Merge 98374

Source/WebCore/css/CSSParser.cpp

 /*
  * Copyright (C) 2003 Lars Knoll (knoll@kde.org)
  * Copyright (C) 2005 Allan Sandfeld Jensen (kde@carewolf.com)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
  * Copyright (C) 2007 Nicholas Shanks <webkit@nickshanks.com>
  * Copyright (C) 2008 Eric Seidel <eric@webkit.org>
  * Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ skipping 597 matching lines @@
         queries->appendMediaQuery(m_mediaQuery.release());
     }
 
     return ok;
 }
 
 void CSSParser::addProperty(int propId, PassRefPtr<CSSValue> value, bool important)
 {
     OwnPtr<CSSProperty> prop(adoptPtr(new CSSProperty(propId, value, important, m_currentShorthand, m_implicitShorthand)));
     if (m_numParsedProperties >= m_maxParsedProperties) {
+        if (m_numParsedProperties > (UINT_MAX / sizeof(CSSProperty*)) - 32)
+            CRASH();  // Avoid inconsistencies with rollbackLastProperties.
         m_maxParsedProperties += 32;
-        if (m_maxParsedProperties > UINT_MAX / sizeof(CSSProperty*))
-            return;
         m_parsedProperties = static_cast<CSSProperty**>(fastRealloc(m_parsedProperties,
             m_maxParsedProperties * sizeof(CSSProperty*)));
     }
     m_parsedProperties[m_numParsedProperties++] = prop.leakPtr();
 }
 
 void CSSParser::rollbackLastProperties(int num)
 {
     ASSERT(num >= 0);
     ASSERT(m_numParsedProperties >= static_cast<unsigned>(num));
@@ skipping 7070 matching lines @@
 // The macro is used in the tokenizer grammar with lines containing
 // BEGIN(mediaqueries) and BEGIN(initial). yy_start acts as index to
 // tokenizer transition table, and 'mediaqueries' and 'initial' are
 // offset multipliers that specify which transitions are active
 // in the tokenizer during in each condition (tokenizer state).
 #define BEGIN yy_start = 1 + 2 *
 
 #include "tokenizer.cpp"
 
 }