Changeset 24936 in webkit

Timestamp:

Aug 8, 2007, 10:37:24 AM (18 years ago)

Author:

antti

Message:

LayoutTests:

Reviewed by Darin.

Test for <rdar://problem/5391576>
Malformed table innerHTML causes Safari to crash in HTMLParser::handleError (14894)

• fast/table/incomplete-table-in-fragment-2-expected.txt: Added.
• fast/table/incomplete-table-in-fragment-2.html: Added.

WebCore:

Reviewed by Darin.

Fix for <rdar://problem/5391576>
Malformed table innerHTML causes Safari to crash in HTMLParser::handleError (14894)

Add null checks to protect against

e.innerHTML = "<tr>text</tr>";

type cases. Normal assumptions about document tree structure don't hold when parsing
fragments. Results don't match Firefox in all cases. It seems to have some sort of
anything-goes fragment parsing mode.

• html/HTMLParser.cpp: (WebCore::HTMLParser::handleError):

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/table/incomplete-table-in-fragment-2-expected.txt (added)
• LayoutTests/fast/table/incomplete-table-in-fragment-2.html (added)
• WebCore/ChangeLog (modified) (1 diff)
• WebCore/html/HTMLParser.cpp (modified) (2 diffs)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2007-08-08  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Darin.
+        
+        Test for <rdar://problem/5391576>
+        Malformed table innerHTML causes Safari to crash in HTMLParser::handleError (14894)
+
+        * fast/table/incomplete-table-in-fragment-2-expected.txt: Added.
+        * fast/table/incomplete-table-in-fragment-2.html: Added.
+
 2007-08-07  Kevin McCullough  <kmccullough@apple.com>
 

trunk/WebCore/ChangeLog

@@ +1 @@
+2007-08-08  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Darin.
+        
+        Fix for <rdar://problem/5391576>
+        Malformed table innerHTML causes Safari to crash in HTMLParser::handleError (14894)
+        
+        Add null checks to protect against 
+        
+        e.innerHTML = "<tr>text</tr>";
+        
+        type cases. Normal assumptions about document tree structure don't hold when parsing 
+        fragments. Results don't match Firefox in all cases. It seems to have some sort of 
+        anything-goes fragment parsing mode.
+        
+        * html/HTMLParser.cpp:
+        (WebCore::HTMLParser::handleError):
+
 2007-08-07  Kevin McCullough  <kmccullough@apple.com>
 

trunk/WebCore/html/HTMLParser.cpp

@@ -529 +529 @@
                 if (n->isTextNode() ||
                     (h->hasLocalName(trTag) &&
-                     isTableSection(parent) && grandparent->hasTagName(tableTag)) ||
+                     isTableSection(parent) && grandparent && grandparent->hasTagName(tableTag)) ||
                      ((!n->hasTagName(tdTag) && !n->hasTagName(thTag) &&
                        !n->hasTagName(formTag) && !n->hasTagName(scriptTag)) && isTableSection(node) &&
@@ -535 +535 @@
                     node = (node->hasTagName(tableTag)) ? node :
                             ((node->hasTagName(trTag)) ? grandparent : parent);
+                    // This can happen with fragments
+                    if (!node)
+                        return false;
                     Node* parent = node->parentNode();
                     if (!parent)