Changeset 55914 in webkit

Timestamp:

Mar 12, 2010 10:28:56 AM (14 years ago)

Author:

mitz@apple.com

Message:

<rdar://problem/7725534> CSSPrimitiveValue::parserValue() returns deleted memory
​https://bugs.webkit.org/show_bug.cgi?id=20069

Reviewed by Darin Adler.

No test added, since with the CSS variables feature disabled, the pointer
to the freed memory is never dereferenced.

• css/CSSPrimitiveValue.cpp:

(WebCore::valueOrPropertyName): Changed to return a const AtomicString& from
a static table.
(WebCore::CSSPrimitiveValue::parserValue): Updated for the above change.

Location:

trunk/WebCore

Files:

• ChangeLog (modified) (1 diff)
• css/CSSPrimitiveValue.cpp (modified) (2 diffs)

trunk/WebCore/ChangeLog

@@ +1 @@
+2010-03-12  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/7725534> CSSPrimitiveValue::parserValue() returns deleted memory
+        https://bugs.webkit.org/show_bug.cgi?id=20069
+
+        No test added, since with the CSS variables feature disabled, the pointer
+        to the freed memory is never dereferenced.
+
+        * css/CSSPrimitiveValue.cpp:
+        (WebCore::valueOrPropertyName): Changed to return a const AtomicString& from
+        a static table.
+        (WebCore::CSSPrimitiveValue::parserValue): Updated for the above change.
+
 2010-03-12  Dan Bernstein  <mitz@apple.com>
 

trunk/WebCore/css/CSSPrimitiveValue.cpp

@@ -117 +117 @@
 }
 
-static const char* valueOrPropertyName(int valueOrPropertyID)
-{
-    if (const char* valueName = getValueName(valueOrPropertyID))
-        return valueName;
-    return getPropertyName(static_cast<CSSPropertyID>(valueOrPropertyID));
+static const AtomicString& valueOrPropertyName(int valueOrPropertyID)
+{
+    ASSERT_ARG(valueOrPropertyID, valueOrPropertyID >= 0);
+    ASSERT_ARG(valueOrPropertyID, valueOrPropertyID < numCSSValueKeywords || (valueOrPropertyID >= firstCSSProperty && valueOrPropertyID < firstCSSProperty + numCSSProperties));
+
+    if (valueOrPropertyID < 0)
+        return nullAtom;
+
+    if (valueOrPropertyID < numCSSValueKeywords) {
+        static AtomicString* cssValueKeywordStrings[numCSSValueKeywords];
+        if (!cssValueKeywordStrings[valueOrPropertyID])
+            cssValueKeywordStrings[valueOrPropertyID] = new AtomicString(getValueName(valueOrPropertyID));
+        return *cssValueKeywordStrings[valueOrPropertyID];
+    }
+
+    if (valueOrPropertyID >= firstCSSProperty && valueOrPropertyID < firstCSSProperty + numCSSProperties) {
+        static AtomicString* cssPropertyStrings[numCSSProperties];
+        int propertyIndex = valueOrPropertyID - firstCSSProperty;
+        if (!cssPropertyStrings[propertyIndex])
+            cssPropertyStrings[propertyIndex] = new AtomicString(getPropertyName(static_cast<CSSPropertyID>(valueOrPropertyID)));
+        return *cssPropertyStrings[propertyIndex];
+    }
+
+    return nullAtom;
 }
 
@@ -931 +950 @@
         case CSS_IDENT: {
             value.id = m_value.ident;
-            String name = valueOrPropertyName(m_value.ident);
+            const AtomicString& name = valueOrPropertyName(m_value.ident);
             value.string.characters = const_cast<UChar*>(name.characters());
             value.string.length = name.length();