Title: [167972] branches/safari-537.76-branch

Diff

Modified: branches/safari-537.76-branch/LayoutTests/ChangeLog (167971 => 167972)


--- branches/safari-537.76-branch/LayoutTests/ChangeLog	2014-04-30 00:11:05 UTC (rev 167971)
+++ branches/safari-537.76-branch/LayoutTests/ChangeLog	2014-04-30 00:34:27 UTC (rev 167972)
@@ -1,3 +1,17 @@
+2014-04-29  Matthew Hanson  <matthew_han...@apple.com>
+
+        Merge r160010.
+
+    2013-12-03  László Langó  <la...@inf.u-szeged.hu>
+
+            ASSERTION FAILED: !value || (value->isPrimitiveValue()) in WebCore::StyleProperties::getLayeredShorthandValue.
+            https://bugs.webkit.org/show_bug.cgi?id=125146
+
+            Reviewed by Darin Adler.
+
+            * fast/css/webkit-mask-crash-implicit-expected.txt: Added.
+            * fast/css/webkit-mask-crash-implicit.html: Added.
+
 2014-03-26  Matthew Hanson  <matthew_han...@apple.com>
 
         Remove artifacts of local changes that made it into a versioning commit.

Copied: branches/safari-537.76-branch/LayoutTests/fast/css/webkit-mask-crash-implicit-expected.txt (from rev 160010, trunk/LayoutTests/fast/css/webkit-mask-crash-implicit-expected.txt) (0 => 167972)


--- branches/safari-537.76-branch/LayoutTests/fast/css/webkit-mask-crash-implicit-expected.txt	                        (rev 0)
+++ branches/safari-537.76-branch/LayoutTests/fast/css/webkit-mask-crash-implicit-expected.txt	2014-04-30 00:34:27 UTC (rev 167972)
@@ -0,0 +1,4 @@
+FAIL document.styleSheets[1].rules[0].style.cssText should be -webkit-mask-repeat: repeat-x; -webkit-mask-repeat-y: inherit;. Was -webkit-mask: inherit;.
+FAIL document.styleSheets[1].rules[0].style.getPropertyValue('-webkit-mask') should be . Was inherit.
+FAIL document.styleSheets[1].rules[0].style.getPropertyValue('-webkit-mask-repeat') should be repeat inherit. Was inherit.
+

Copied: branches/safari-537.76-branch/LayoutTests/fast/css/webkit-mask-crash-implicit.html (from rev 160010, trunk/LayoutTests/fast/css/webkit-mask-crash-implicit.html) (0 => 167972)


--- branches/safari-537.76-branch/LayoutTests/fast/css/webkit-mask-crash-implicit.html	                        (rev 0)
+++ branches/safari-537.76-branch/LayoutTests/fast/css/webkit-mask-crash-implicit.html	2014-04-30 00:34:27 UTC (rev 167972)
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<head>
+<script src=""
+<style>
+.box {
+-webkit-mask-repeat: repeat-x; -webkit-mask-repeat-y: inherit;
+}
+</style>
+<script>
+if (window.internals)
+    testRunner.dumpAsText();
+shouldBeEqualToString("document.styleSheets[1].rules[0].style.cssText", "-webkit-mask-repeat: repeat-x; -webkit-mask-repeat-y: inherit;");
+shouldBeEqualToString("document.styleSheets[1].rules[0].style.getPropertyValue('-webkit-mask')", "");
+shouldBeEqualToString("document.styleSheets[1].rules[0].style.getPropertyValue('-webkit-mask-repeat')", "repeat inherit");
+</script>
+</head>
+<body>
+</body>
+</html>
\ No newline at end of file

Modified: branches/safari-537.76-branch/Source/WebCore/ChangeLog (167971 => 167972)


--- branches/safari-537.76-branch/Source/WebCore/ChangeLog	2014-04-30 00:11:05 UTC (rev 167971)
+++ branches/safari-537.76-branch/Source/WebCore/ChangeLog	2014-04-30 00:34:27 UTC (rev 167972)
@@ -1,5 +1,28 @@
 2014-03-26  Matthew Hanson  <matthew_han...@apple.com>
 
+        Merge r160010.
+
+    2013-12-03  László Langó  <la...@inf.u-szeged.hu>
+
+            ASSERTION FAILED: !value || (value->isPrimitiveValue()) in WebCore::StyleProperties::getLayeredShorthandValue.
+            https://bugs.webkit.org/show_bug.cgi?id=125146
+
+            Reviewed by Darin Adler.
+
+            Do not presume that |yValue| is primitive if |value| is implicit in StylePropertySerializer.
+            An implicit y-value can become explicit if specified as a separate longhand.
+            At the same time, its new value can be non-primitive.
+
+            Backported from Blink:
+            http://src.chromium.org/viewvc/blink?view=rev&rev=153678
+
+            Test: fast/css/webkit-mask-crash-implicit.html
+
+            * css/StyleProperties.cpp:
+            (WebCore::StyleProperties::getLayeredShorthandValue):
+
+2014-03-26  Matthew Hanson  <matthew_han...@apple.com>
+
         Remove extraneous ! from merge of r166304.
 
 2014-03-26  Matthew Hanson  <matthew_han...@apple.com>

Modified: branches/safari-537.76-branch/Source/WebCore/css/StylePropertySet.cpp (167971 => 167972)


--- branches/safari-537.76-branch/Source/WebCore/css/StylePropertySet.cpp	2014-04-30 00:11:05 UTC (rev 167971)
+++ branches/safari-537.76-branch/Source/WebCore/css/StylePropertySet.cpp	2014-04-30 00:34:27 UTC (rev 167972)
@@ -420,6 +420,9 @@
                     else
                         yValue = nextValue;
 
+                    if (!value->isPrimitiveValue() || !yValue->isPrimitiveValue())
+                        continue;
+
                     int xId = static_cast<CSSPrimitiveValue*>(value.get())->getIdent();
                     int yId = static_cast<CSSPrimitiveValue*>(yValue.get())->getIdent();
                     if (xId != yId) {
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes

Reply via email to