[SCM] WebKit Debian packaging branch, debian/experimental, updated. upstream/1.3.3-10851-g50815da
commit-queue at webkit.org
commit-queue at webkit.org
Wed Dec 22 17:57:22 UTC 2010
The following commit has been merged in the debian/experimental branch:
commit a3bb21de508d9e146272be367c5324bb36d713d9
Author: commit-queue at webkit.org <commit-queue at webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Date: Fri Dec 3 08:12:10 2010 +0000
2010-12-03 Yonathan Randolph <yonathan at gmail.com>
Reviewed by Alexey Proskuryakov.
XPath lexer misinterprets expression starting with "div".
https://bugs.webkit.org/show_bug.cgi?id=50366
* fast/xpath/ambiguous-operators-expected.txt: Added.
* fast/xpath/ambiguous-operators.html: Added.
2010-12-03 Yonathan Randolph <yonathan at gmail.com>
Reviewed by Alexey Proskuryakov.
XPath lexer misinterprets expression starting with "div".
https://bugs.webkit.org/show_bug.cgi?id=50366
* xml/XPathParser.cpp:
* xml/XPathParser.h:
(WebCore::XPath::Parser::isOperatorContext): removed (renamed)
(WebCore::XPath::Parser::isBinaryOperatorContext): added
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@73247 268f45cc-cd09-0410-ab3c-d52691b4dbfc
diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index a94fb61..4469124 100644
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,13 @@
+2010-12-03 Yonathan Randolph <yonathan at gmail.com>
+
+ Reviewed by Alexey Proskuryakov.
+
+ XPath lexer misinterprets expression starting with "div".
+ https://bugs.webkit.org/show_bug.cgi?id=50366
+
+ * fast/xpath/ambiguous-operators-expected.txt: Added.
+ * fast/xpath/ambiguous-operators.html: Added.
+
2010-12-02 Rob Buis <rwlbuis at gmail.com>
Reviewed by Alexey Proskuryakov.
diff --git a/LayoutTests/fast/xpath/ambiguous-operators-expected.txt b/LayoutTests/fast/xpath/ambiguous-operators-expected.txt
new file mode 100644
index 0000000..02290f2
--- /dev/null
+++ b/LayoutTests/fast/xpath/ambiguous-operators-expected.txt
@@ -0,0 +1,73 @@
+Test that an NCName and * are interpreted as an operator when in binary operator context, and as a NameTest otherwise.
+
+See bug 50366: XPath lexer misinterprets expression starting with "div".
+
+PASS div
+PASS div
+PASS (div) div (div)
+PASS self::node()[div] div 1
+PASS . div .
+PASS .. div ..
+PASS string(div/@div)
+PASS substring-before('1992', div)
+PASS self::div
+PASS * div 4
+PASS '3' div 4
+PASS "3" div 4
+PASS 12 div 4
+PASS true() and div
+PASS false() or div
+PASS div mod div
+PASS div div div
+PASS 3 * div
+PASS div/div
+PASS div//div
+PASS zz|div
+PASS div+div
+PASS - - div
+PASS 5 -div
+PASS div=div
+PASS div!=div
+PASS div<div
+PASS div<=div
+PASS div>div
+PASS div>=div
+PASS *
+PASS *
+PASS (*) * (*)
+PASS self::node()[*] * 1
+PASS . * .
+PASS .. * ..
+PASS substring-before('1992', *)
+PASS self::*
+PASS * * 4
+PASS '3' * 4
+PASS "3" * 4
+PASS 12 * 4
+PASS true() and *
+PASS false() or *
+PASS * mod *
+PASS * div *
+PASS 3 * *
+PASS */*
+PASS *//*
+PASS zz|*
+PASS *+*
+PASS - - *
+PASS 5 -*
+PASS *=*
+PASS *!=*
+PASS *<*
+PASS *<=*
+PASS *>*
+PASS *>=*
+PASS or:or
+PASS or:*
+PASS mod
+PASS mod mod mod
+PASS (mod) mod 5
+PASS string(mod/@and)
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
diff --git a/LayoutTests/fast/xpath/ambiguous-operators.html b/LayoutTests/fast/xpath/ambiguous-operators.html
new file mode 100644
index 0000000..f22a185
--- /dev/null
+++ b/LayoutTests/fast/xpath/ambiguous-operators.html
@@ -0,0 +1,118 @@
+<html>
+<head>
+<link rel="stylesheet" href="../js/resources/js-test-style.css">
+<script src="../js/resources/js-test-pre.js"></script>
+<script src="xpath-test-pre.js"></script>
+<style>
+#context {display:none}
+</style>
+</head>
+<body>
+<p>Test that an NCName and * are interpreted as an operator when in
+binary operator context, and as a NameTest otherwise.
