Bug 842134: fix serialization of unquoted url() in CSS. r=heycam

2013-02-17 22:03:55 -05:00
parent 950046530e
commit 2c03623c0c
3 changed files with 3 additions and 0 deletions
--- a/layout/style/crashtests/842134.html
+++ b/layout/style/crashtests/842134.html
@@ -0,0 +1 @@
+<!doctype html><style>body { marker: url(#m) url(#m); }</style>
--- a/layout/style/crashtests/crashtests.list
+++ b/layout/style/crashtests/crashtests.list
@@ -88,3 +88,4 @@ load 822842.html
 load 822766-1.html
 load 827591-1.html
 load 840898.html
+load 842134.html
--- a/layout/style/nsCSSScanner.cpp
+++ b/layout/style/nsCSSScanner.cpp
@@ -1030,6 +1030,7 @@ nsCSSScanner::NextURL(nsCSSToken& aToken)

  } else {
    // Otherwise, this is the start of a non-quoted url (which may be empty).
+    aToken.mSymbol = PRUnichar(0);
    GatherText(IS_URL_CHAR, aToken.mIdent);
  }
				`@@ -0,0 +1 @@`
				`<!doctype html><style>body { marker: url(#m) url(#m); }</style>`