Fix parseHTMLInteger

third_party/WebKit/Source/core/html/parser/HTMLParserIdioms.cpp

 /*
  * Copyright (C) 2010 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1.  Redistributions of source code must retain the above copyright
  *     notice, this list of conditions and the following disclaimer.
  * 2.  Redistributions in binary form must reproduce the above copyright
  *     notice, this list of conditions and the following disclaimer in the
@@ skipping 143 matching lines @@
   bool valid = false;
   double value = string.toDouble(&valid);
   return checkDoubleValue(value, valid, fallbackValue);
 }
 
 template <typename CharacterType>
 static bool parseHTMLIntegerInternal(const CharacterType* position,
                                      const CharacterType* end,
                                      int& value) {
   // Step 3
-  // We do not do this step and do not have a local sign
-  // variable since due to a bug in charactersToIntStrict
-  // we have to add the sign to the digits string.
+  bool isNegative = false;
 
   // Step 4
   while (position < end) {
     if (!isHTMLSpace<CharacterType>(*position))
       break;
     ++position;
   }
 
   // Step 5
   if (position == end)
     return false;
   ASSERT(position < end);
 
   // Step 6
-  StringBuilder digits;
   if (*position == '-') {
-    digits.append('-');
+    isNegative = true;
     ++position;
   } else if (*position == '+')
     ++position;
   if (position == end)
     return false;
   ASSERT(position < end);
 
   // Step 7
   if (!isASCIIDigit(*position))
     return false;
 
   // Step 8
-  while (position < end) {
-    if (!isASCIIDigit(*position))
-      break;
-    digits.append(*position++);
-  }
+  static const int intMax = std::numeric_limits<int>::max();
+  const int base = 10;
+  const int maxMultiplier = intMax / base;
 
+  unsigned temp = 0;
+  do {
+    int digitValue = *position - '0';
+    if (temp > maxMultiplier ||
+        (temp == maxMultiplier && digitValue > (intMax % base) + isNegative))
+      return false;
+    temp = temp * base + digitValue;
+    ++position;
+  } while (position < end && isASCIIDigit(*position));
   // Step 9
-  bool ok;
-  if (digits.is8Bit())
-    value = charactersToIntStrict(digits.characters8(), digits.length(), &ok);
-  else
-    value = charactersToIntStrict(digits.characters16(), digits.length(), &ok);
-  return ok;
+  value = isNegative ? (0 - temp) : temp;
+  return true;
 }
 
 // http://www.whatwg.org/specs/web-apps/current-work/#rules-for-parsing-integers
 bool parseHTMLInteger(const String& input, int& value) {
   // Step 1
   // Step 2
   unsigned length = input.length();
   if (!length || input.is8Bit()) {
     const LChar* start = input.characters8();
     return parseHTMLIntegerInternal(start, start + length, value);
@@ skipping 271 matching lines @@
     string = StringImpl::create8BitIfPossible(characters, size);
   else if (width == Force8Bit)
     string = String::make8BitFrom16BitSource(characters, size);
   else
     string = String(characters, size);
 
   return string;
 }
 
 }  // namespace blink