+
+<p>See <a href="http://bugs.webkit.org/show_bug.cgi?id=50366">bug 50366</a>:
+XPath lexer misinterprets expression starting with "div".</p>
+
+<div id="console"></div>
+
+<div id="context">
+ <div id="two" div="x">2</div>
+</div>
+
+<script>
+var context = document.getElementById('context');
+var div = document.getElementById('two');
+
+// =========== div ===========
+
+test(document, context, "div", [div], null); // div with no preceding token
+test(document, context, " div", [div], null);
+// div following every possible [28] ExprToken http://www.w3.org/TR/xpath/
+test(document, context, "(div) div (div)", 2/2, null); // div after ( and )
+test(document, context, "self::node()[div] div 1", 2/1, null); // div after [ and ]
+test(document, context, ". div .", 2/2, null); // div after .
+test(document, div, ".. div ..", 2/2, null); // div after ..
+test(document, context, "string(div/@div)", "x", null); // div after @
+test(document, context, "substring-before('1992', div)", "199", null); // div after ,
+test(document, div, "self::div", [div], null); // div after ::
+test(document, context, "* div 4", 2/4, null); // div after NameTest *
+test(document, context, "'3' div 4", 3/4, null); // div after Literal
+test(document, context, "\"3\" div 4", 3/4, null); // div after Literal
+test(document, context, "12 div 4", 12/4, null); // div after Number
+
+// div following every [32] Operator
+test(document, context, "true() and div", true, null); // div after OperatorName and
+test(document, context, "false() or div", true, null); // div after OperatorName or
+test(document, context, "div mod div", 0, null); // div after OperatorName mod
+test(document, context, "div div div", 1, null); // div after OperatorName div
+test(document, context, "3 * div", 6, null); // div after MultiplyOperator
+test(document, context, "div/div", [], null); // div after /
+test(document, context, "div//div", [], null); // div after //
+test(document, context, "zz|div", [div], null); // div after |
+test(document, context, "div+div", 4, null); // div after +
+test(document, context, "- - div", 2, null); // div after unary -
+test(document, context, "5 -div", 3, null); // div after binary -
+test(document, context, "div=div", true, null); // div after =
+test(document, context, "div!=div", false, null); // div after =
+test(document, context, "div<div", false, null); // div after <
+test(document, context, "div<=div", true, null); // div after <=
+test(document, context, "div>div", false, null); // div after >
+test(document, context, "div>=div", true, null); // div after >=
+
+
+// =========== * ===========
+
+test(document, context, "*", [div], null); // * with no preceding token
+test(document, context, " *", [div], null);
+// * following every possible [28] ExprToken http://www.w3.org/TR/xpath/
+test(document, context, "(*) * (*)", 2*2, null); // * after ( and )
+test(document, context, "self::node()[*] * 1", 2*1, null); // * after [ and ]
+test(document, context, ". * .", 2*2, null); // * after .
+test(document, div, ".. * ..", 2*2, null); // * after ..
+// (* can't follow @)
+test(document, context, "substring-before('1992', *)", "199", null); // * after ,
+test(document, div, "self::*", [div], null); // * after ::
+test(document, context, "* * 4", 2*4, null); // * after NameTest *
+test(document, context, "'3' * 4", 3*4, null); // * after Literal
+test(document, context, "\"3\" * 4", 3*4, null); // * after Literal
+test(document, context, "12 * 4", 12*4, null); // * after Number
+
+// * following every [32] Operator
+test(document, context, "true() and *", true, null); // * after OperatorName and
+test(document, context, "false() or *", true, null); // * after OperatorName or
+test(document, context, "* mod *", 0, null); // * after OperatorName mod
+test(document, context, "* div *", 1, null); // * after OperatorName div
+test(document, context, "3 * *", 6, null); // * after MultiplyOperator
+test(document, context, "*/*", [], null); // * after /
+test(document, context, "*//*", [], null); // * after //
+test(document, context, "zz|*", [div], null); // * after |
+test(document, context, "*+*", 4, null); // * after +
+test(document, context, "- - *", 2, null); // * after unary -
+test(document, context, "5 -*", 3, null); // * after binary -
+test(document, context, "*=*", true, null); // * after =
+test(document, context, "*!=*", false, null); // * after =
+test(document, context, "*<*", false, null); // * after <
+test(document, context, "*<=*", true, null); // * after <=
+test(document, context, "*>*", false, null); // * after >
+test(document, context, "*>=*", true, null); // * after >=
+
+var xmlDoc = (new DOMParser).parseFromString("<or xmlns='uri'>5</or>", "text/xml");
+var nsResolver = function(prefix) {return 'uri';}
+// div and * after :
+test(xmlDoc, xmlDoc, "or:or", [xmlDoc.documentElement], nsResolver);
+test(xmlDoc, xmlDoc, "or:*", [xmlDoc.documentElement], nsResolver);
+
+// A few tests with mod as well
+var xmlDoc2 = (new DOMParser).parseFromString("<mod and='x'>8</mod>", "text/xml");
+test(xmlDoc2, xmlDoc2, "mod", [xmlDoc2.documentElement], null);
+test(xmlDoc2, xmlDoc2, "mod mod mod", 0, null);
+test(xmlDoc2, xmlDoc2, "(mod) mod 5", 3, null);
+test(xmlDoc2, xmlDoc2, "string(mod/@and)", 'x', null);
+
+
+var successfullyParsed = true;
+</script>
+<script src="../js/resources/js-test-post.js"></script>
+</body>
+</html>
diff --git a/WebCore/ChangeLog b/WebCore/ChangeLog
index aa82a1b..e41e6c1 100644
--- a/WebCore/ChangeLog
+++ b/WebCore/ChangeLog
@@ -1,3 +1,15 @@
+2010-12-03 Yonathan Randolph <yonathan at gmail.com>
+
+ Reviewed by Alexey Proskuryakov.
