Bug 1532768 - Don't crash when given bad types to cssPropertySupportsType. r=heycam
authorEmilio Cobos Álvarez <emilio@crisal.io>
Wed, 06 Mar 2019 20:50:19 +0000
changeset 520583 d34db0a033145601b8ec344c9debd10799c2fdae
parent 520582 6551636084e0652d785f4f9ff277cbe83bdf8cd7
child 520584 61f7f4614016337030ac0f1047f0df641aaa37bd
push id10862
push userffxbld-merge
push dateMon, 11 Mar 2019 13:01:11 +0000
treeherdermozilla-beta@a2e7f5c935da [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersheycam
bugs1532768
milestone67.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1532768 - Don't crash when given bad types to cssPropertySupportsType. r=heycam Differential Revision: https://phabricator.services.mozilla.com/D22222
layout/inspector/InspectorUtils.cpp
layout/inspector/tests/test_bug1006595.html
--- a/layout/inspector/InspectorUtils.cpp
+++ b/layout/inspector/InspectorUtils.cpp
@@ -439,16 +439,20 @@ bool InspectorUtils::CssPropertyIsShorth
   }
   return isShorthand;
 }
 
 bool InspectorUtils::CssPropertySupportsType(GlobalObject& aGlobalObject,
                                              const nsAString& aProperty,
                                              uint32_t aType, ErrorResult& aRv) {
   NS_ConvertUTF16toUTF8 property(aProperty);
+  if (!aType || aType > InspectorUtils_Binding::TYPE_TIMING_FUNCTION) {
+    aRv.Throw(NS_ERROR_INVALID_ARG);
+    return false;
+  }
   bool found;
   bool result = Servo_Property_SupportsType(&property, aType, &found);
   if (!found) {
     aRv.Throw(NS_ERROR_FAILURE);
     return false;
   }
   return result;
 }
--- a/layout/inspector/tests/test_bug1006595.html
+++ b/layout/inspector/tests/test_bug1006595.html
@@ -31,16 +31,23 @@ https://bugzilla.mozilla.org/show_bug.cg
 
   var displaySubProps = InspectorUtils.getSubpropertiesForCSSProperty("color");
   arraysEqual(displaySubProps, [ "color" ],
               "'color' subproperties");
 
   var varProps = InspectorUtils.getSubpropertiesForCSSProperty("--foo");
   arraysEqual(varProps, ["--foo"], "'--foo' subproperties");
 
+  try {
+    InspectorUtils.cssPropertySupportsType("padding", 0);
+    ok(false, "Invalid types throw");
+  } catch (ex) {
+    ok(true, "Invalid types don't crash");
+  }
+
   ok(InspectorUtils.cssPropertyIsShorthand("padding"), "'padding' is a shorthand")
   ok(!InspectorUtils.cssPropertyIsShorthand("color"), "'color' is not a shorthand")
 
   ok(!InspectorUtils.cssPropertySupportsType("padding", InspectorUtils.TYPE_COLOR),
      "'padding' can't be a color");
 
   ok(InspectorUtils.cssPropertySupportsType("color", InspectorUtils.TYPE_COLOR),
      "'color' can be a color");