1 files changed, 56 insertions, 63 deletions

diff --git a/chromium/third_party/WebKit/Source/core/inspector/ContentSearchUtils.cpp b/chromium/third_party/WebKit/Source/core/inspector/ContentSearchUtils.cpp
index 9ed8568644c..cd20aeb7063 100644
--- a/chromium/third_party/WebKit/Source/core/inspector/ContentSearchUtils.cpp
+++ b/chromium/third_party/WebKit/Source/core/inspector/ContentSearchUtils.cpp
@@ -33,8 +33,6 @@
 #include "bindings/v8/ScriptRegexp.h"
 #include "wtf/text/StringBuilder.h"
 
-using namespace std;
-
 namespace WebCore {
 namespace ContentSearchUtils {
 
@@ -95,25 +93,6 @@ PassOwnPtr<ScriptRegexp> createSearchRegex(const String& query, bool caseSensiti
     return adoptPtr(new ScriptRegexp(regexSource, caseSensitive ? TextCaseSensitive : TextCaseInsensitive));
 }
 
-int countScriptRegexpMatches(const ScriptRegexp* regex, const String& content)
-{
-    if (content.isEmpty())
-        return 0;
-
-    int result = 0;
-    int position;
-    unsigned start = 0;
-    int matchLength;
-    while ((position = regex->match(content, start, &matchLength)) != -1) {
-        if (start >= content.length())
-            break;
-        if (matchLength > 0)
-            ++result;
-        start = position + 1;
-    }
-    return result;
-}
-
 PassRefPtr<TypeBuilder::Array<TypeBuilder::Page::SearchMatch> > searchInTextByLines(const String& text, const String& query, const bool caseSensitive, const bool isRegex)
 {
     RefPtr<TypeBuilder::Array<TypeBuilder::Page::SearchMatch> > result = TypeBuilder::Array<TypeBuilder::Page::SearchMatch>::create();
@@ -132,51 +111,65 @@ static String findMagicComment(const String& content, const String& name, MagicC
     ASSERT(name.find("=") == kNotFound);
     if (deprecated)
         *deprecated = false;
-    String pattern;
-    String deprecatedPattern;
-    switch (commentType) {
-    case JavaScriptMagicComment:
-        pattern = "//#[\040\t]" + createSearchRegexSource(name) + "=[\040\t]*([^\\s\'\"]*)[\040\t]*$";
-        deprecatedPattern = "//@[\040\t]" + createSearchRegexSource(name) + "=[\040\t]*([^\\s\'\"]*)[\040\t]*$";
-        break;
-    case CSSMagicComment:
-        pattern = "/\\*#[\040\t]" + createSearchRegexSource(name) + "=[\040\t]*([^\\s]*)[\040\t]*\\*/[\040\t]*$";
-        deprecatedPattern = "/\\*@[\040\t]" + createSearchRegexSource(name) + "=[\040\t]*([^\\s]*)[\040\t]*\\*/[\040\t]*$";
+
+    unsigned length = content.length();
+    unsigned nameLength = name.length();
+
+    size_t pos = length;
+    size_t equalSignPos = 0;
+    size_t closingCommentPos = 0;
+    while (true) {
+        pos = content.reverseFind(name, pos);
+        if (pos == kNotFound)
+            return String();
+
+        // Check for a /\/[\/*][@#][ \t]/ regexp (length of 4) before found name.
+        if (pos < 4)
+            return String();
+        pos -= 4;
+        if (content[pos] != '/')
+            continue;
+        if ((content[pos + 1] != '/' || commentType != JavaScriptMagicComment)
+            && (content[pos + 1] != '*' || commentType != CSSMagicComment))
+            continue;
+        if (content[pos + 2] != '#' && content[pos + 2] != '@')
+            continue;
+        if (content[pos + 3] != ' ' && content[pos + 3] != '\t')
+            continue;
+        equalSignPos = pos + 4 + nameLength;
+        if (equalSignPos < length && content[equalSignPos] != '=')
+            continue;
+        if (commentType == CSSMagicComment) {
+            closingCommentPos = content.find("*/", equalSignPos + 1);
+            if (closingCommentPos == kNotFound)
+                return String();
+        }
+
         break;
-    default:
-        ASSERT_NOT_REACHED();
-        return String();
-    }
-    ScriptRegexp regex(pattern, TextCaseSensitive, MultilineEnabled);
-    ScriptRegexp deprecatedRegex(deprecatedPattern, TextCaseSensitive, MultilineEnabled);
-
-    int matchLength;
-    int offset = regex.match(content, 0, &matchLength);
-    if (offset == -1) {
-        offset = deprecatedRegex.match(content, 0, &matchLength);
-        if (offset != -1 && deprecated)
-            *deprecated = true;
     }
-    if (offset == -1)
-        return String();
-
-    String match = content.substring(offset, matchLength);
-    size_t separator = match.find("=");
-    ASSERT(separator != kNotFound);
-    match = match.substring(separator + 1);
-
-    switch (commentType) {
-    case JavaScriptMagicComment:
-        return match.stripWhiteSpace();
-    case CSSMagicComment: {
-        size_t lastStarIndex = match.reverseFind('*');
-        ASSERT(lastStarIndex != kNotFound);
-        return match.substring(0, lastStarIndex).stripWhiteSpace();
-    }
-    default:
-        ASSERT_NOT_REACHED();
-        return String();
+
+    if (deprecated && content[pos + 2] == '@')
+        *deprecated = true;
+
+    ASSERT(equalSignPos);
+    ASSERT(commentType != CSSMagicComment || closingCommentPos);
+    size_t urlPos = equalSignPos + 1;
+    String match = commentType == CSSMagicComment
+        ? content.substring(urlPos, closingCommentPos - urlPos)
+        : content.substring(urlPos);
+
+    size_t newLine = match.find("\n");
+    if (newLine != kNotFound)
+        match = match.substring(0, newLine);
+    match = match.stripWhiteSpace();
+
+    String disallowedChars("\"' \t");
+    for (unsigned i = 0; i < match.length(); ++i) {
+        if (disallowedChars.find(match[i]) != kNotFound)
+            return "";
     }
+
+    return match;
 }
 
 String findSourceURL(const String& content, MagicCommentType commentType, bool* deprecated)