Bug 897094 - Mismatched parenthesis in some CSS functions do not prevent parsing of subsequent CSS properties. r=heycam

This commit is contained in:
Max Vujovic 2013-07-30 15:38:01 -04:00
parent 50f99a7d61
commit 5498d723b7
3 changed files with 82 additions and 10 deletions

View File

@ -9666,8 +9666,9 @@ CSSParserImpl::ParseTextOverflow(nsCSSValue& aValue)
///////////////////////////////////////////////////////
// transform Parsing Implementation
/* Reads a function list of arguments. Do not call this function
* directly; it's mean to be caled from ParseFunction.
/* Reads a function list of arguments and consumes the closing parenthesis.
* Do not call this function directly; it's meant to be called from
* ParseFunction.
*/
bool
CSSParserImpl::ParseFunctionInternals(const int32_t aVariantMask[],
@ -9684,21 +9685,28 @@ CSSParserImpl::ParseFunctionInternals(const int32_t aVariantMask[],
nsCSSValue newValue;
int32_t m = aVariantMaskAll ? aVariantMaskAll : aVariantMask[index];
if (!ParseVariant(newValue, m, nullptr)) {
return false;
break;
}
aOutput.AppendElement(newValue);
// See whether to continue or whether to look for end of function.
if (!ExpectSymbol(',', true)) {
// We need to read the closing parenthesis, and also must take care
// that we haven't read too few symbols.
return ExpectSymbol(')', true) && (index + 1) >= aMinElems;
if (ExpectSymbol(',', true)) {
// Move on to the next argument if we see a comma.
continue;
}
if (ExpectSymbol(')', true)) {
// Make sure we've read enough symbols if we see a closing parenthesis.
return (index + 1) >= aMinElems;
}
// Only a comma or a closing parenthesis is valid after an argument.
break;
}
// If we're here, we finished looping without hitting the end, so we read too
// many elements.
// If we're here, we've hit an error without seeing a closing parenthesis or
// we've read too many elements without seeing a closing parenthesis.
SkipUntil(')');
return false;
}

View File

@ -97,6 +97,7 @@ MOCHITEST_FILES = test_acid3_test46.html \
test_default_computed_style.html \
test_css_cross_domain.html \
test_css_eof_handling.html \
test_css_function_mismatched_parenthesis.html \
test_css_supports.html \
test_default_bidi_css.html \
test_descriptor_storage.html \

View File

@ -0,0 +1,63 @@
<!DOCTYPE HTML>
<html>
<!--
https://bugzilla.mozilla.org/show_bug.cgi?id=897094
This test verifies that:
(1) Mismatched parentheses in a CSS function prevent parsing of subsequent CSS
properties.
(2) Properly matched parentheses do not prevent parsing of subsequent CSS
properties.
-->
<head>
<title>Test for Bug 897094</title>
<script type="text/javascript" src="/MochiKit/MochiKit.js"></script>
<script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
<link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
</head>
<body>
<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=897094">Mozilla Bug 897094</a>
<p id="display"></p>
<div id="content" style="display: none">
<div id="target"></div>
</div>
<pre id="test">
<script class="testbody" type="text/javascript">
/** Test for Bug 897094 **/
function check_parens(declaration, parens_are_balanced)
{
var element = document.getElementById("target");
element.setAttribute("style",
"background-color: " + (parens_are_balanced ? "red" : "green") + "; " +
declaration + "; " +
"background-color: " + (parens_are_balanced ? "green" : "red") + "; ");
var resultColor = element.style.getPropertyValue("background-color");
is(resultColor, "green", "parenthesis balancing within " + declaration);
}
check_parens("transform: scale()", true);
check_parens("transform: scale(", false);
check_parens("transform: scale(,)", true);
check_parens("transform: scale(,", false);
check_parens("transform: scale(1)", true);
check_parens("transform: scale(1", false);
check_parens("transform: scale(1,)", true);
check_parens("transform: scale(1,", false);
check_parens("transform: scale(1,1)", true);
check_parens("transform: scale(1,1", false);
check_parens("transform: scale(1,1,)", true);
check_parens("transform: scale(1,1,", false);
check_parens("transform: scale(1,1,1)", true);
check_parens("transform: scale(1,1,1", false);
check_parens("transform: scale(1,1,1,)", true);
check_parens("transform: scale(1,1,1,", false);
check_parens("transform: scale(1px)", true);
check_parens("transform: scale(1px", false);
check_parens("transform: scale(1px,)", true);
check_parens("transform: scale(1px,", false);
</script>
</pre>
</body>
</html>