Changeset 160010 in webkit

Timestamp:

Dec 3, 2013 9:29:22 AM (10 years ago)

Author:

commit-queue@webkit.org

Message:

ASSERTION FAILED: !value

(value->isPrimitiveValue()) in WebCore::StyleProperties::getLayeredShorthandValue.

​https://bugs.webkit.org/show_bug.cgi?id=125146

Patch by László Langó <​lango@inf.u-szeged.hu> on 2013-12-03
Reviewed by Darin Adler.

Source/WebCore:

Do not presume that |yValue| is primitive if |value| is implicit in StylePropertySerializer.
An implicit y-value can become explicit if specified as a separate longhand.
At the same time, its new value can be non-primitive.

Backported from Blink:
​http://src.chromium.org/viewvc/blink?view=rev&rev=153678

Test: fast/css/webkit-mask-crash-implicit.html

• css/StyleProperties.cpp:

(WebCore::StyleProperties::getLayeredShorthandValue):

LayoutTests:

• fast/css/webkit-mask-crash-implicit-expected.txt: Added.
• fast/css/webkit-mask-crash-implicit.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/css/webkit-mask-crash-implicit-expected.txt (added)
• LayoutTests/fast/css/webkit-mask-crash-implicit.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/css/StyleProperties.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2013-12-03  László Langó  <lango@inf.u-szeged.hu>
+
+        ASSERTION FAILED: !value || (value->isPrimitiveValue()) in WebCore::StyleProperties::getLayeredShorthandValue.
+        https://bugs.webkit.org/show_bug.cgi?id=125146
+
+        Reviewed by Darin Adler.
+
+        * fast/css/webkit-mask-crash-implicit-expected.txt: Added.
+        * fast/css/webkit-mask-crash-implicit.html: Added.
+
 2013-12-03  Rob Buis  <rob.buis@samsung.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2013-12-03  László Langó  <lango@inf.u-szeged.hu>
+
+        ASSERTION FAILED: !value || (value->isPrimitiveValue()) in WebCore::StyleProperties::getLayeredShorthandValue.
+        https://bugs.webkit.org/show_bug.cgi?id=125146
+
+        Reviewed by Darin Adler.
+
+        Do not presume that |yValue| is primitive if |value| is implicit in StylePropertySerializer.
+        An implicit y-value can become explicit if specified as a separate longhand.
+        At the same time, its new value can be non-primitive.
+
+        Backported from Blink:
+        http://src.chromium.org/viewvc/blink?view=rev&rev=153678
+
+        Test: fast/css/webkit-mask-crash-implicit.html
+
+        * css/StyleProperties.cpp:
+        (WebCore::StyleProperties::getLayeredShorthandValue):
+
 2013-12-03  Rob Buis  <rob.buis@samsung.com>
 

trunk/Source/WebCore/css/StyleProperties.cpp

@@ -412 +412 @@
                         yValue = nextValue;
 
+                    if (!value->isPrimitiveValue() || !yValue->isPrimitiveValue())
+                        continue;
+
                     CSSValueID xId = toCSSPrimitiveValue(value.get())->getValueID();
                     CSSValueID yId = toCSSPrimitiveValue(yValue.get())->getValueID();