Skip to content

GitLab

T
tangled
Commit 3893eed2 authored by bratell@opera.com's avatar bratell@opera.com
Browse files
Options

Followup to CSSTokenizer memory usage optimization 

Make sure to measure the same input string as we're going to parse.

BUG=358667,352544

Review URL: https://codereview.chromium.org/220113006

git-svn-id: svn://svn.chromium.org/blink/trunk@170636 bbb929c8-8fbe-4397-9dbb-9b2b20218538
parent 503e4510
Hide whitespace changes
Inline Side-by-side
Showing with 19 additions and 4 deletions
third_party/WebKit/LayoutTests/fast/css/css-escaped-identifier-crash-expected.txt 0 → 100644
View file @ 3893eed2
Test for crash discovered with escapes in CSS identifiers. If this text appears, the test passed.
third_party/WebKit/LayoutTests/fast/css/css-escaped-identifier-crash.html 0 → 100644
View file @ 3893eed2
<html>
<head>
<style>foo { D\\\\\$\eeeeeeeeeee\\\\\\\\\\\\\\\\\\ }</style>
<script>
if (window.testRunner)
testRunner.dumpAsText();
</script>
</head>
<body>
<p>
Test for crash discovered with escapes in CSS identifiers. If this text appears, the test passed.
</p>
</body>
</html>
third_party/WebKit/Source/core/css/CSSTokenizer-in.cpp
View file @ 3893eed2
......@@ -492,7 +492,7 @@ inline void CSSTokenizer::parseIdentifier(CharacterType*& result, CSSParserStrin
if (UNLIKELY(!parseIdentifierInternal(currentCharacter<CharacterType>(), result, hasEscape))) {
// Found an escape we couldn't handle with 8 bits, copy what has been recognized and continue
ASSERT(is8BitSource());
UChar* result16 = allocateStringBuffer16((result - start) + peekMaxIdentifierLen(result));
UChar* result16 = allocateStringBuffer16((result - start) + peekMaxIdentifierLen(currentCharacter<CharacterType>()));
UChar* start16 = result16;
int i = 0;
for (; i < result - start; i++)
......@@ -565,7 +565,7 @@ inline void CSSTokenizer::parseString(CharacterType*& result, CSSParserString& r
if (UNLIKELY(!parseStringInternal(currentCharacter<CharacterType>(), result, quote))) {
// Found an escape we couldn't handle with 8 bits, copy what has been recognized and continue
ASSERT(is8BitSource());
UChar* result16 = allocateStringBuffer16((result - start) + peekMaxStringLen(result, quote));
UChar* result16 = allocateStringBuffer16((result - start) + peekMaxStringLen(currentCharacter<CharacterType>(), quote));
UChar* start16 = result16;
int i = 0;
for (; i < result - start; i++)
......@@ -675,9 +675,9 @@ inline void CSSTokenizer::parseURI(CSSParserString& string)
// Reset the current character to the start of the URI and re-parse with
// a 16-bit destination.
ASSERT(is8BitSource());
UChar* result16 = allocateStringBuffer16(peekMaxURILen(uriStart, quote));
UChar* uriStart16 = result16;
currentCharacter<CharacterType>() = uriStart;
UChar* result16 = allocateStringBuffer16(peekMaxURILen(currentCharacter<CharacterType>(), quote));
UChar* uriStart16 = result16;
bool result = parseURIInternal(currentCharacter<CharacterType>(), result16, quote);
ASSERT_UNUSED(result, result);
string.init(uriStart16, result16 - uriStart16);
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment