Merge r176454 - Crash when setting 'font' CSS property to 'calc(2 * 3)'

https://bugs.webkit.org/show_bug.cgi?id=138933 Reviewed by Darin Adler. Source/WebCore: The CSS Parser was not handling calculated values when parsing the font weight. This would lead us to hit an assertion when parsing a font property whose weight is set to a calculated value. This patch updates parseFontWeight() to properly handle calculated values. Test: fast/css/font-calculated-value.html * css/CSSParser.cpp: (WebCore::CSSParser::parseFontWeight): LayoutTests: Add a layout test to cover the case where the 'font' CSS property is set to a value whose weight is a calculated value, to make sure it does not crash and behaves as intended. * fast/css/font-calculated-value-expected.txt: Added. * fast/css/font-calculated-value.html: Added. Canonical link: https://commits.webkit.org/154760.233@webkitgtk/2.6 git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@178268 268f45cc-cd09-0410-ab3c-d52691b4dbfc
WebKit · Jan 12, 2015 · 06ba7bd · 06ba7bd
1 parent 218c0c9
commit 06ba7bd
Show file tree

Hide file tree

Showing 5 changed files with 64 additions and 1 deletion.
diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
@@ -1,3 +1,17 @@
+2014-11-21  Chris Dumez  <cdumez@apple.com>
+
+        Crash when setting 'font' CSS property to 'calc(2 * 3)'
+        https://bugs.webkit.org/show_bug.cgi?id=138933
+
+        Reviewed by Darin Adler.
+
+        Add a layout test to cover the case where the 'font' CSS property is
+        set to a value whose weight is a calculated value, to make sure it
+        does not crash and behaves as intended.
+
+        * fast/css/font-calculated-value-expected.txt: Added.
+        * fast/css/font-calculated-value.html: Added.
+
 2014-11-20  Zalan Bujtas  <zalan@apple.com>
 
         REGRESSION (174986): CSS clip property is ignored when border-radius is present.

diff --git a/LayoutTests/fast/css/font-calculated-value-expected.txt b/LayoutTests/fast/css/font-calculated-value-expected.txt
@@ -0,0 +1,13 @@
+Tests assigning a calculated value to 'font' CSS property.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS testDiv.style['font'] is ""
+testDiv.style['font'] = 'italic small-caps calc(100 * 9) 12px arial'
+PASS testDiv.style['font'] is "italic small-caps 900 12px arial"
+PASS window.getComputedStyle(testDiv).getPropertyValue('font') is "italic small-caps 900 12px/normal arial"
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
diff --git a/LayoutTests/fast/css/font-calculated-value.html b/LayoutTests/fast/css/font-calculated-value.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<body>
+<script src="../../resources/js-test-pre.js"></script>
+<div id="testDiv""></div>
+<script>
+description("Tests assigning a calculated value to 'font' CSS property.");
+
+var testDiv = document.getElementById("testDiv");
+
+shouldBeEmptyString("testDiv.style['font']");
+evalAndLog("testDiv.style['font'] = 'italic small-caps calc(100 * 9) 12px arial'");
+shouldBeEqualToString("testDiv.style['font']", "italic small-caps 900 12px arial");
+shouldBeEqualToString("window.getComputedStyle(testDiv).getPropertyValue('font')", "italic small-caps 900 12px/normal arial");
+
+</script>
+<script src="../../resources/js-test-post.js"></script>
+</body>
diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
@@ -1,3 +1,22 @@
+2014-11-21  Chris Dumez  <cdumez@apple.com>
+
+        Crash when setting 'font' CSS property to 'calc(2 * 3)'
+        https://bugs.webkit.org/show_bug.cgi?id=138933
+
+        Reviewed by Darin Adler.
+
+        The CSS Parser was not handling calculated values when parsing the font
+        weight. This would lead us to hit an assertion when parsing a font
+        property whose weight is set to a calculated value.
+
+        This patch updates parseFontWeight() to properly handle calculated
+        values.
+
+        Test: fast/css/font-calculated-value.html
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseFontWeight):
+
 2014-11-20  Zalan Bujtas  <zalan@apple.com>
 
         REGRESSION (174986): CSS clip property is ignored when border-radius is present.

diff --git a/Source/WebCore/css/CSSParser.cpp b/Source/WebCore/css/CSSParser.cpp
@@ -6430,7 +6430,7 @@ bool CSSParser::parseFontWeight(bool important)
         return true;
     }
     if (validUnit(value, FInteger | FNonNeg, CSSQuirksMode)) {
-        int weight = static_cast<int>(value->fValue);
+        int weight = static_cast<int>(parsedDouble(value, ReleaseParsedCalcValue));
         if (!(weight % 100) && weight >= 100 && weight <= 900) {
             addProperty(CSSPropertyFontWeight, cssValuePool().createIdentifierValue(createFontWeightValueKeyword(weight)), important);
             return true;