Changeset 141701 in webkit
- Timestamp:
- Feb 2, 2013 12:55:48 PM (11 years ago)
- Location:
- trunk
- Files:
-
- 2 added
- 3 edited
Legend:
- Unmodified
- Added
- Removed
-
trunk/LayoutTests/ChangeLog
r141689 r141701 1 2013-02-02 Takashi Sakamoto <tasak@google.com> 2 3 Making -webkit-image-set() the first value of background property causes crash. 4 https://bugs.webkit.org/show_bug.cgi?id=108409 5 6 Reviewed by Beth Dakin. 7 8 * fast/css/image-set-value-crash-in-fillImageSet-expected.txt: Added. 9 * fast/css/image-set-value-crash-in-fillImageSet.html: Added. 10 1 11 2013-02-02 Andrey Lushnikov <lushnikov@chromium.org> 2 12 -
trunk/Source/WebCore/ChangeLog
r141699 r141701 1 2013-02-02 Takashi Sakamoto <tasak@google.com> 2 3 Making -webkit-image-set() the first value of background property causes crash. 4 https://bugs.webkit.org/show_bug.cgi?id=108409 5 6 Reviewed by Beth Dakin. 7 8 CSSParser::addFillValue should use lval->isBaseValueList() instead 9 of lval->isValueList(). If lval is -webkit-image-set, rval is appended 10 to -webkit-image-set. 11 12 Test: fast/css/image-set-value-crash-in-fillImageSet.html 13 14 * css/CSSParser.cpp: 15 (WebCore::CSSParser::addFillValue): 16 If lval is not a value list, lval is initialized by using 17 CSSValueList::createCommaSeparated(). So we have to check whether 18 lval is created by CSSValueList::createCommaSeparated() or not. 19 1 20 2013-02-02 David Kilzer <ddkilzer@apple.com> 2 21 -
trunk/Source/WebCore/css/CSSParser.cpp
r141480 r141701 2971 2971 { 2972 2972 if (lval) { 2973 if (lval->is ValueList())2973 if (lval->isBaseValueList()) 2974 2974 static_cast<CSSValueList*>(lval.get())->append(rval); 2975 2975 else {
Note: See TracChangeset
for help on using the changeset viewer.