Crash on incomplete :not().
https://bugs.webkit.org/show_bug.cgi?id=86673
Patch by Yong Li <yoli@rim.com> on 2012-05-28
Reviewed by Antti Koivisto.
Source/WebCore:
Add back null-checks for incomplete :not() class
which were dropped by r81845.
* css/CSSSelector.cpp:
(WebCore::CSSSelector::specificityForOneSelector):
(WebCore::CSSSelector::selectorText):
* css/SelectorChecker.cpp:
(WebCore::SelectorChecker::checkOneSelector):
(WebCore::SelectorChecker::determineLinkMatchType):
LayoutTests:
Add a test case that makes CSS parser create incomplete
:not selector.
* fast/css/crash-on-incomplete-not.html: Added.
* fast/css/crash-on-incomplete-not-expected.txt: Added.
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@118703 268f45cc-cd09-0410-ab3c-d52691b4dbfc
diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index 89b73a2..2c4cb43 100644
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,16 @@
+2012-05-28 Yong Li <yoli@rim.com>
+
+ Crash on incomplete :not().
+ https://bugs.webkit.org/show_bug.cgi?id=86673
+
+ Reviewed by Antti Koivisto.
+
+ Add a test case that makes CSS parser create incomplete
+ :not selector.
+
+ * fast/css/crash-on-incomplete-not.html: Added.
+ * fast/css/crash-on-incomplete-not-expected.txt: Added.
+
2012-05-28 Marcus Bulach <bulach@chromium.org>
[chromium] Adjust expectations for fast/layers/clip-rects-assertion-expected.txt
diff --git a/LayoutTests/fast/css/crash-on-incomplete-not-expected.txt b/LayoutTests/fast/css/crash-on-incomplete-not-expected.txt
new file mode 100644
index 0000000..f381830
--- /dev/null
+++ b/LayoutTests/fast/css/crash-on-incomplete-not-expected.txt
@@ -0,0 +1 @@
+PASS without crash.
diff --git a/LayoutTests/fast/css/crash-on-incomplete-not.html b/LayoutTests/fast/css/crash-on-incomplete-not.html
new file mode 100644
index 0000000..8d9cf9f
--- /dev/null
+++ b/LayoutTests/fast/css/crash-on-incomplete-not.html
@@ -0,0 +1,23 @@
+<html>
+<head>
+<style id="m"></style>
+</head>
+<body>
+<script>
+ var g = ":not\\( .title{}";
+ var me = document.getElementById("m");
+ window.setTimeout(runTest,0);
+ function runTest(){
+ me.textContent=g;
+ if (window.layoutTestController) {
+ layoutTestController.notifyDone();
+ }
+ }
+ if (window.layoutTestController) {
+ layoutTestController.dumpAsText();
+ layoutTestController.waitUntilDone();
+ }
+</script>
+<p>PASS without crash.</p>
+</body>
+</html>
diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
index 7e6600ff..56847d2 100644
--- a/Source/WebCore/ChangeLog
+++ b/Source/WebCore/ChangeLog
@@ -1,3 +1,20 @@
+2012-05-28 Yong Li <yoli@rim.com>
+
+ Crash on incomplete :not().
+ https://bugs.webkit.org/show_bug.cgi?id=86673
+
+ Reviewed by Antti Koivisto.
+
+ Add back null-checks for incomplete :not() class
+ which were dropped by r81845.
+
+ * css/CSSSelector.cpp:
+ (WebCore::CSSSelector::specificityForOneSelector):
+ (WebCore::CSSSelector::selectorText):
+ * css/SelectorChecker.cpp:
+ (WebCore::SelectorChecker::checkOneSelector):
+ (WebCore::SelectorChecker::determineLinkMatchType):
+
2012-05-28 Leo Yang <leo.yang@torchmobile.com.cn>
FileWriterSync binding should have no static table
diff --git a/Source/WebCore/css/CSSSelector.cpp b/Source/WebCore/css/CSSSelector.cpp
index 5bc0ee3..13479b6 100644
--- a/Source/WebCore/css/CSSSelector.cpp
+++ b/Source/WebCore/css/CSSSelector.cpp
@@ -81,10 +81,9 @@
case End:
// FIXME: PsuedoAny should base the specificity on the sub-selectors.
// See http://lists.w3.org/Archives/Public/www-style/2010Sep/0530.html
- if (pseudoType() == PseudoNot) {
- ASSERT(selectorList());
+ if (pseudoType() == PseudoNot && selectorList())
s += selectorList()->first()->specificityForOneSelector();
- } else
+ else
s += 0x100;
case None:
break;
@@ -544,8 +543,8 @@
switch (cs->pseudoType()) {
case PseudoNot:
- ASSERT(cs->selectorList());
- str += cs->selectorList()->first()->selectorText();
+ if (CSSSelectorList* selectorList = cs->selectorList())
+ str += selectorList->first()->selectorText();
str += ")";
break;
case PseudoLang:
diff --git a/Source/WebCore/css/SelectorChecker.cpp b/Source/WebCore/css/SelectorChecker.cpp
index 08c3e3b..3be4d9f 100644
--- a/Source/WebCore/css/SelectorChecker.cpp
+++ b/Source/WebCore/css/SelectorChecker.cpp
@@ -732,10 +732,15 @@
if (selector->m_match == CSSSelector::PseudoClass) {
// Handle :not up front.
if (selector->pseudoType() == CSSSelector::PseudoNot) {
- ASSERT(selector->selectorList());
+ CSSSelectorList* selectorList = selector->selectorList();
+
+ // FIXME: We probably should fix the parser and make it never produce :not rules with missing selector list.
+ if (!selectorList)
+ return false;
+
SelectorCheckingContext subContext(context);
subContext.isSubSelector = true;
- for (subContext.selector = selector->selectorList()->first(); subContext.selector; subContext.selector = subContext.selector->tagHistory()) {
+ for (subContext.selector = selectorList->first(); subContext.selector; subContext.selector = subContext.selector->tagHistory()) {
// :not cannot nest. I don't really know why this is a
// restriction in CSS3, but it is, so let's honor it.
// the parser enforces that this never occurs
@@ -1324,13 +1329,19 @@
for (; selector; selector = selector->tagHistory()) {
switch (selector->pseudoType()) {
case CSSSelector::PseudoNot:
- // :not(:visited) is equivalent to :link. Parser enforces that :not can't nest.
- for (CSSSelector* subSelector = selector->selectorList()->first(); subSelector; subSelector = subSelector->tagHistory()) {
- CSSSelector::PseudoType subType = subSelector->pseudoType();
- if (subType == CSSSelector::PseudoVisited)
- linkMatchType &= ~SelectorChecker::MatchVisited;
- else if (subType == CSSSelector::PseudoLink)
- linkMatchType &= ~SelectorChecker::MatchLink;
+ {
+ // :not(:visited) is equivalent to :link. Parser enforces that :not can't nest.
+ CSSSelectorList* selectorList = selector->selectorList();
+ if (!selectorList)
+ break;
+
+ for (CSSSelector* subSelector = selectorList->first(); subSelector; subSelector = subSelector->tagHistory()) {
+ CSSSelector::PseudoType subType = subSelector->pseudoType();
+ if (subType == CSSSelector::PseudoVisited)
+ linkMatchType &= ~SelectorChecker::MatchVisited;
+ else if (subType == CSSSelector::PseudoLink)
+ linkMatchType &= ~SelectorChecker::MatchLink;
+ }
}
break;
case CSSSelector::PseudoLink:
