Avoid splitting a code point when parsing HTMLImageElement.usemap

Fixes #15883
2026-05-05 06:32:13 +02:00 · 2017-03-25 01:55:16 +00:00
2 changed files with 12 additions and 3 deletions
--- a/components/script/dom/htmlimageelement.rs
+++ b/components/script/dom/htmlimageelement.rs
@@ -422,16 +422,17 @@ impl HTMLImageElement {
        };
        let value = usemap_attr.value();
        let (first, last) = value.split_at(1);
-        if first != "#" || last.len() == 0 {
+        if value.len() <= 1 || value.bytes()[0] != b'#' {
            return None
        }
        let value = &value[1..];
        let map = self.upcast::<Node>()
                      .following_siblings()
                      .filter_map(Root::downcast::<HTMLMapElement>)
-                      .find(|n| n.upcast::<Element>().get_string_attribute(&LocalName::from("name")) == last);
+                      .find(|n| n.upcast::<Element>().get_string_attribute(&LocalName::from("name")) == value);
        let elements: Vec<Root<HTMLAreaElement>> = map.unwrap().upcast::<Node>()
                      .children()
--- a/tests/wpt/web-platform-tests/html/semantics/embedded-content/image-maps/image-map-processing-model/hash-name-reference-test-data.html
+++ b/tests/wpt/web-platform-tests/html/semantics/embedded-content/image-maps/image-map-processing-model/hash-name-reference-test-data.html
@@ -11,6 +11,14 @@
 </head>
 <body>
 <div data-expect="no match">
 <img src="/images/threecolors.png" usemap="&#x1F4A9;"/>
 <object data="/images/threecolors.png" usemap="&#x1F4A9;"></object>
 <map name="&#x1F4A9;">
  <area shape="rect" coords="0,0,99,50" href="#area-&#x1F4A9;"/>
 </map>
 </div>
 <div data-expect="no match">
 <img src="/images/threecolors.png" usemap="no-hash-name"/>
 <object data="/images/threecolors.png" usemap="no-hash-name"></object>