Title: [286220] trunk
- Revision
- 286220
- Author
- commit-qu...@webkit.org
- Date
- 2021-11-29 10:10:34 -0800 (Mon, 29 Nov 2021)
Log Message
Only handle ident tokens in consumeWillChange
https://bugs.webkit.org/show_bug.cgi?id=233459
Patch by Rob Buis <rb...@igalia.com> on 2021-11-29
Reviewed by Antti Koivisto.
Source/WebCore:
Only handle ident tokens in consumeWillChange.
Test: fast/css/variables/will-change-variable-resolve-crash.html
* css/parser/CSSPropertyParser.cpp:
(WebCore::consumeWillChange):
LayoutTests:
* fast/css/variables/will-change-variable-resolve-crash-expected.txt: Added.
* fast/css/variables/will-change-variable-resolve-crash.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (286219 => 286220)
--- trunk/LayoutTests/ChangeLog 2021-11-29 17:58:55 UTC (rev 286219)
+++ trunk/LayoutTests/ChangeLog 2021-11-29 18:10:34 UTC (rev 286220)
@@ -1,3 +1,13 @@
+2021-11-29 Rob Buis <rb...@igalia.com>
+
+ Only handle ident tokens in consumeWillChange
+ https://bugs.webkit.org/show_bug.cgi?id=233459
+
+ Reviewed by Antti Koivisto.
+
+ * fast/css/variables/will-change-variable-resolve-crash-expected.txt: Added.
+ * fast/css/variables/will-change-variable-resolve-crash.html: Added.
+
2021-10-27 Sergio Villar Senin <svil...@igalia.com>
[css-flexbox] Do not shrink tables bellow their intrinsic sizes
Added: trunk/LayoutTests/fast/css/variables/will-change-variable-resolve-crash-expected.txt (0 => 286220)
--- trunk/LayoutTests/fast/css/variables/will-change-variable-resolve-crash-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/css/variables/will-change-variable-resolve-crash-expected.txt 2021-11-29 18:10:34 UTC (rev 286220)
@@ -0,0 +1 @@
+This test passes if it doesn't crash.
Added: trunk/LayoutTests/fast/css/variables/will-change-variable-resolve-crash.html (0 => 286220)
--- trunk/LayoutTests/fast/css/variables/will-change-variable-resolve-crash.html (rev 0)
+++ trunk/LayoutTests/fast/css/variables/will-change-variable-resolve-crash.html 2021-11-29 18:10:34 UTC (rev 286220)
@@ -0,0 +1,7 @@
+<style></style>
+<script>
+ if (window.testRunner)
+ testRunner.dumpAsText();
+ document.styleSheets[0].insertRule(`html { will-change: var(--v0); --v0: .; text-emphasis-style: "\x00";}`);
+ document.write("This test passes if it doesn't crash.");
+</script>
Modified: trunk/Source/WebCore/ChangeLog (286219 => 286220)
--- trunk/Source/WebCore/ChangeLog 2021-11-29 17:58:55 UTC (rev 286219)
+++ trunk/Source/WebCore/ChangeLog 2021-11-29 18:10:34 UTC (rev 286220)
@@ -1,3 +1,17 @@
+2021-11-29 Rob Buis <rb...@igalia.com>
+
+ Only handle ident tokens in consumeWillChange
+ https://bugs.webkit.org/show_bug.cgi?id=233459
+
+ Reviewed by Antti Koivisto.
+
+ Only handle ident tokens in consumeWillChange.
+
+ Test: fast/css/variables/will-change-variable-resolve-crash.html
+
+ * css/parser/CSSPropertyParser.cpp:
+ (WebCore::consumeWillChange):
+
2021-11-29 Youenn Fablet <you...@apple.com>
Apply WebPreferences on ServiceWorker settings
Modified: trunk/Source/WebCore/css/parser/CSSPropertyParser.cpp (286219 => 286220)
--- trunk/Source/WebCore/css/parser/CSSPropertyParser.cpp 2021-11-29 17:58:55 UTC (rev 286219)
+++ trunk/Source/WebCore/css/parser/CSSPropertyParser.cpp 2021-11-29 18:10:34 UTC (rev 286220)
@@ -508,6 +508,8 @@
case CSSValueAuto:
return nullptr;
default:
+ if (range.peek().type() != IdentToken)
+ return nullptr;
CSSPropertyID propertyID = cssPropertyID(range.peek().value());
if (propertyID == CSSPropertyWillChange)
return nullptr;
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes
