[Crash] Null pointer in CSSParser::parseMixFunction()

[Michelangelo De Simone]

Crashes may arise within parseMixFunction() when the arguments of the mix() function are comma terminated.

[Michelangelo De Simone]

Created attachment 160555 [details]
Patch

[Benjamin Poulain]

Comment on attachment 160555 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=160555&action=review

The patch looks correct.

> Source/WebCore/ChangeLog:3
> +        [Crash] Dangling pointer in CSSParser::parseMixFunction()

The title need to be updated.

> LayoutTests/css3/filters/script-tests/custom-filter-property-parsing-invalid.js:50
> +testInvalidFilterRule("Mix function with comma terminator", "custom(none mix(url(shader), multiply clear,))");

I would also have the minimum parsing that would lead to the crash. probably: mix(,).

[Michelangelo De Simone]

Created attachment 160556 [details]
Patch for landing

[WebKit Review Bot]

Comment on attachment 160556 [details]
Patch for landing

Clearing flags on attachment: 160556

Committed r126681: <http://trac.webkit.org/changeset/126681>

[WebKit Review Bot]

All reviewed patches have been landed.  Closing bug.