Skip to content
Permalink
Browse files
Assertion failure when opening a file with a missing tag closing bracket
https://bugs.webkit.org/show_bug.cgi?id=176061

Patch by Said Abou-Hallawa <sabouhallawa@apple.com> on 2017-08-29
Reviewed by Darin Adler.

Source/WebCore:

If a tag is missing its closing bracket, the tokenizer just needs to advance()
the character position without checking m_currentCharacter != '\n'. Newline
character is a valid ending for partially closed tags.

Test: fast/tokenizer/missing-script-tag-closing-bracket.html

* html/parser/HTMLTokenizer.cpp:
(WebCore::HTMLTokenizer::commitToPartialEndTag):

LayoutTests:

* fast/tokenizer/missing-script-tag-closing-bracket-expected.txt: Added.
* fast/tokenizer/missing-script-tag-closing-bracket.html: Added.

Canonical link: https://commits.webkit.org/192762@main
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@221335 268f45cc-cd09-0410-ab3c-d52691b4dbfc
  • Loading branch information
Said Abou-Hallawa authored and webkit-commit-queue committed Aug 30, 2017
1 parent 8ffab64 commit 8da58580a89b2dbed487681315dae29b03c81736
@@ -1,3 +1,13 @@
2017-08-29 Said Abou-Hallawa <sabouhallawa@apple.com>

Assertion failure when opening a file with a missing tag closing bracket
https://bugs.webkit.org/show_bug.cgi?id=176061

Reviewed by Darin Adler.

* fast/tokenizer/missing-script-tag-closing-bracket-expected.txt: Added.
* fast/tokenizer/missing-script-tag-closing-bracket.html: Added.

2017-08-29 Yusuke Suzuki <utatane.tea@gmail.com>

[JSC] Use reifying system for "name" property of builtin JSFunction
@@ -0,0 +1 @@
Pass if no assertion failure happens.
@@ -0,0 +1,7 @@
<body>
<p>Pass if no assertion failure happens.</p>
<script>
if (window.testRunner)
testRunner.dumpAsText();
</script
</body>
@@ -1,3 +1,19 @@
2017-08-29 Said Abou-Hallawa <sabouhallawa@apple.com>

Assertion failure when opening a file with a missing tag closing bracket
https://bugs.webkit.org/show_bug.cgi?id=176061

Reviewed by Darin Adler.

If a tag is missing its closing bracket, the tokenizer just needs to advance()
the character position without checking m_currentCharacter != '\n'. Newline
character is a valid ending for partially closed tags.

Test: fast/tokenizer/missing-script-tag-closing-bracket.html

* html/parser/HTMLTokenizer.cpp:
(WebCore::HTMLTokenizer::commitToPartialEndTag):

2017-08-29 Brady Eidson <beidson@apple.com>

Rename "potentionally trustworthy" to "potentially trustworthy"
@@ -159,7 +159,7 @@ bool HTMLTokenizer::commitToPartialEndTag(SegmentedString& source, UChar charact
{
ASSERT(source.currentCharacter() == character);
appendToTemporaryBuffer(character);
source.advancePastNonNewline();
source.advance();

if (haveBufferedCharacterToken()) {
// Emit the buffered character token.

0 comments on commit 8da5858

Please sign in to comment.