Bug 489871 - CSS comments should not be allowed in presentation attribute values. r=dbaron a=roc

--HG--
extra : rebase_source : 7a41fca1422a024934839ebe0c50cc479223915f

layout/reftests/svg/cssComment-in-attribute-01-ref.svg

@@ -0,0 +1,4 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+  <title>Reference that css comment in attribute is not allowed</title>
+  <rect width="100%" height="100%" fill="black"/>
+</svg>

layout/reftests/svg/cssComment-in-attribute-01.svg

@@ -0,0 +1,4 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+  <title>Testcase that css comment in attribute is not allowed</title>
+  <rect width="100%" height="100%" fill="/* blah */ red"/>
+</svg>

layout/reftests/svg/reftest.list

@@ -20,6 +20,7 @@ include moz-only/reftest.list
 include svg-integration/reftest.list
 
 == altGlyph-01.svg altGlyph-01-ref.svg
+== cssComment-in-attribute-01.svg cssComment-in-attribute-01-ref.svg
 == clip-01.svg pass.svg
 == clip-02a.svg clip-02-ref.svg
 == clip-02b.svg clip-02-ref.svg

layout/style/nsCSSScanner.cpp

@@ -263,9 +263,7 @@ nsCSSScanner::nsCSSScanner()
   : mInputStream(nsnull)
   , mReadPointer(nsnull)
   , mLowLevelError(NS_OK)
-#ifdef MOZ_SVG
   , mSVGMode(PR_FALSE)
-#endif
 #ifdef CSS_REPORT_PARSE_ERRORS
   , mError(mErrorBuf, NS_ARRAY_LENGTH(mErrorBuf), 0)
 #endif
@@ -783,7 +781,7 @@ nsCSSScanner::Next(nsCSSToken& aToken)
       EatWhiteSpace();
       return PR_TRUE;
     }
-    if (ch == '/') {
+    if (ch == '/' && !IsSVGMode()) {
       PRInt32 nextChar = Peek();
       if (nextChar == '*') {
         (void) Read();
@@ -1163,7 +1161,6 @@ nsCSSScanner::ParseNumber(PRInt32 c, nsCSSToken& aToken)
   }
 
   PRBool gotE = PR_FALSE;
-#ifdef MOZ_SVG
   if (IsSVGMode() && (c == 'e' || c == 'E')) {
     PRInt32 nextChar = Peek();
     PRInt32 expSignChar = 0;
@@ -1190,7 +1187,6 @@ nsCSSScanner::ParseNumber(PRInt32 c, nsCSSToken& aToken)
       }
     }
   }
-#endif
 
   nsCSSTokenType type = eCSSToken_Number;
 

layout/style/nsCSSScanner.h

@@ -148,7 +148,6 @@ class nsCSSScanner {
   static PRBool InitGlobals();
   static void ReleaseGlobals();
 
-#ifdef  MOZ_SVG
   // Set whether or not we are processing SVG
   void SetSVGMode(PRBool aSVGMode) {
     NS_ASSERTION(aSVGMode == PR_TRUE || aSVGMode == PR_FALSE,
@@ -159,7 +158,6 @@ class nsCSSScanner {
     return mSVGMode;
   }
 
-#endif
 #ifdef CSS_REPORT_PARSE_ERRORS
   void AddToError(const nsSubstring& aErrorText);
   void OutputError();
@@ -238,10 +236,8 @@ protected:
   nsresult mLowLevelError;
 
   PRUint32 mLineNumber;
-#ifdef MOZ_SVG
   // True if we are in SVG mode; false in "normal" CSS
   PRPackedBool mSVGMode;
-#endif
 #ifdef CSS_REPORT_PARSE_ERRORS
   nsXPIDLCString mFileName;
   nsCOMPtr<nsIURI> mURI;  // Cached so we know to not refetch mFileName