Title: [160010] trunk
- Revision
- 160010
- Author
- [email protected]
- Date
- 2013-12-03 09:29:22 -0800 (Tue, 03 Dec 2013)
Log Message
ASSERTION FAILED: !value || (value->isPrimitiveValue()) in WebCore::StyleProperties::getLayeredShorthandValue.
https://bugs.webkit.org/show_bug.cgi?id=125146
Patch by László Langó <[email protected]> on 2013-12-03
Reviewed by Darin Adler.
Source/WebCore:
Do not presume that |yValue| is primitive if |value| is implicit in StylePropertySerializer.
An implicit y-value can become explicit if specified as a separate longhand.
At the same time, its new value can be non-primitive.
Backported from Blink:
http://src.chromium.org/viewvc/blink?view=rev&rev=153678
Test: fast/css/webkit-mask-crash-implicit.html
* css/StyleProperties.cpp:
(WebCore::StyleProperties::getLayeredShorthandValue):
LayoutTests:
* fast/css/webkit-mask-crash-implicit-expected.txt: Added.
* fast/css/webkit-mask-crash-implicit.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (160009 => 160010)
--- trunk/LayoutTests/ChangeLog 2013-12-03 17:26:36 UTC (rev 160009)
+++ trunk/LayoutTests/ChangeLog 2013-12-03 17:29:22 UTC (rev 160010)
@@ -1,3 +1,13 @@
+2013-12-03 László Langó <[email protected]>
+
+ ASSERTION FAILED: !value || (value->isPrimitiveValue()) in WebCore::StyleProperties::getLayeredShorthandValue.
+ https://bugs.webkit.org/show_bug.cgi?id=125146
+
+ Reviewed by Darin Adler.
+
+ * fast/css/webkit-mask-crash-implicit-expected.txt: Added.
+ * fast/css/webkit-mask-crash-implicit.html: Added.
+
2013-12-03 Rob Buis <[email protected]>
[css shapes] layout for new ellipse syntax
Added: trunk/LayoutTests/fast/css/webkit-mask-crash-implicit-expected.txt (0 => 160010)
--- trunk/LayoutTests/fast/css/webkit-mask-crash-implicit-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/css/webkit-mask-crash-implicit-expected.txt 2013-12-03 17:29:22 UTC (rev 160010)
@@ -0,0 +1,4 @@
+FAIL document.styleSheets[1].rules[0].style.cssText should be -webkit-mask-repeat: repeat-x; -webkit-mask-repeat-y: inherit;. Was -webkit-mask: inherit;.
+FAIL document.styleSheets[1].rules[0].style.getPropertyValue('-webkit-mask') should be . Was inherit.
+FAIL document.styleSheets[1].rules[0].style.getPropertyValue('-webkit-mask-repeat') should be repeat inherit. Was inherit.
+
Added: trunk/LayoutTests/fast/css/webkit-mask-crash-implicit.html (0 => 160010)
--- trunk/LayoutTests/fast/css/webkit-mask-crash-implicit.html (rev 0)
+++ trunk/LayoutTests/fast/css/webkit-mask-crash-implicit.html 2013-12-03 17:29:22 UTC (rev 160010)
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<head>
+<script src=""
+<style>
+.box {
+-webkit-mask-repeat: repeat-x; -webkit-mask-repeat-y: inherit;
+}
+</style>
+<script>
+if (window.internals)
+ testRunner.dumpAsText();
+shouldBeEqualToString("document.styleSheets[1].rules[0].style.cssText", "-webkit-mask-repeat: repeat-x; -webkit-mask-repeat-y: inherit;");
+shouldBeEqualToString("document.styleSheets[1].rules[0].style.getPropertyValue('-webkit-mask')", "");
+shouldBeEqualToString("document.styleSheets[1].rules[0].style.getPropertyValue('-webkit-mask-repeat')", "repeat inherit");
+</script>
+</head>
+<body>
+</body>
+</html>
\ No newline at end of file
Modified: trunk/Source/WebCore/ChangeLog (160009 => 160010)
--- trunk/Source/WebCore/ChangeLog 2013-12-03 17:26:36 UTC (rev 160009)
+++ trunk/Source/WebCore/ChangeLog 2013-12-03 17:29:22 UTC (rev 160010)
@@ -1,3 +1,22 @@
+2013-12-03 László Langó <[email protected]>
+
+ ASSERTION FAILED: !value || (value->isPrimitiveValue()) in WebCore::StyleProperties::getLayeredShorthandValue.
+ https://bugs.webkit.org/show_bug.cgi?id=125146
+
+ Reviewed by Darin Adler.
+
+ Do not presume that |yValue| is primitive if |value| is implicit in StylePropertySerializer.
+ An implicit y-value can become explicit if specified as a separate longhand.
+ At the same time, its new value can be non-primitive.
+
+ Backported from Blink:
+ http://src.chromium.org/viewvc/blink?view=rev&rev=153678
+
+ Test: fast/css/webkit-mask-crash-implicit.html
+
+ * css/StyleProperties.cpp:
+ (WebCore::StyleProperties::getLayeredShorthandValue):
+
2013-12-03 Rob Buis <[email protected]>
Fix build break after r160007.
Modified: trunk/Source/WebCore/css/StyleProperties.cpp (160009 => 160010)
--- trunk/Source/WebCore/css/StyleProperties.cpp 2013-12-03 17:26:36 UTC (rev 160009)
+++ trunk/Source/WebCore/css/StyleProperties.cpp 2013-12-03 17:29:22 UTC (rev 160010)
@@ -411,6 +411,9 @@
else
yValue = nextValue;
+ if (!value->isPrimitiveValue() || !yValue->isPrimitiveValue())
+ continue;
+
CSSValueID xId = toCSSPrimitiveValue(value.get())->getValueID();
CSSValueID yId = toCSSPrimitiveValue(yValue.get())->getValueID();
if (xId != yId) {
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
