Bug 842134: fix serialization of unquoted url() in CSS. r=heycam
authorZack Weinberg <zackw@panix.com>
Sun, 17 Feb 2013 22:03:55 -0500
changeset 122203 eb1a14e09f50df22978eea54caf2bf9887821e7a
parent 122202 a1310b986ebe61e0e8eeb618bb1d0aba89f4b658
child 122204 e0ffe719035b6aba48c9fa79303284a8509d1086
push id1
push userroot
push dateMon, 20 Oct 2014 17:29:22 +0000
reviewersheycam
bugs842134
milestone21.0a1
Bug 842134: fix serialization of unquoted url() in CSS. r=heycam
layout/style/crashtests/842134.html
layout/style/crashtests/crashtests.list
layout/style/nsCSSScanner.cpp
new file mode 100644
--- /dev/null
+++ b/layout/style/crashtests/842134.html
@@ -0,0 +1,1 @@
+<!doctype html><style>body { marker: url(#m) url(#m); }</style>
--- a/layout/style/crashtests/crashtests.list
+++ b/layout/style/crashtests/crashtests.list
@@ -83,8 +83,9 @@ skip-if(Android||browserIsRemote) load 7
 skip-if(browserIsRemote) load 786108-2.html # Bug 795534
 load 788836.html
 load 806310-1.html
 load 812824.html
 load 822842.html
 load 822766-1.html
 load 827591-1.html
 load 840898.html
+load 842134.html
--- a/layout/style/nsCSSScanner.cpp
+++ b/layout/style/nsCSSScanner.cpp
@@ -1025,16 +1025,17 @@ nsCSSScanner::NextURL(nsCSSToken& aToken
     if (MOZ_UNLIKELY(aToken.mType == eCSSToken_Bad_String)) {
       aToken.mType = eCSSToken_Bad_URL;
       return true;
     }
     MOZ_ASSERT(aToken.mType == eCSSToken_String, "unexpected token type");
 
   } else {
     // Otherwise, this is the start of a non-quoted url (which may be empty).
+    aToken.mSymbol = PRUnichar(0);
     GatherText(IS_URL_CHAR, aToken.mIdent);
   }
 
   // Consume trailing whitespace and then look for a close parenthesis.
   SkipWhitespace();
   ch = Peek();
   if (MOZ_LIKELY(ch < 0 || ch == ')')) {
     Advance();