Changeset 33492 in webkit

Timestamp:

May 15, 2008 12:49:42 PM (16 years ago)

Author:

jchaffraix@webkit.org

Message:

WebCore:

2008-05-15 Julien Chaffraix <​jchaffraix@webkit.org>

Reviewed by Darin.

​https://bugs.webkit.org/show_bug.cgi?id=13942
ASSERTION FAILED: !attrName.contains('/') in HTMLTokenizer.cpp:132 when loading ​http://bamanzi.blogeden.cn/

In HTML, when an attribute was null (for example when we parse '="somevalue"'
(attribute forgotten or there is a space between the attribute and the '=')),
the fallback was to assign the value to the attribute. However if the value was
a url or did contain a '/', we would trigger the assertion.

To avoid that, we check the value before assigning it now and do not assign it
if it means adding a '/'.

Test: fast/parser/assertion-empty-attribute.html

• html/HTMLTokenizer.cpp: (WebCore::HTMLTokenizer::parseTag): Add check for '/' in value before assigning it to an attribute when the attribute is null.

LayoutTests:

2008-05-15 Julien Chaffraix <​jchaffraix@webkit.org>

Reviewed by Darin.

Test case for ​https://bugs.webkit.org/show_bug.cgi?id=13942
ASSERTION FAILED: !attrName.contains('/') in HTMLTokenizer.cpp:132 when loading ​http://bamanzi.blogeden.cn/

• fast/parser/assertion-empty-attribute-expected.txt: Added.
• fast/parser/assertion-empty-attribute.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/parser/assertion-empty-attribute-expected.txt (added)
• LayoutTests/fast/parser/assertion-empty-attribute.html (added)
• WebCore/ChangeLog (modified) (1 diff)
• WebCore/html/HTMLTokenizer.cpp (modified) (2 diffs)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2008-05-15  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Reviewed by Darin.
+
+        Test case for https://bugs.webkit.org/show_bug.cgi?id=13942
+        ASSERTION FAILED: !attrName.contains('/') in HTMLTokenizer.cpp:132 when loading http://bamanzi.blogeden.cn/
+
+        * fast/parser/assertion-empty-attribute-expected.txt: Added.
+        * fast/parser/assertion-empty-attribute.html: Added.
+
 2008-05-15  Alexey Proskuryakov  <ap@webkit.org>
 

trunk/WebCore/ChangeLog

@@ +1 @@
+2008-05-15  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Reviewed by Darin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=13942
+        ASSERTION FAILED: !attrName.contains('/') in HTMLTokenizer.cpp:132 when loading http://bamanzi.blogeden.cn/
+
+        In HTML, when an attribute was null (for example when we parse '="somevalue"'
+        (attribute forgotten or there is a space between the attribute and the '=')),
+        the fallback was to assign the value to the attribute. However if the value was
+        a url or did contain a '/', we would trigger the assertion.
+
+        To avoid that, we check the value before assigning it now and do not assign it
+        if it means adding a '/'.
+
+        Test: fast/parser/assertion-empty-attribute.html
+
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::parseTag): Add check for '/' in value before
+        assigning it to an attribute when the attribute is null.
+
 2008-05-15  Kevin Ollivier  <kevino@theolliviers.com>
 

trunk/WebCore/html/HTMLTokenizer.cpp

@@ -1356 +1356 @@
                             dest--; // remove trailing newlines
                         AtomicString v(buffer + 1, dest - buffer - 1);
-                        attrName = v; // Just make the name/value match. (FIXME: Is this some WinIE quirk?)
+                        if (!v.contains('/'))
+                            attrName = v; // Just make the name/value match. (FIXME: Is this some WinIE quirk?)
                         currToken.addAttribute(m_doc, attrName, v, inViewSourceMode());
                         if (inViewSourceMode())
@@ -1377 +1378 @@
                             dest--; // remove trailing newlines
                         AtomicString v(buffer + 1, dest - buffer - 1);
-                        if (attrName.isEmpty()) {
+                        if (attrName.isEmpty() && !v.contains('/')) {
                             attrName = v; // Make the name match the value. (FIXME: Is this a WinIE quirk?)
                             if (inViewSourceMode())