Handle extra whitespaces in the DOM token list

third_party/WebKit/Source/core/dom/DOMTokenList.cpp

 /*
  * Copyright (C) 2010 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1.  Redistributions of source code must retain the above copyright
  *     notice, this list of conditions and the following disclaimer.
  * 2.  Redistributions in binary form must reproduce the above copyright
  *     notice, this list of conditions and the following disclaimer in the
@@ skipping 224 matching lines @@
     // New spec is at http://dom.spec.whatwg.org/#remove-a-token-from-a-string
 
     unsigned inputLength = input.length();
     StringBuilder output; // 3
     output.reserveCapacity(inputLength);
     unsigned position = 0; // 4
 
     // Step 5
     while (position < inputLength) {
         if (isHTMLSpace<UChar>(input[position])) { // 6
-            output.append(input[position++]); // 6.1, 6.2
+            position++;
             continue; // 6.3
         }
 
         // Step 7
         StringBuilder tokenBuilder;
         while (position < inputLength && isNotHTMLSpace<UChar>(input[position]))
             tokenBuilder.append(input[position++]);
 
         // Step 8
         String token = tokenBuilder.toString();
         if (tokens.contains(token)) {
             // Step 8.1
             while (position < inputLength && isHTMLSpace<UChar>(input[position]))
                 ++position;
 
             // Step 8.2
             size_t j = output.length();
             while (j > 0 && isHTMLSpace<UChar>(output[j - 1]))
                 --j;
             output.resize(j);
-
-            // Step 8.3
-            if (position < inputLength && !output.isEmpty())
-                output.append(' ');
         } else {
             output.append(token); // Step 9
         }
+
+        if (position < inputLength && !output.isEmpty())
+            output.append(' ');
     }
 
+    size_t j = output.length();
+    if (isHTMLSpace<UChar>(output[j - 1]))

[tkent, 2015/10/26 23:30:38]

Buffer underflow.  |j| can be 0.

[tanay.c, 2015/10/27 10:44:39]

Done.

+        output.resize(j - 1);
+
     return output.toAtomicString();
 }
 
 ValueIterable<String>::IterationSource* DOMTokenList::startIteration(ScriptState*, ExceptionState&)
 {
     return new DOMTokenListIterationSource(this);
 }
 
 } // namespace blink