+
+ XPath lexer misinterprets expression starting with "div".
+ https://bugs.webkit.org/show_bug.cgi?id=50366
+
+ * xml/XPathParser.cpp:
+ * xml/XPathParser.h:
+ (WebCore::XPath::Parser::isOperatorContext): removed (renamed)
+ (WebCore::XPath::Parser::isBinaryOperatorContext): added
+
2010-12-02 Rob Buis <rwlbuis at gmail.com>
Reviewed by Alexey Proskuryakov.
diff --git a/WebCore/xml/XPathParser.cpp b/WebCore/xml/XPathParser.cpp
index c242a5c..ba6da7e 100644
--- a/WebCore/xml/XPathParser.cpp
+++ b/WebCore/xml/XPathParser.cpp
@@ -124,23 +124,21 @@ static bool isNodeTypeName(const String& name)
return nodeTypeNames.contains(name);
}
-/* Returns whether the last parsed token matches the [32] Operator rule
- * (check http://www.w3.org/TR/xpath#exprlex). Necessary to disambiguate
- * the tokens.
- */
-bool Parser::isOperatorContext() const
+// Returns whether the current token can possibly be a binary operator, given
+// the previous token. Necessary to disambiguate some of the operators
+// (* (multiply), div, and, or, mod) in the [32] Operator rule
+// (check http://www.w3.org/TR/xpath#exprlex).
+bool Parser::isBinaryOperatorContext() const
{
- if (m_nextPos == 0)
- return false;
-
switch (m_lastTokenType) {
- case AND: case OR: case MULOP:
- case '/': case SLASHSLASH: case '|': case PLUS: case MINUS:
- case EQOP: case RELOP:
- case '@': case AXISNAME: case '(': case '[':
- return false;
- default:
- return true;
+ case 0:
+ case '@': case AXISNAME: case '(': case '[': case ',':
+ case AND: case OR: case MULOP:
+ case '/': case SLASHSLASH: case '|': case PLUS: case MINUS:
+ case EQOP: case RELOP:
+ return false;
+ default:
+ return true;
}
}
@@ -279,57 +277,57 @@ Token Parser::nextTokenInternal()
char code = peekCurHelper();
switch (code) {
- case '(': case ')': case '[': case ']':
- case '@': case ',': case '|':
- return makeTokenAndAdvance(code);
- case '\'':
- case '\"':
- return lexString();
- case '0': case '1': case '2': case '3': case '4':
- case '5': case '6': case '7': case '8': case '9':
+ case '(': case ')': case '[': case ']':
+ case '@': case ',': case '|':
+ return makeTokenAndAdvance(code);
+ case '\'':
+ case '\"':
+ return lexString();
+ case '0': case '1': case '2': case '3': case '4':
+ case '5': case '6': case '7': case '8': case '9':
+ return lexNumber();
+ case '.': {
+ char next = peekAheadHelper();
+ if (next == '.')
+ return makeTokenAndAdvance(DOTDOT, 2);
+ if (next >= '0' && next <= '9')
return lexNumber();
- case '.': {
- char next = peekAheadHelper();
- if (next == '.')
