gecko-dev/testing/web-platform/tests/css/css-variables/variable-exponential-blowup.html
Anders Hartvoll Ruud ccd989790a Bug 1541949 [wpt PR 16239] - [css-variables] Limit length of substituted token sequence., a=testonly
Automatic update from web-platform-tests
[css-variables] Limit length of substituted token sequence.

A recent amendment to the spec requires us to impose a limit (without
specifying what that limit is).

Mozilla has already implemented a limit. (A maximum string representation
of 1MB, I believe). Unfortunately, we can't implement the limit the same
way, as we don't have a quick way of knowing what the string representation
of a given variable is; we would have to serialize the tokens. (This may
change in the future, though).

This CL suggest a limit of 16K tokens instead, without imposing any direct
limit on the string backing of those tokens. That means that there is
effectively no limit on e.g. data URLs.

The problem of a large initial string duplicated many times with the
billion laughs technique is mitigated by the fact that String is reference
counted: we do end up with a large amount of String instances, but they
all point to a fairly limited number of StringImpls. I have added a unit
test to verify this behavior.

Also updated the test: --v31 wasn't declared, and 'content' does not
accept multiple strings separated by commas.

BUG=939289
R=emilio@chromium.org, futhark@chromium.org

Change-Id: I6d4cb5fed4d752ff409db390fd09f8f91ea54bcb
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1549058
Commit-Queue: Anders Hartvoll Ruud <andruud@chromium.org>
Reviewed-by: Emilio Cobos Álvarez <emilio@chromium.org>
Reviewed-by: Rune Lillesveen <futhark@chromium.org>
Cr-Commit-Position: refs/heads/master@{#647220}

--

wpt-commits: 56a8b65c49d6da9fec8d32df290086f8cd90b49e
wpt-pr: 16239
2019-06-05 10:25:11 +01:00

28 lines
931 B
HTML

<!doctype html>
<title>CSS Variables Test: Exponential blowup doesn't crash</title>
<meta charset="UTF-8">
<script src="/resources/testharness.js"></script>
<script src="/resources/testharnessreport.js"></script>
<link rel="author" href="mailto:emilio@crisal.io" title="Emilio Cobos Álvarez">
<link rel="author" href="https://mozilla.org" title="Mozilla">
<link rel="help" href="https://drafts.csswg.org/css-variables/">
<script>
let css = `
--v0: "Something really really really long";
`;
for (let i = 0; i < 31; ++i)
css += `--v${i + 1}: var(--v${i}) var(--v${i});`;
let s = document.createElement("style");
s.innerHTML = `
:root { ${css}; }
:root::before { content: var(--v31); }
`;
document.head.appendChild(s);
</script>
PASS if doesn't crash
<script>
test(function() {
getComputedStyle(document.documentElement, "::before").content;
assert_true(true, "Didn't crash");
});
</script>