Merge r221335 - Assertion failure when opening a file with a missing …

…tag closing bracket https://bugs.webkit.org/show_bug.cgi?id=176061 Patch by Said Abou-Hallawa <sabouhallawa@apple.com> on 2017-08-29 Reviewed by Darin Adler. Source/WebCore: If a tag is missing its closing bracket, the tokenizer just needs to advance() the character position without checking m_currentCharacter != '\n'. Newline character is a valid ending for partially closed tags. Test: fast/tokenizer/missing-script-tag-closing-bracket.html * html/parser/HTMLTokenizer.cpp: (WebCore::HTMLTokenizer::commitToPartialEndTag): LayoutTests: * fast/tokenizer/missing-script-tag-closing-bracket-expected.txt: Added. * fast/tokenizer/missing-script-tag-closing-bracket.html: Added.
WebKit · Sep 2, 2017 · 0cb983e · 0cb983e
1 parent 1192d5f
commit 0cb983e
Show file tree

Hide file tree

Showing 5 changed files with 35 additions and 1 deletion.
diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
@@ -1,3 +1,13 @@
+2017-08-29  Said Abou-Hallawa  <sabouhallawa@apple.com>
+
+        Assertion failure when opening a file with a missing tag closing bracket
+        https://bugs.webkit.org/show_bug.cgi?id=176061
+
+        Reviewed by Darin Adler.
+
+        * fast/tokenizer/missing-script-tag-closing-bracket-expected.txt: Added.
+        * fast/tokenizer/missing-script-tag-closing-bracket.html: Added.
+
 2017-08-19  Sergio Villar Senin  <svillar@igalia.com>
 
         [SVG] Leak in SVGAnimatedListPropertyTearOff

diff --git a/LayoutTests/fast/tokenizer/missing-script-tag-closing-bracket-expected.txt b/LayoutTests/fast/tokenizer/missing-script-tag-closing-bracket-expected.txt
@@ -0,0 +1 @@
+Pass if no assertion failure happens.
diff --git a/LayoutTests/fast/tokenizer/missing-script-tag-closing-bracket.html b/LayoutTests/fast/tokenizer/missing-script-tag-closing-bracket.html
@@ -0,0 +1,7 @@
+<body>
+    <p>Pass if no assertion failure happens.</p>
+    <script>
+        if (window.testRunner)
+            testRunner.dumpAsText();
+    </script
+</body>
diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
@@ -1,3 +1,19 @@
+2017-08-29  Said Abou-Hallawa  <sabouhallawa@apple.com>
+
+        Assertion failure when opening a file with a missing tag closing bracket
+        https://bugs.webkit.org/show_bug.cgi?id=176061
+
+        Reviewed by Darin Adler.
+
+        If a tag is missing its closing bracket, the tokenizer just needs to advance()
+        the character position without checking m_currentCharacter != '\n'. Newline
+        character is a valid ending for partially closed tags.
+
+        Test: fast/tokenizer/missing-script-tag-closing-bracket.html
+
+        * html/parser/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::commitToPartialEndTag):
+
 2017-08-19  Sergio Villar Senin  <svillar@igalia.com>
 
         [SVG] Leak in SVGAnimatedListPropertyTearOff

diff --git a/Source/WebCore/html/parser/HTMLTokenizer.cpp b/Source/WebCore/html/parser/HTMLTokenizer.cpp
@@ -159,7 +159,7 @@ bool HTMLTokenizer::commitToPartialEndTag(SegmentedString& source, UChar charact
 {
     ASSERT(source.currentCharacter() == character);
     appendToTemporaryBuffer(character);
-    source.advancePastNonNewline();
+    source.advance();
 
     if (haveBufferedCharacterToken()) {
         // Emit the buffered character token.