Fix parenthesis-matching while parsing format() function in @font-face src: descriptor. (Bug 511333) r=dbaron

layout/style/nsCSSParser.cpp

@@ -7957,16 +7957,23 @@ CSSParserImpl::ParseFontSrcFormat(nsTArray<nsCSSValue> & values)
 
   do {
     if (!GetToken(PR_TRUE))
-      return PR_FALSE;
+      return PR_FALSE; // EOF - no need for SkipUntil
 
-    if (mToken.mType != eCSSToken_String)
+    if (mToken.mType != eCSSToken_String) {
+      SkipUntil(')');
       return PR_FALSE;
+    }
 
     nsCSSValue cur(mToken.mIdent, eCSSUnit_Font_Format);
     values.AppendElement(cur);
   } while (ExpectSymbol(',', PR_TRUE));
 
-  return ExpectSymbol(')', PR_TRUE);
+  if (!ExpectSymbol(')', PR_TRUE)) {
+    SkipUntil(')');
+    return PR_FALSE;
+  }
+
+  return PR_TRUE;
 }
 
 // font-ranges: urange ( ',' urange )*

layout/style/test/test_font_face_parser.html

@@ -120,7 +120,7 @@
       d: { "src" : "local(\"老鼠\"), url(\"/fonts/Mouse\") format(\"truetype\")" } },
 
     // Correct but unusual src:
-    { rule: _("src: local(Hoefler Text);"), 
+    { rule: _("src: local(Hoefler Text);"),
       d: {"src" : "local(\"Hoefler Text\")"}, noncanonical: true },
 
     // Incorrect src:
@@ -154,6 +154,16 @@
       d: { "src" : "local(\"Mouse\")" },
       noncanonical: true },
 
+    // Correct parenthesis matching for format()
+    { rule: _("src: url(\"/fonts/Mouse\"); " +
+	      "src: url(\"/fonts/Cat\") format(Cat(); src: local(Rat); )"),
+      d: { "src" : "url(\"/fonts/Mouse\")" },
+      noncanonical: true },
+    { rule: _("src: url(\"/fonts/Mouse\"); " +
+	      "src: url(\"/fonts/Cat\") format(\"Cat\"; src: local(Rat); )"),
+      d: { "src" : "url(\"/fonts/Mouse\")" },
+      noncanonical: true },
+
     // unicode-range is not implemented (bug 443976).
     // tests for that omitted for now.
   ];