Changeset 149106 in webkit

Timestamp:

Apr 25, 2013 6:43:33 AM (11 years ago)

Author:

akling@apple.com

Message:

CSS parser: Add error recovery while parsing @-webkit-keyframes key values.
<​http://webkit.org/b/115175>

Source/WebCore:

From Blink r148714 by <​apavlov@chromium.org>:

If not a percentage, "from", or "to" value is used in a key list, the rule is erroneous,
and due to the absense of recovery, the parser skips the following, valid CSS rule.

On a related note, keyframes, whose selectors contain invalid keys, should be discarded
altogether, according to <​http://www.w3.org/TR/css3-animations/#keyframes>

Tests: animations/keyframes-invalid-keys.html

fast/css/webkit-keyframes-errors.html

• css/CSSGrammar.y.in:
• css/CSSParser.cpp:

(WebCore::CSSParser::rewriteSpecifiers):

LayoutTests:

From Blink r148714 by <​apavlov@chromium.org>.

• animations/keyframes-invalid-keys-expected.txt: Added.
• animations/keyframes-invalid-keys.html: Added.
• fast/css/webkit-keyframes-errors-expected.html: Added.
• fast/css/webkit-keyframes-errors.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/animations/keyframes-invalid-keys-expected.txt (added)
• LayoutTests/animations/keyframes-invalid-keys.html (added)
• LayoutTests/fast/css/webkit-keyframes-errors-expected.html (added)
• LayoutTests/fast/css/webkit-keyframes-errors.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/css/CSSGrammar.y.in (modified) (1 diff)
• Source/WebCore/css/CSSParser.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2013-04-25  Andreas Kling  <akling@apple.com>
+
+        CSS parser: Add error recovery while parsing @-webkit-keyframes key values.
+        <http://webkit.org/b/115175>
+
+        From Blink r148714 by <apavlov@chromium.org>.
+
+        * animations/keyframes-invalid-keys-expected.txt: Added.
+        * animations/keyframes-invalid-keys.html: Added.
+        * fast/css/webkit-keyframes-errors-expected.html: Added.
+        * fast/css/webkit-keyframes-errors.html: Added.
+
 2013-04-25  Ádám Kallai  <kadam@inf.u-szeged.hu>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2013-04-25  Andreas Kling  <akling@apple.com>
+
+        CSS parser: Add error recovery while parsing @-webkit-keyframes key values.
+        <http://webkit.org/b/115175>
+
+        From Blink r148714 by <apavlov@chromium.org>:
+
+        If not a percentage, "from", or "to" value is used in a key list, the rule is erroneous,
+        and due to the absense of recovery, the parser skips the following, valid CSS rule.
+
+        On a related note, keyframes, whose selectors contain invalid keys, should be discarded
+        altogether, according to <http://www.w3.org/TR/css3-animations/#keyframes>
+
+        Tests: animations/keyframes-invalid-keys.html
+               fast/css/webkit-keyframes-errors.html
+
+        * css/CSSGrammar.y.in:
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::rewriteSpecifiers):
+
 2013-04-25  Antti Koivisto  <antti@apple.com>
 

trunk/Source/WebCore/css/CSSGrammar.y.in

@@ -877 +877 @@
         else if (str.equalIgnoringCase("to"))
             $$.fValue = 100;
-        else
+        else {
+            $$.unit = 0;
             YYERROR;
+        }
+    }
+    | error {
+        $$.unit = 0;
     }
     ;

trunk/Source/WebCore/css/CSSParser.cpp

@@ -11792 +11792 @@
     StringBuilder keyString;
     for (unsigned i = 0; i < keys->size(); ++i) {
+        // Just as per the comment below, we ignore keyframes with
+        // invalid key values (plain numbers or unknown identifiers)
+        // marked as CSSPrimitiveValue::CSS_UNKNOWN during parsing.
+        if (keys->valueAt(i)->unit == CSSPrimitiveValue::CSS_UNKNOWN) {
+            clearProperties();
+            return 0;
+        }
+
+        ASSERT(keys->valueAt(i)->unit == CSSPrimitiveValue::CSS_NUMBER);
         float key = static_cast<float>(keys->valueAt(i)->fValue);
+        if (key < 0 || key > 100) {
+            // As per http://www.w3.org/TR/css3-animations/#keyframes,
+            // "If a keyframe selector specifies negative percentage values
+            // or values higher than 100%, then the keyframe will be ignored."
+            clearProperties();
+            return 0;
+        }
         if (i != 0)
             keyString.append(',');