Bug 1314531 - Disallow xul tree pseudo-elements with user action pseudo-classes. r?heycam
MozReview-Commit-ID: 85DDwDl0oYg
new file mode 100644
--- /dev/null
+++ b/layout/style/crashtests/1314531.html
@@ -0,0 +1,2 @@
+<!DOCTYPE html>
+<style>::-moz-tree-row:hover {}</style>
--- a/layout/style/crashtests/crashtests.list
+++ b/layout/style/crashtests/crashtests.list
@@ -154,8 +154,9 @@ load 1278463-1.html
pref(dom.animations-api.core.enabled,true) load 1277908-1.html
load 1277908-2.html
load 1282076-1.html
pref(dom.animations-api.core.enabled,true) load 1282076-2.html
pref(dom.animations-api.core.enabled,true) load 1290994-1.html
pref(dom.animations-api.core.enabled,true) load 1290994-2.html
pref(dom.animations-api.core.enabled,true) load 1290994-3.html
load 1290994-4.html
+load 1314531.html
--- a/layout/style/nsCSSParser.cpp
+++ b/layout/style/nsCSSParser.cpp
@@ -6092,17 +6092,18 @@ CSSParserImpl::ParsePseudoSelector(int32
!isAnonBox) {
REPORT_UNEXPECTED_TOKEN(PEPseudoSelNotPE);
UngetToken();
return eSelectorParsingStatus_Error;
}
if (aSelector.IsPseudoElement()) {
CSSPseudoElementType type = aSelector.PseudoType();
- if (!nsCSSPseudoElements::PseudoElementSupportsUserActionState(type)) {
+ if (type >= CSSPseudoElementType::Count ||
+ !nsCSSPseudoElements::PseudoElementSupportsUserActionState(type)) {
// We only allow user action pseudo-classes on certain pseudo-elements.
REPORT_UNEXPECTED_TOKEN(PEPseudoSelNoUserActionPC);
UngetToken();
return eSelectorParsingStatus_Error;
}
if (!isPseudoClass || !pseudoClassIsUserAction) {
// CSS 4 Selectors says that pseudo-elements can only be followed by
// a user action pseudo-class.