Bug 842134: fix serialization of unquoted url() in CSS. r=heycam
authorZack Weinberg <zackw@panix.com>
Sun, 17 Feb 2013 22:03:55 -0500
changeset 122203 eb1a14e09f50df22978eea54caf2bf9887821e7a
parent 122202 a1310b986ebe61e0e8eeb618bb1d0aba89f4b658
child 122204 e0ffe719035b6aba48c9fa79303284a8509d1086
push id24322
push userdbaron@mozilla.com
push dateMon, 18 Feb 2013 08:55:11 +0000
treeherdermozilla-central@0acbd06d48a9 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersheycam
bugs842134
milestone21.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 842134: fix serialization of unquoted url() in CSS. r=heycam
layout/style/crashtests/842134.html
layout/style/crashtests/crashtests.list
layout/style/nsCSSScanner.cpp
new file mode 100644
--- /dev/null
+++ b/layout/style/crashtests/842134.html
@@ -0,0 +1,1 @@
+<!doctype html><style>body { marker: url(#m) url(#m); }</style>
--- a/layout/style/crashtests/crashtests.list
+++ b/layout/style/crashtests/crashtests.list
@@ -83,8 +83,9 @@ skip-if(Android||browserIsRemote) load 7
 skip-if(browserIsRemote) load 786108-2.html # Bug 795534
 load 788836.html
 load 806310-1.html
 load 812824.html
 load 822842.html
 load 822766-1.html
 load 827591-1.html
 load 840898.html
+load 842134.html
--- a/layout/style/nsCSSScanner.cpp
+++ b/layout/style/nsCSSScanner.cpp
@@ -1025,16 +1025,17 @@ nsCSSScanner::NextURL(nsCSSToken& aToken
     if (MOZ_UNLIKELY(aToken.mType == eCSSToken_Bad_String)) {
       aToken.mType = eCSSToken_Bad_URL;
       return true;
     }
     MOZ_ASSERT(aToken.mType == eCSSToken_String, "unexpected token type");
 
   } else {
     // Otherwise, this is the start of a non-quoted url (which may be empty).
+    aToken.mSymbol = PRUnichar(0);
     GatherText(IS_URL_CHAR, aToken.mIdent);
   }
 
   // Consume trailing whitespace and then look for a close parenthesis.
   SkipWhitespace();
   ch = Peek();
   if (MOZ_LIKELY(ch < 0 || ch == ')')) {
     Advance();