Changeset 96471 in webkit

Timestamp:

Oct 2, 2011, 1:25:34 AM (14 years ago)

Author:

mitz@apple.com

Message:

REGRESSION (r95502): Assertion failure in CSSPrimitiveValue::computeLengthDouble() when media query specifies unit-less length
​https://bugs.webkit.org/show_bug.cgi?id=68760

Reviewed by Antti Koivisto.

Source/WebCore:

Test: fast/media/invalid-lengths.html

Made length-comparison media queries accept only length values. In compatibility mode, numbers
are allowed as well, and they are interpreted as pixels.

• css/MediaQueryEvaluator.cpp:

(WebCore::computeLength): Added this helper function.
(WebCore::device_heightMediaFeatureEval): Changed to use computeLength().
(WebCore::device_widthMediaFeatureEval): Ditto.
(WebCore::heightMediaFeatureEval): Ditto.
(WebCore::widthMediaFeatureEval): Ditto.

LayoutTests:

• fast/media/invalid-lengths-expected.txt: Added.
• fast/media/invalid-lengths.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/media/invalid-lengths-expected.txt (added)
• LayoutTests/fast/media/invalid-lengths.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/css/MediaQueryEvaluator.cpp (modified) (5 diffs)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2011-10-02  Dan Bernstein  <mitz@apple.com>
+
+        REGRESSION (r95502): Assertion failure in CSSPrimitiveValue::computeLengthDouble() when media query specifies unit-less length
+        https://bugs.webkit.org/show_bug.cgi?id=68760
+
+        Reviewed by Antti Koivisto.
+
+        * fast/media/invalid-lengths-expected.txt: Added.
+        * fast/media/invalid-lengths.html: Added.
+
 2011-10-02  Dirk Schulze  <krit@webkit.org>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2011-10-02  Dan Bernstein  <mitz@apple.com>
+
+        REGRESSION (r95502): Assertion failure in CSSPrimitiveValue::computeLengthDouble() when media query specifies unit-less length
+        https://bugs.webkit.org/show_bug.cgi?id=68760
+
+        Reviewed by Antti Koivisto.
+
+        Test: fast/media/invalid-lengths.html
+
+        Made length-comparison media queries accept only length values. In compatibility mode, numbers
+        are allowed as well, and they are interpreted as pixels.
+
+        * css/MediaQueryEvaluator.cpp:
+        (WebCore::computeLength): Added this helper function.
+        (WebCore::device_heightMediaFeatureEval): Changed to use computeLength().
+        (WebCore::device_widthMediaFeatureEval): Ditto.
+        (WebCore::heightMediaFeatureEval): Ditto.
+        (WebCore::widthMediaFeatureEval): Ditto.
+
 2011-10-02  Dirk Schulze  <krit@webkit.org>
 

trunk/Source/WebCore/css/MediaQueryEvaluator.cpp

@@ -307 +307 @@
 }
 
+static bool computeLength(CSSValue* value, bool strict, RenderStyle* style, RenderStyle* rootStyle, int& result)
+{
+    if (!value->isPrimitiveValue())
+        return false;
+
+    CSSPrimitiveValue* primitiveValue = static_cast<CSSPrimitiveValue*>(value);
+
+    if (primitiveValue->primitiveType() == CSSPrimitiveValue::CSS_NUMBER) {
+        result = primitiveValue->getIntValue();
+        return !strict || !result;
+    }
+
+    if (primitiveValue->isLength()) {
+        result = primitiveValue->computeLength<int>(style, rootStyle);
+        return true;
+    }
+
+    return false;
+}
+
 static bool device_heightMediaFeatureEval(CSSValue* value, RenderStyle* style, Frame* frame, MediaFeaturePrefix op)
 {
@@ -312 +332 @@
         FloatRect sg = screenRect(frame->page()->mainFrame()->view());
         RenderStyle* rootStyle = frame->document()->documentElement()->renderStyle();
-        return value->isPrimitiveValue() && compareValue(static_cast<int>(sg.height()), static_cast<CSSPrimitiveValue*>(value)->computeLength<int>(style, rootStyle), op);
+        int length;
+        return computeLength(value, !frame->document()->inQuirksMode(), style, rootStyle, length) && compareValue(static_cast<int>(sg.height()), length, op);
     }
     // ({,min-,max-}device-height)
@@ -324 +345 @@
         FloatRect sg = screenRect(frame->page()->mainFrame()->view());
         RenderStyle* rootStyle = frame->document()->documentElement()->renderStyle();
-        return value->isPrimitiveValue() && compareValue(static_cast<int>(sg.width()), static_cast<CSSPrimitiveValue*>(value)->computeLength<int>(style, rootStyle), op);
+        int length;
+        return computeLength(value, !frame->document()->inQuirksMode(), style, rootStyle, length) && compareValue(static_cast<int>(sg.width()), length, op);
     }
     // ({,min-,max-}device-width)
@@ -334 +356 @@
 {
     FrameView* view = frame->view();
-    RenderStyle* rootStyle = frame->document()->documentElement()->renderStyle();
-
-    if (value)
-        return value->isPrimitiveValue() && compareValue(view->layoutHeight(), static_cast<CSSPrimitiveValue*>(value)->computeLength<int>(style, rootStyle), op);
+
+    if (value) {
+        RenderStyle* rootStyle = frame->document()->documentElement()->renderStyle();
+        int length;
+        return computeLength(value, !frame->document()->inQuirksMode(), style, rootStyle, length) && compareValue(view->layoutHeight(), length, op);
+    }
 
     return view->layoutHeight() != 0;
@@ -345 +369 @@
 {
     FrameView* view = frame->view();
-    RenderStyle* rootStyle = frame->document()->documentElement()->renderStyle();
-
-    if (value)
-        return value->isPrimitiveValue() && compareValue(view->layoutWidth(), static_cast<CSSPrimitiveValue*>(value)->computeLength<int>(style, rootStyle), op);
+
+    if (value) {
+        RenderStyle* rootStyle = frame->document()->documentElement()->renderStyle();
+        int length;
+        return computeLength(value, !frame->document()->inQuirksMode(), style, rootStyle, length) && compareValue(view->layoutWidth(), length, op);
+    }
 
     return view->layoutWidth() != 0;