- return makeTokenAndAdvance(DOTDOT, 2);
- if (next >= '0' && next <= '9')
- return lexNumber();
- return makeTokenAndAdvance('.');
- }
- case '/':
- if (peekAheadHelper() == '/')
- return makeTokenAndAdvance(SLASHSLASH, 2);
- return makeTokenAndAdvance('/');
- case '+':
- return makeTokenAndAdvance(PLUS);
- case '-':
- return makeTokenAndAdvance(MINUS);
- case '=':
- return makeTokenAndAdvance(EQOP, EqTestOp::OP_EQ);
- case '!':
- if (peekAheadHelper() == '=')
- return makeTokenAndAdvance(EQOP, EqTestOp::OP_NE, 2);
+ return makeTokenAndAdvance('.');
+ }
+ case '/':
+ if (peekAheadHelper() == '/')
+ return makeTokenAndAdvance(SLASHSLASH, 2);
+ return makeTokenAndAdvance('/');
+ case '+':
+ return makeTokenAndAdvance(PLUS);
+ case '-':
+ return makeTokenAndAdvance(MINUS);
+ case '=':
+ return makeTokenAndAdvance(EQOP, EqTestOp::OP_EQ);
+ case '!':
+ if (peekAheadHelper() == '=')
+ return makeTokenAndAdvance(EQOP, EqTestOp::OP_NE, 2);
+ return Token(XPATH_ERROR);
+ case '<':
+ if (peekAheadHelper() == '=')
+ return makeTokenAndAdvance(RELOP, EqTestOp::OP_LE, 2);
+ return makeTokenAndAdvance(RELOP, EqTestOp::OP_LT);
+ case '>':
+ if (peekAheadHelper() == '=')
+ return makeTokenAndAdvance(RELOP, EqTestOp::OP_GE, 2);
+ return makeTokenAndAdvance(RELOP, EqTestOp::OP_GT);
+ case '*':
+ if (isBinaryOperatorContext())
+ return makeTokenAndAdvance(MULOP, NumericOp::OP_Mul);
+ ++m_nextPos;
+ return Token(NAMETEST, "*");
+ case '$': { // $ QName
+ m_nextPos++;
+ String name;
+ if (!lexQName(name))
return Token(XPATH_ERROR);
- case '<':
- if (peekAheadHelper() == '=')
- return makeTokenAndAdvance(RELOP, EqTestOp::OP_LE, 2);
- return makeTokenAndAdvance(RELOP, EqTestOp::OP_LT);
- case '>':
- if (peekAheadHelper() == '=')
- return makeTokenAndAdvance(RELOP, EqTestOp::OP_GE, 2);
- return makeTokenAndAdvance(RELOP, EqTestOp::OP_GT);
- case '*':
- if (isOperatorContext())
- return makeTokenAndAdvance(MULOP, NumericOp::OP_Mul);
- ++m_nextPos;
- return Token(NAMETEST, "*");
- case '$': { // $ QName
- m_nextPos++;
- String name;
- if (!lexQName(name))
- return Token(XPATH_ERROR);
- return Token(VARIABLEREFERENCE, name);
- }
+ return Token(VARIABLEREFERENCE, name);
+ }
}
String name;
@@ -338,7 +336,7 @@ Token Parser::nextTokenInternal()
skipWS();
// If we're in an operator context, check for any operator names
- if (isOperatorContext()) {
+ if (isBinaryOperatorContext()) {
if (name == "and") //### hash?
return Token(AND);
if (name == "or")
@@ -430,26 +428,26 @@ int Parser::lex(void* data)
Token tok = nextToken();
switch (tok.type) {
- case AXISNAME:
- yylval->axis = tok.axis;
- break;
- case MULOP:
- yylval->numop = tok.numop;
- break;
- case RELOP:
- case EQOP:
- yylval->eqop = tok.eqop;
- break;
- case NODETYPE:
- case PI:
- case FUNCTIONNAME:
- case LITERAL:
- case VARIABLEREFERENCE:
- case NUMBER:
- case NAMETEST:
- yylval->str = new String(tok.str);
- registerString(yylval->str);
- break;
+ case AXISNAME:
+ yylval->axis = tok.axis;
+ break;
+ case MULOP:
+ yylval->numop = tok.numop;
+ break;
+ case RELOP:
+ case EQOP:
+ yylval->eqop = tok.eqop;
+ break;
+ case NODETYPE:
+ case PI:
+ case FUNCTIONNAME:
+ case LITERAL:
+ case VARIABLEREFERENCE:
+ case NUMBER:
+ case NAMETEST:
+ yylval->str = new String(tok.str);
+ registerString(yylval->str);
+ break;
}
return tok.type;
diff --git a/WebCore/xml/XPathParser.h b/WebCore/xml/XPathParser.h
index 44a8e48..0ee447a 100644
--- a/WebCore/xml/XPathParser.h
+++ b/WebCore/xml/XPathParser.h
@@ -91,7 +91,7 @@ namespace WebCore {
void deleteNodeTest(Step::NodeTest*);
private:
- bool isOperatorContext() const;
+ bool isBinaryOperatorContext() const;
void skipWS();
Token makeTokenAndAdvance(int type, int advance = 1);
--
WebKit Debian packaging
More information about the Pkg-webkit-commits
mailing list