From 5abe246385dc70e9b69426cd19302d28b7d869d0 Mon Sep 17 00:00:00 2001 From: Sam Atkins Date: Mon, 29 Jul 2024 16:20:36 +0100 Subject: [PATCH] LibWeb/CSS: Treat counters() function with 1 argument as invalid Fixes #887. --- .../counters-function-single-argument.txt | 11 +++++++++++ .../counters-function-single-argument.html | 5 +++++ Userland/Libraries/LibWeb/CSS/Parser/Parser.cpp | 2 +- 3 files changed, 17 insertions(+), 1 deletion(-) create mode 100644 Tests/LibWeb/Layout/expected/css-counters/counters-function-single-argument.txt create mode 100644 Tests/LibWeb/Layout/input/css-counters/counters-function-single-argument.html diff --git a/Tests/LibWeb/Layout/expected/css-counters/counters-function-single-argument.txt b/Tests/LibWeb/Layout/expected/css-counters/counters-function-single-argument.txt new file mode 100644 index 00000000000..85cdda3b22a --- /dev/null +++ b/Tests/LibWeb/Layout/expected/css-counters/counters-function-single-argument.txt @@ -0,0 +1,11 @@ +Viewport <#document> at (0,0) content-size 800x600 children: not-inline + BlockContainer at (0,0) content-size 800x600 [BFC] children: not-inline + BlockContainer at (8,8) content-size 784x17 children: inline + frag 0 from TextNode start: 0, length: 19, rect: [8,8 162.109375x17] baseline: 13.296875 + "PASS (didn't crash)" + TextNode <#text> + +ViewportPaintable (Viewport<#document>) [0,0 800x600] + PaintableWithLines (BlockContainer) [0,0 800x600] + PaintableWithLines (BlockContainer) [8,8 784x17] + TextPaintable (TextNode<#text>) diff --git a/Tests/LibWeb/Layout/input/css-counters/counters-function-single-argument.html b/Tests/LibWeb/Layout/input/css-counters/counters-function-single-argument.html new file mode 100644 index 00000000000..cdc932f3e45 --- /dev/null +++ b/Tests/LibWeb/Layout/input/css-counters/counters-function-single-argument.html @@ -0,0 +1,5 @@ +PASS (didn't crash) diff --git a/Userland/Libraries/LibWeb/CSS/Parser/Parser.cpp b/Userland/Libraries/LibWeb/CSS/Parser/Parser.cpp index 9d3cf46b252..3f0ee682ed4 100644 --- a/Userland/Libraries/LibWeb/CSS/Parser/Parser.cpp +++ b/Userland/Libraries/LibWeb/CSS/Parser/Parser.cpp @@ -3003,7 +3003,7 @@ RefPtr Parser::parse_counter_value(TokenStream& toke auto& function = token.function(); TokenStream function_tokens { function.values() }; auto function_values = parse_a_comma_separated_list_of_component_values(function_tokens); - if (function_values.is_empty() || function_values.size() > 3) + if (function_values.size() < 2 || function_values.size() > 3) return nullptr; TokenStream name_tokens { function_values[0] };