Changeset 51101 in webkit

Timestamp:

Nov 17, 2009 9:19:24 PM (14 years ago)

Author:

tkent@chromium.org

Message:

2009-11-17 Hayato Ito <​hayato@google.com>

Reviewed by Darin Adler.

Avoid infinite mutual recursion when deeply nested tags are loaded
​https://bugs.webkit.org/show_bug.cgi?id=30651

• fast/parser/block-nesting-cap-table-expected.txt: Added.
• fast/parser/block-nesting-cap-table.html: Added.
• fast/parser/script-tests/block-nesting-cap-table.js: Added.

2009-11-17 Hayato Ito <​hayato@google.com>

Reviewed by Darin Adler.

Avoid infinite mutual recursion when deeply nested tags are loaded
​https://bugs.webkit.org/show_bug.cgi?id=30651

Test: fast/parser/block-nesting-cap-table.html

• html/HTMLParser.cpp: (WebCore::HTMLParser::parseToken): (WebCore::tagPriorityOfNode): (WebCore::HTMLParser::limitBlockDepth): (WebCore::HTMLParser::insertNodeAfterLimitBlockDepth): (WebCore::HTMLParser::insertNode):
• html/HTMLParser.h:

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/parser/block-nesting-cap-table-expected.txt (added)
• LayoutTests/fast/parser/block-nesting-cap-table.html (added)
• LayoutTests/fast/parser/script-tests/block-nesting-cap-table.js (added)
• WebCore/ChangeLog (modified) (1 diff)
• WebCore/html/HTMLParser.cpp (modified) (5 diffs)
• WebCore/html/HTMLParser.h (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2009-11-17  Hayato Ito  <hayato@google.com>
+
+        Reviewed by Darin Adler.
+
+        Avoid infinite mutual recursion when deeply nested tags are loaded
+        https://bugs.webkit.org/show_bug.cgi?id=30651
+
+        * fast/parser/block-nesting-cap-table-expected.txt: Added.
+        * fast/parser/block-nesting-cap-table.html: Added.
+        * fast/parser/script-tests/block-nesting-cap-table.js: Added.
+
 2009-11-17  Johnny Ding  <jnd@chromium.org>
 

trunk/WebCore/ChangeLog

@@ +1 @@
+2009-11-17  Hayato Ito  <hayato@google.com>
+
+        Reviewed by Darin Adler.
+
+        Avoid infinite mutual recursion when deeply nested tags are loaded
+        https://bugs.webkit.org/show_bug.cgi?id=30651
+
+        Test: fast/parser/block-nesting-cap-table.html
+
+        * html/HTMLParser.cpp:
+        (WebCore::HTMLParser::parseToken):
+        (WebCore::tagPriorityOfNode):
+        (WebCore::HTMLParser::limitBlockDepth):
+        (WebCore::HTMLParser::insertNodeAfterLimitBlockDepth):
+        (WebCore::HTMLParser::insertNode):
+        * html/HTMLParser.h:
+
 2009-11-17  Brent Fulgham  <bfulgham@webkit.org>
 

trunk/WebCore/html/HTMLParser.cpp

@@ -204 +204 @@
 }
 
+inline static int tagPriorityOfNode(Node* n)
+{
+    return n->isHTMLElement() ? static_cast<HTMLElement*>(n)->tagPriority() : 0;
+}
+
+inline void HTMLParser::limitBlockDepth(int tagPriority)
+{
+    if (tagPriority >= minBlockLevelTagPriority) {
+        while (m_blocksInStack >= cMaxBlockDepth)
+            popBlock(m_blockStack->tagName);
+    }
+}
+
+inline bool HTMLParser::insertNodeAfterLimitBlockDepth(Node* n, bool flat)
+{
+    limitBlockDepth(tagPriorityOfNode(n));
+    return insertNode(n, flat);
+}
+
 PassRefPtr<Node> HTMLParser::parseToken(Token* t)
 {
@@ -242 +261 @@
             // split large blocks of text to nodes of manageable size
             n = Text::createWithLengthLimit(m_document, text, charsLeft);
-            if (!insertNode(n.get(), t->selfClosingTag))
+            if (!insertNodeAfterLimitBlockDepth(n.get(), t->selfClosingTag))
                 return 0;
         }
@@ -272 +291 @@
     }
 
-    if (!insertNode(n.get(), t->selfClosingTag)) {
+    if (!insertNodeAfterLimitBlockDepth(n.get(), t->selfClosingTag)) {
         // we couldn't insert the node
 
@@ -330 +349 @@
 
     const AtomicString& localName = n->localName();
-    int tagPriority = n->isHTMLElement() ? static_cast<HTMLElement*>(n)->tagPriority() : 0;
     
     // <table> is never allowed inside stray table content.  Always pop out of the stray table content
@@ -337 +355 @@
         popBlock(tableTag);
 
-    if (tagPriority >= minBlockLevelTagPriority) {
-        while (m_blocksInStack >= cMaxBlockDepth)
-            popBlock(m_blockStack->tagName);
-    }
-
     if (m_parserQuirks && !m_parserQuirks->shouldInsertNode(m_current, n))
         return false;
+
+    int tagPriority = tagPriorityOfNode(n);
 
     // let's be stupid and just try to insert it.

trunk/WebCore/html/HTMLParser.h

@@ -112 +112 @@
     void processCloseTag(Token*);
 
+    void limitBlockDepth(int tagPriority);
+
+    bool insertNodeAfterLimitBlockDepth(Node*, bool flat = false);
     bool insertNode(Node*, bool flat = false);
     bool handleError(Node*, bool flat, const AtomicString& localName, int tagPriority);