Bug 873222 - check unit-type of font-synthesis value before use. r=dbaron
authorJohn Daggett <jdaggett@mozilla.com>
Thu, 27 Jun 2013 14:43:00 +0900
changeset 136653 7d831fcaf4f90e268fff48ab9fa668bf4c27ce99
parent 136652 6a9d40dc058a3e7610026ff0d8b2de52b57ca679
child 136654 607b8e1da1ca0f30d7ad7b32a5e80027f78fd623
push id24889
push useremorley@mozilla.com
push dateThu, 27 Jun 2013 10:31:05 +0000
treeherdermozilla-central@b8a80bf3f9da [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersdbaron
bugs873222
milestone25.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 873222 - check unit-type of font-synthesis value before use. r=dbaron
layout/style/Declaration.cpp
layout/style/crashtests/873222.html
layout/style/crashtests/crashtests.list
--- a/layout/style/Declaration.cpp
+++ b/layout/style/Declaration.cpp
@@ -587,16 +587,17 @@ Declaration::GetValue(nsCSSProperty aPro
         // subproperties are reset by this shorthand property to their
         // initial values, but can't be represented in its syntax.
         if (stretch.GetUnit() != eCSSUnit_Enumerated ||
             stretch.GetIntValue() != NS_STYLE_FONT_STRETCH_NORMAL ||
             sizeAdjust.GetUnit() != eCSSUnit_None ||
             featureSettings.GetUnit() != eCSSUnit_Normal ||
             languageOverride.GetUnit() != eCSSUnit_Normal ||
             fontKerning.GetIntValue() != NS_FONT_KERNING_AUTO ||
+            fontSynthesis.GetUnit() != eCSSUnit_Enumerated ||
             fontSynthesis.GetIntValue() !=
               (NS_FONT_SYNTHESIS_WEIGHT | NS_FONT_SYNTHESIS_STYLE) ||
             fontVariantAlternates.GetUnit() != eCSSUnit_Normal ||
             fontVariantCaps.GetUnit() != eCSSUnit_Normal ||
             fontVariantEastAsian.GetUnit() != eCSSUnit_Normal ||
             fontVariantLigatures.GetUnit() != eCSSUnit_Normal ||
             fontVariantNumeric.GetUnit() != eCSSUnit_Normal ||
             fontVariantPosition.GetUnit() != eCSSUnit_Normal) {
new file mode 100644
--- /dev/null
+++ b/layout/style/crashtests/873222.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+    var r = document.documentElement;
+    r.style.font = "170% fantasy";
+    r.style.fontSynthesis = "none";
+    r.getAttribute("style");
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
--- a/layout/style/crashtests/crashtests.list
+++ b/layout/style/crashtests/crashtests.list
@@ -89,8 +89,9 @@ load 822842.html
 load 822766-1.html
 load 827591-1.html
 load 829817.html
 load 840898.html
 load 842134.html
 load 862113.html
 load 867487.html
 load 880862.html
+load 873222.html