[SCM] WebKit Debian packaging branch, debian/experimental, updated. upstream/1.3.3-9427-gc2be6fc

Wed Dec 22 15:34:16 UTC 2010

The following commit has been merged in the debian/experimental branch:
commit 92ec5156a4f346d9f982cd74644d3d1c49d2f123
Author: apavlov at chromium.org <apavlov at chromium.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Date:   Mon Nov 8 16:54:29 2010 +0000

    2010-11-08  Alexander Pavlov  <apavlov at chromium.org>
    
            Reviewed by David Hyatt.
    
            getPropertyValue("background") causes crash
            https://bugs.webkit.org/show_bug.cgi?id=49055
    
            * fast/css/background-norepeat-crash-expected.txt: Added.
            * fast/css/background-norepeat-crash.html: Added.
    2010-11-08  Alexander Pavlov  <apavlov at chromium.org>
    
            Reviewed by David Hyatt.
    
            getPropertyValue("background") causes crash
            https://bugs.webkit.org/show_bug.cgi?id=49055
    
            Test: fast/css/background-norepeat-crash.html
    
            * css/CSSMutableStyleDeclaration.cpp:
            (WebCore::CSSMutableStyleDeclaration::getLayeredShorthandValue):
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@71530 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index 3ad47b3..b4ded5c 100644
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,13 @@
+2010-11-08  Alexander Pavlov  <apavlov at chromium.org>
+
+        Reviewed by David Hyatt.
+
+        getPropertyValue("background") causes crash
+        https://bugs.webkit.org/show_bug.cgi?id=49055
+
+        * fast/css/background-norepeat-crash-expected.txt: Added.
+        * fast/css/background-norepeat-crash.html: Added.
+
 2010-11-08  Martin Robinson  <mrobinson at igalia.com>
 
         Skip failing tests and rebaseline another test after r71512.
diff --git a/LayoutTests/fast/css/background-norepeat-crash-expected.txt b/LayoutTests/fast/css/background-norepeat-crash-expected.txt
new file mode 100644
index 0000000..e535fd4
--- /dev/null
+++ b/LayoutTests/fast/css/background-norepeat-crash-expected.txt
@@ -0,0 +1,9 @@
+layer at (0,0) size 800x600
+  RenderView at (0,0) size 800x600
+layer at (0,0) size 800x600
+  RenderBlock {HTML} at (0,0) size 800x600
+    RenderBody {BODY} at (8,8) size 784x576
+      RenderBlock {P} at (0,0) size 784x36
+        RenderText {#text} at (0,0) size 686x36
+          text run at (0,0) width 686: "Test for crash when retrieving the implicit \"background\" property value with \"background-repeat: no-repeat\""
+          text run at (0,18) width 565: "(https://bugs.webkit.org/show_bug.cgi?id=49055). If this text appears, the test has passed."
diff --git a/LayoutTests/fast/css/background-norepeat-crash.html b/LayoutTests/fast/css/background-norepeat-crash.html
new file mode 100644
index 0000000..f10132a
--- /dev/null
+++ b/LayoutTests/fast/css/background-norepeat-crash.html
@@ -0,0 +1,6 @@
+<body style="background:url(),url(); background-repeat:no-repeat;">
+<script>document.body.style.getPropertyValue("background")</script>
+<p>
+    Test for crash when retrieving the implicit "background" property value with "background-repeat: no-repeat" (https://bugs.webkit.org/show_bug.cgi?id=49055). If this text appears, the test has passed.
+</p>
+</body>
diff --git a/WebCore/ChangeLog b/WebCore/ChangeLog
index efcb2ee..8925d5e 100644
--- a/WebCore/ChangeLog
+++ b/WebCore/ChangeLog
@@ -1,3 +1,15 @@
+2010-11-08  Alexander Pavlov  <apavlov at chromium.org>
+
+        Reviewed by David Hyatt.
+
+        getPropertyValue("background") causes crash
+        https://bugs.webkit.org/show_bug.cgi?id=49055
+
+        Test: fast/css/background-norepeat-crash.html
+
+        * css/CSSMutableStyleDeclaration.cpp:
+        (WebCore::CSSMutableStyleDeclaration::getLayeredShorthandValue):
+
 2010-11-08  Martin Robinson  <mrobinson at igalia.com>
 
         Reviewed by Xan Lopez.
diff --git a/WebCore/css/CSSMutableStyleDeclaration.cpp b/WebCore/css/CSSMutableStyleDeclaration.cpp
index 9b1dd71..02319f5 100644
--- a/WebCore/css/CSSMutableStyleDeclaration.cpp
+++ b/WebCore/css/CSSMutableStyleDeclaration.cpp
@@ -336,7 +336,9 @@ String CSSMutableStyleDeclaration::getLayeredShorthandValue(const int* propertie
             // then it was written with only one value. Here we figure out which value that was so we can
             // report back correctly. 
             if (properties[j] == CSSPropertyBackgroundRepeatX && isPropertyImplicit(properties[j])) {
-                if (j < number - 1 && properties[j + 1] == CSSPropertyBackgroundRepeatY) {
+
+                // BUG 49055: make sure the value was not reset in the layer check just above.
+                if (j < number - 1 && properties[j + 1] == CSSPropertyBackgroundRepeatY && value) {
                     RefPtr<CSSValue> yValue;
                     RefPtr<CSSValue> nextValue = values[j + 1];
                     if (nextValue->isValueList())

-- 
WebKit Debian packaging

