Bug 1449075 - comma and/or whitespace should be mandatory to separate transform values r=dholbert

dom/svg/SVGTransformListParser.cpp

@@ -114,7 +114,11 @@ SVGTransformListParser::ParseArguments(float* aResult,
   }
   *aParsedCount = 1;
 
-  while (SkipWsp()) {
+  while (true) {
+    RangedPtr<const char16_t> iter(mIter);
+    if (!SkipWsp()) {
+      return false;
+    }
     if (*mIter == ')') {
       ++mIter;
       return true;
@@ -123,6 +127,10 @@ SVGTransformListParser::ParseArguments(float* aResult,
       return false;
     }
     SkipCommaWsp();
+    if (iter == mIter) {
+      // There must be either whitespace or a comma between values
+      return false;
+    }
     if (!SVGContentUtils::ParseNumber(mIter, mEnd, aResult[(*aParsedCount)++])) {
       return false;
     }

layout/reftests/svg/reftest.list

@@ -483,6 +483,7 @@ fuzzy-if(skiaContent,1,610) == textPath-03.svg pass.svg
 
 == thin-stroke-01.svg pass.svg
 
+== transform-01.svg pass.svg
 == transform-outer-svg-01.svg transform-outer-svg-01-ref.svg
 
 == tspan-dxdy-01.svg tspan-dxdy-ref.svg

layout/reftests/svg/transform-01.svg

@@ -0,0 +1,11 @@
+<!--
+     Any copyright is dedicated to the Public Domain.
+     http://creativecommons.org/publicdomain/zero/1.0/
+-->
+<svg xmlns="http://www.w3.org/2000/svg">
+  <rect width="100%" height="100%" fill="lime"/>
+  <rect x="25" y="25" width="50" height="50" fill="red"/>
+  <g transform="translate(-100-100)">
+    <rect x="24" y="24" width="52" height="52" fill="lime"/>
+  </g>
+</svg>