CSS Parser: Implement parseValue

Source/core/css/parser/CSSParserValues.cpp

 /*
  * Copyright (C) 2003 Lars Knoll (knoll@kde.org)
  * Copyright (C) 2004, 2005, 2006, 2008 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
  *
  * This library is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  * Library General Public License for more details.
  *
  * You should have received a copy of the GNU Library General Public License
  * along with this library; see the file COPYING.LIB.  If not, write to
  * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
  * Boston, MA 02110-1301, USA.
  */
 
 #include "config.h"
 #include "core/css/parser/CSSParserValues.h"
 
 #include "core/css/CSSFunctionValue.h"
 #include "core/css/CSSSelectorList.h"
+#include "core/css/parser/CSSPropertyParser.h"
 #include "core/html/parser/HTMLParserIdioms.h"
 
 namespace blink {
 
 using namespace WTF;
 
+CSSParserValueList::CSSParserValueList(CSSParserTokenIterator start, CSSParserTokenIterator end)
+: m_current(0)
+{

[alancutter (OOO until 2018), 2014/11/07 19:36:12]

ASSERT(end.type() == EOFToken) ?

[Timothy Loh, 2014/11/08 00:42:49]

It basically never makes sense to deference an end iterator. Actually in the
future other codepaths will call into here with other just-past-the-end tokens;
probably including ;, !, ), }.

+    Vector<CSSParserValueList*> stack;
+    Vector<int> bracketCounts;
+    stack.append(this);
+    bracketCounts.append(0);
+    unsigned calcDepth = 0;
+    for (CSSParserTokenIterator it = start; it != end; ++it) {
+        ASSERT(stack.size() == bracketCounts.size());
+        ASSERT(!stack.isEmpty());
+        const CSSParserToken& token = *it;
+        CSSParserValue value;
+        switch (token.type()) {
+        case FunctionToken: {
+            if (token.value() == "url" && (it + 1)->type() == StringToken) {
+                if ((it + 2)->type() == RightParenthesisToken
+                    || ((it + 3)->type() == RightParenthesisToken && (it + 2)->type() == WhitespaceToken)) {

[alancutter (OOO until 2018), 2014/11/07 19:36:11]

These iterator accesses need to be swapped around to catch the EOF correctly and
avoid an out of bounds access.
Given the nature of the bug we ought to have unit tests to catch these.

[Timothy Loh, 2014/11/08 00:42:49]

I tweaked the logic a bit here, ptal.

[alancutter (OOO until 2018), 2014/11/08 00:59:08]

This is better.

+                    CSSParserString string;
+                    ++it;
+                    string.init(it->value());
+                    value.id = CSSValueInvalid;
+                    value.isInt = false;
+                    value.unit = CSSPrimitiveValue::CSS_URI;
+                    value.string = string;
+                    ++it;
+                    if (it->type() == WhitespaceToken)
+                        ++it;
+                    break;
+                }
+            }
+
+            CSSParserFunction* function = new CSSParserFunction;
+            CSSParserString name;
+            name.init(token.value());
+            function->id = cssValueKeywordID(name);
+            CSSParserValueList* list = new CSSParserValueList;
+            function->args = adoptPtr(list);
+
+            value.id = CSSValueInvalid;
+            value.isInt = false;
+            value.unit = CSSParserValue::Function;
+            value.function = function;
+
+            stack.last()->addValue(value);
+            stack.append(list);
+            bracketCounts.append(0);
+            calcDepth += (function->id == CSSValueCalc || function->id == CSSValueWebkitCalc);
+            continue;
+        }
+        case LeftParenthesisToken: {
+            if (!calcDepth) {

[alancutter (OOO until 2018), 2014/11/07 19:36:12]

calcDepth == 0

[Timothy Loh, 2014/11/08 00:42:49]

Done.

+                CSSParserValueList* list = new CSSParserValueList;
+                value.setFromValueList(adoptPtr(list));
+                stack.last()->addValue(value);
+                stack.append(list);
+                bracketCounts.append(0);
+                continue;
+            }
+            bracketCounts.last()++;
+            value.setFromOperator('(');
+            break;
+        }
+        case RightParenthesisToken: {
+            if (!bracketCounts.last()) {

[alancutter (OOO until 2018), 2014/11/07 19:36:12]

backetCounts.last() == 0

[Timothy Loh, 2014/11/08 00:42:49]

Done.

