Add an early abort for the CSSParserFastPaths transform path.

third_party/WebKit/Source/core/css/parser/CSSParserFastPaths.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/css/parser/CSSParserFastPaths.h"
 
 #include "core/StylePropertyShorthand.h"
 #include "core/css/CSSFunctionValue.h"
 #include "core/css/CSSValuePool.h"
 #include "core/css/parser/CSSParserIdioms.h"
@@ skipping 882 matching lines @@
         double number = charactersToDouble(pos, argumentLength, &ok);
         if (!ok)
             return false;
         transformValue->append(cssValuePool().createValue(number, CSSPrimitiveValue::UnitType::Number));
         pos += argumentLength + 1;
         --expectedCount;
     }
     return true;
 }
 
+static const int kShortestValidTransformStringLength = 12;
+
 template <typename CharType>
 static CSSFunctionValue* parseSimpleTransformValue(CharType*& pos, CharType* end)
 {
-    static const int shortestValidTransformStringLength = 12;
-
-    if (end - pos < shortestValidTransformStringLength)
+    if (end - pos < kShortestValidTransformStringLength)
         return nullptr;
 
     const bool isTranslate = toASCIILower(pos[0]) == 't'
         && toASCIILower(pos[1]) == 'r'
         && toASCIILower(pos[2]) == 'a'
         && toASCIILower(pos[3]) == 'n'
         && toASCIILower(pos[4]) == 's'
         && toASCIILower(pos[5]) == 'l'
         && toASCIILower(pos[6]) == 'a'
         && toASCIILower(pos[7]) == 't'
@@ skipping 60 matching lines @@
         CSSFunctionValue* transformValue = CSSFunctionValue::create(CSSValueScale3d);
         if (!parseTransformNumberArguments(pos, end, 3, transformValue))
             return nullptr;
         return transformValue;
     }
 
     return nullptr;
 }
 
 template <typename CharType>
-static CSSValueList* parseSimpleTransformList(CharType*& pos, CharType* end)
+static bool transformCanLikelyUseFastPath(const CharType* chars, unsigned length)
 {
+    // Very fast scan that attempts to reject most transforms that couldn't
+    // take the fast path. This avoids doing the malloc and string->double
+    // conversions in parseSimpleTransformValue only to discard them when we
+    // run into a transform component we don't understand.
+    unsigned i = 0;
+    while (i < length) {
+        if (isCSSSpace(chars[i])) {
+            ++i;
+            continue;
+        }
+        if (length - i < kShortestValidTransformStringLength)
+            return false;
+        switch (toASCIILower(chars[i])) {
+        case 't':
+            // translate, translateX, translateY, translateZ, translate3d.
+            if (toASCIILower(chars[i + 8]) != 'e')
+                return false;
+            i += 9;
+            break;
+        case 'm':
+            // matrix3d.
+            if (toASCIILower(chars[i + 7]) != 'd')
+                return false;
+            i += 8;
+            break;
+        case 's':
+            // scale3d.
+            if (toASCIILower(chars[i + 6]) != 'd')
+                return false;
+            i += 7;
+            break;
+        default:
+            // All other things, ex. rotate.
+            return false;
+        }
+        size_t argumentsEnd = WTF::find(chars, length, ')', i);
+        if (argumentsEnd == kNotFound)
+            return false;
+        // Advance to the end of the arguments.
+        i = argumentsEnd + 1;
+    }
+    return i == length;
+}
+
+template <typename CharType>
+static CSSValueList* parseSimpleTransformList(const CharType* chars, unsigned length)
+{
+    if (!transformCanLikelyUseFastPath(chars, length))
+        return nullptr;
+    const CharType*& pos = chars;
+    const CharType* end = chars + length;
     CSSValueList* transformList = nullptr;
     while (pos < end) {
         while (pos < end && isCSSSpace(*pos))
             ++pos;
         if (pos >= end)
             break;
         CSSFunctionValue* transformValue = parseSimpleTransformValue(pos, end);
         if (!transformValue)
             return nullptr;
         if (!transformList)
             transformList = CSSValueList::createSpaceSeparated();
         transformList->append(transformValue);
     }
     return transformList;
 }
 
 static CSSValue* parseSimpleTransform(CSSPropertyID propertyID, const String& string)
 {
     ASSERT(!string.isEmpty());
 
     if (propertyID != CSSPropertyTransform)
         return nullptr;
-    if (string.is8Bit()) {
-        const LChar* pos = string.characters8();
-        const LChar* end = pos + string.length();
-        return parseSimpleTransformList(pos, end);
-    }
-    const UChar* pos = string.characters16();
-    const UChar* end = pos + string.length();
-    return parseSimpleTransformList(pos, end);
+    if (string.is8Bit())
+        return parseSimpleTransformList(string.characters8(), string.length());
+    return parseSimpleTransformList(string.characters16(), string.length());
 }
 
 CSSValue* CSSParserFastPaths::maybeParseValue(CSSPropertyID propertyID, const String& string, CSSParserMode parserMode)
 {
     if (CSSValue* length = parseSimpleLengthValue(propertyID, string, parserMode))
         return length;
     if (isColorPropertyID(propertyID))
         return parseColor(string, parserMode);
     if (CSSValue* keyword = parseKeywordValue(propertyID, string, parserMode))
         return keyword;
     if (CSSValue* transform = parseSimpleTransform(propertyID, string))
         return transform;
     return nullptr;
 }
 
 } // namespace blink