Changeset 130721 in webkit

Timestamp:

Oct 8, 2012, 11:01:09 PM (14 years ago)

Author:

yosin@chromium.org

Message:

Merge 130717 - HTMLSelectElement::typeAheadFind depends on implementation dependent behavior
​https://bugs.webkit.org/show_bug.cgi?id=98710

Reviewed by Kent Tamura.

Source/WebCore:

This patch gets rid of C/C++ implementation dependent behavior from
HTMLSelectElement::typeAheadFind() which does modulo operation with
a negative operand.

HTMLSelectElement::typeAheadFind() contains expression with modulo
operator and dividend can be -1 when the "select" element without
"option" element but "optgroup" element.

Test: fast/forms/select/select-typeahead-crash.html

• html/HTMLSelectElement.cpp:

(WebCore::HTMLSelectElement::typeAheadFind): Changed to do modulo
operation with both operands are non-negative.

LayoutTests:

This patch adds a test for checking HTMLSelectElement::typeAheadFind
doesn't crash.

• fast/forms/select/select-typeahead-crash-expected.txt: Added.
• fast/forms/select/select-typeahead-crash.html: Added.

TBR=​yosin@chromium.org
Review URL: ​https://codereview.chromium.org/11088020

Location:

branches/chromium/1271

Files:

• LayoutTests/fast/forms/select/select-typeahead-crash-expected.txt (copied) (copied from trunk/LayoutTests/fast/forms/select/select-typeahead-crash-expected.txt )
• LayoutTests/fast/forms/select/select-typeahead-crash.html (copied) (copied from trunk/LayoutTests/fast/forms/select/select-typeahead-crash.html )
• Source/WebCore/html/HTMLSelectElement.cpp (modified) (1 diff)

branches/chromium/1271/Source/WebCore/html/HTMLSelectElement.cpp

@@ -1515 +1515 @@
 
     int selected = selectedIndex();
-    int index = (optionToListIndex(selected >= 0 ? selected : 0) + searchStartOffset) % itemCount;
-    ASSERT(index >= 0);
+    int index = optionToListIndex(selected >= 0 ? selected : 0) + searchStartOffset;
+    if (index < 0)
+        return;
+    index %= itemCount;
 
     // Compute a case-folded copy of the prefix string before beginning the search for