IntersectionObserver constructor: fail on invalid rootMargin syntax.

third_party/WebKit/Source/core/dom/IntersectionObserver.cpp

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/dom/IntersectionObserver.h"
 
 #include "bindings/core/v8/ExceptionState.h"
 #include "core/css/parser/CSSParserTokenRange.h"
 #include "core/css/parser/CSSTokenizer.h"
 #include "core/dom/Element.h"
@@ skipping 21 matching lines @@
 static void parseRootMargin(String rootMarginParameter, Vector<Length>& rootMargin, ExceptionState& exceptionState)
 {
     // TODO(szager): Make sure this exact syntax and behavior is spec-ed somewhere.
 
     // The root margin argument accepts syntax similar to that for CSS margin:
     //
     // "1px" = top/right/bottom/left
     // "1px 2px" = top/bottom left/right
     // "1px 2px 3px" = top left/right bottom
     // "1px 2px 3px 4px" = top left right bottom
-    //
-    // Any extra stuff after the first four tokens is ignored.
     CSSTokenizer::Scope tokenizerScope(rootMarginParameter);
     CSSParserTokenRange tokenRange = tokenizerScope.tokenRange();
-    while (rootMargin.size() < 4 && tokenRange.peek().type() != EOFToken && !exceptionState.hadException()) {
+    while (rootMargin.size() < 5 && tokenRange.peek().type() != EOFToken && !exceptionState.hadException()) {
+        if (rootMargin.size() == 4) {

[eae, 2016/06/22 10:51:04]

According the the comment above four tokens should be allowed. (1px 2px 3px 4px)

[szager1, 2016/06/22 15:11:45]

At this point in the code, there are already four parsed tokens, and the loop is
about to process the fifth.  We know there's a fifth token, because the loop
conditional contains (tokenRange.peek().type() != EOFToken).

The existing tests verify that a rootMargin field with four tokens is
successfully parsed, and one with five tokens throws an exception.

[eae, 2016/06/22 16:54:40]

The while conditions check that rootMargin.size() is less than 5 and this
condition checks if it's four.  How can that indicate the presence of a fifth
token? Does tokenRange.peek() mutate the rootMargins vector?

I might be missing something obvious here but I fail to wrap my head around this
logic.

+            exceptionState.throwDOMException(SyntaxError, "Extra text found at the end of rootMargin.");
+            break;
+        }
         const CSSParserToken& token = tokenRange.consumeIncludingWhitespace();
         switch (token.type()) {
         case PercentageToken:
             rootMargin.append(Length(token.numericValue(), Percent));
             break;
         case DimensionToken:
             switch (token.unitType()) {
             case CSSPrimitiveValue::UnitType::Pixels:
                 rootMargin.append(Length(static_cast<int>(floor(token.numericValue())), Fixed));
                 break;
@@ skipping 295 matching lines @@
 
 DEFINE_TRACE(IntersectionObserver)
 {
     visitor->template registerWeakMembers<IntersectionObserver, &IntersectionObserver::clearWeakMembers>(this);
     visitor->trace(m_callback);
     visitor->trace(m_observations);
     visitor->trace(m_entries);
 }
 
 } // namespace blink