1176668 - Code from handling NCR overflow is bogus, especially upon EOF

Status: RESOLVED FIXED

(Core :: DOM: HTML Parser, defect)

Description

[Henri Sivonen (:hsivonen)]

Steps to reproduce:
 1) http://software.hixie.ch/utilities/js/live-dom-viewer/saved/3540

Actual results:
Not U+FFFD.

Expected result:
U+FFFD.

Comment 1

[Henri Sivonen (:hsivonen)]

Attachment: htmlparser repo patch

Test cases: https://github.com/html5lib/html5lib-tests/pull/59

Comment 2

[Henri Sivonen (:hsivonen)]

Attachment: m-c patch

Comment 3

[Henri Sivonen (:hsivonen)]

See bug 1029671 comment 36 for the big picture of the whole queue and about landing.

Comment 4

[William Chen [:wchen]]

Comment on attachment 8625262 [details] [diff] [review]
htmlparser repo patch

Review of attachment 8625262 [details] [diff] [review]:
-----------------------------------------------------------------

We should also add an assertion to handleNcrValue to make sure that value is non-negative.

::: src/nu/validator/htmlparser/impl/Tokenizer.java
@@ +3352,5 @@
>                              seenDigits = true;
> +                            // Avoid overflow
> +                            if (value <= 0x10FFFF) {
> +                                value *= 16;
> +                                value += c - '0';                                

trailing whitespace

Comment 5

[Henri Sivonen (:hsivonen)]

Attachment: htmlparser repo patch, review comments addressed

Thanks. Attaching the fix patch for the record.

Comment 6

[Henri Sivonen (:hsivonen)]

Attachment: m-c patch, review comments addressed

Comment 7

[Pulsebot]

https://hg.mozilla.org/integration/mozilla-inbound/rev/bb56d50195c4

Comment 8

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/bb56d50195c4