+                stack.removeLast();
+                bracketCounts.removeLast();
+                if (bracketCounts.isEmpty()) {
+                    destroyAndClear();
+                    return;
+                }
+                CSSParserValueList* currentList = stack.last();
+                CSSParserValue* current = currentList->valueAt(currentList->size()-1);
+                if (current->unit == CSSParserValue::Function) {
+                    CSSValueID id = current->function->id;
+                    calcDepth -= (id == CSSValueCalc || id == CSSValueWebkitCalc);
+                }
+                continue;
+            }

[alancutter (OOO until 2018), 2014/11/07 19:36:12]

ASSERT(calcDepth > 0) for readability.

[Timothy Loh, 2014/11/08 00:42:49]

Done.

+            bracketCounts.last()--;
+            value.setFromOperator(')');
+            break;
+        }
+        case IdentToken: {
+            CSSParserString string;
+            string.init(token.value());
+            value.id = cssValueKeywordID(string);
+            value.isInt = false;
+            value.unit = CSSPrimitiveValue::CSS_IDENT;
+            value.string = string;
+            break;
+        }
+        case DimensionToken:
+        case NumberToken:
+        case PercentageToken:
+            value.setFromNumber(token.numericValue(), token.unitType());
+            value.isInt = (token.numericValueType() == IntegerValueType);
+            break;
+        case HashToken:
+        case StringToken:
+        case UnicodeRangeToken:
+        case UrlToken: {
+            CSSParserString string;
+            string.init(token.value());
+            value.id = CSSValueInvalid;
+            value.isInt = false;
+            if (token.type() == HashToken)
+                value.unit = CSSPrimitiveValue::CSS_PARSER_HEXCOLOR;
+            else if (token.type() == StringToken)
+                value.unit = CSSPrimitiveValue::CSS_STRING;
+            else if (token.type() == UnicodeRangeToken)
+                value.unit = CSSPrimitiveValue::CSS_UNICODE_RANGE;
+            else
+                value.unit = CSSPrimitiveValue::CSS_URI;
+            value.string = string;
+            break;
+        }
+        case DelimiterToken:
+            value.setFromOperator(token.delimiter());
+            if (calcDepth && token.delimiter() == '+' && (it - 1)->type() != WhitespaceToken) {
+                // calc(1px+ 2px) is invalid
+                destroyAndClear();
+                return;
+            }
+            break;
+        case CommaToken:
+            value.setFromOperator(',');
+            break;
+        case LeftBracketToken:
+            value.setFromOperator('[');
+            break;
+        case RightBracketToken:
+            value.setFromOperator(']');
+            break;
+        case LeftBraceToken:
+            value.setFromOperator('{');
+            break;
+        case RightBraceToken:
+            value.setFromOperator('}');
+            break;
+        case WhitespaceToken:
+        case CommentToken:
+            continue;
+        case BadStringToken:
+        case BadUrlToken:
+        case ColonToken:
+        case EOFToken:
+        case SemicolonToken:
+            destroyAndClear();
+            return;
+        }
+        stack.last()->addValue(value);
+    }
+
+    CSSParserValue rightParenthesis;
+    rightParenthesis.setFromOperator(')');
+    while (!stack.isEmpty()) {
+        while (bracketCounts.last() > 0) {
+            bracketCounts.last()--;
+            stack.last()->addValue(rightParenthesis);
+        }
+        stack.removeLast();
+        bracketCounts.removeLast();
+    }
+}
+
 static void destroy(Vector<CSSParserValue, 4>& values)
 {
     size_t numValues = values.size();
     for (size_t i = 0; i < numValues; i++) {
         if (values[i].unit == CSSParserValue::Function)
             delete values[i].function;
         else if (values[i].unit == CSSParserValue::ValueList)
             delete values[i].valueList;
     }
 }
@@ skipping 110 matching lines @@
 bool CSSParserSelector::hasHostPseudoSelector() const
 {
     for (CSSParserSelector* selector = const_cast<CSSParserSelector*>(this); selector; selector = selector->tagHistory()) {
         if (selector->pseudoType() == CSSSelector::PseudoHost || selector->pseudoType() == CSSSelector::PseudoHostContext)
             return true;
     }
     return false;
 }
 
 } // namespace blink