Crash on incomplete :not().
https://bugs.webkit.org/show_bug.cgi?id=86673
Patch by Yong Li <yoli@rim.com> on 2012-05-28
Reviewed by Antti Koivisto.
Source/WebCore:
Add back null-checks for incomplete :not() class
which were dropped by r81845.
* css/CSSSelector.cpp:
(WebCore::CSSSelector::specificityForOneSelector):
(WebCore::CSSSelector::selectorText):
* css/SelectorChecker.cpp:
(WebCore::SelectorChecker::checkOneSelector):
(WebCore::SelectorChecker::determineLinkMatchType):
LayoutTests:
Add a test case that makes CSS parser create incomplete
:not selector.
* fast/css/crash-on-incomplete-not.html: Added.
* fast/css/crash-on-incomplete-not-expected.txt: Added.
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@118703 268f45cc-cd09-0410-ab3c-d52691b4dbfc
diff --git a/LayoutTests/fast/css/crash-on-incomplete-not.html b/LayoutTests/fast/css/crash-on-incomplete-not.html
new file mode 100644
index 0000000..8d9cf9f
--- /dev/null
+++ b/LayoutTests/fast/css/crash-on-incomplete-not.html
@@ -0,0 +1,23 @@
+<html>
+<head>
+<style id="m"></style>
+</head>
+<body>
+<script>
+ var g = ":not\\( .title{}";
+ var me = document.getElementById("m");
+ window.setTimeout(runTest,0);
+ function runTest(){
+ me.textContent=g;
+ if (window.layoutTestController) {
+ layoutTestController.notifyDone();
+ }
+ }
+ if (window.layoutTestController) {
+ layoutTestController.dumpAsText();
+ layoutTestController.waitUntilDone();
+ }
+</script>
+<p>PASS without crash.</p>
+</body>
+</html>
