[SCM] WebKit Debian packaging branch, debian/experimental, updated. upstream/1.3.3-9427-gc2be6fc

simon.fraser at apple.com simon.fraser at apple.com
Wed Dec 22 15:37:46 UTC 2010


The following commit has been merged in the debian/experimental branch:
commit 64a61673af8e9b66da020104252d6aad23e5ce18
Author: simon.fraser at apple.com <simon.fraser at apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Date:   Tue Nov 9 17:45:30 2010 +0000

    2010-11-09  Simon Fraser  <simon.fraser at apple.com>
    
            Reviewed by Dave Hyatt.
    
            https://bugs.webkit.org/show_bug.cgi?id=49204
            <rdar://problem/8643412>
    
            Add checks to the CSSStyleSelector code to ensure that the
            casts to the various CSSValue types are safe, and do more
            rigorous checking of the lengths of CSSValueLists, and
            non-null members of Pair in some cases.
    
            * css/CSSBorderImageValue.h:
            (WebCore::CSSBorderImageValue::isBorderImageValue):
            * css/CSSCursorImageValue.h:
            (WebCore::CSSCursorImageValue::isCursorImageValue):
            * css/CSSImageValue.h:
            (WebCore::CSSImageValue::isImageValue):
            * css/CSSReflectValue.h:
            (WebCore::CSSReflectValue::isReflectValue):
            * css/CSSStyleSelector.cpp:
            (WebCore::CSSStyleSelector::resolveVariablesForDeclaration):
            (WebCore::CSSRuleSet::addRulesFromSheet):
            (WebCore::CSSRuleSet::addStyleRule):
            (WebCore::applyCounterList):
            (WebCore::CSSStyleSelector::applyProperty):
            (WebCore::CSSStyleSelector::mapFillSize):
            (WebCore::CSSStyleSelector::mapAnimationDelay):
            (WebCore::CSSStyleSelector::mapAnimationDirection):
            (WebCore::CSSStyleSelector::mapAnimationFillMode):
            (WebCore::CSSStyleSelector::mapAnimationName):
            (WebCore::CSSStyleSelector::mapAnimationPlayState):
            (WebCore::CSSStyleSelector::mapNinePieceImage):
            (WebCore::CSSStyleSelector::createTransformOperations):
            * css/CSSValue.h:
            (WebCore::CSSValue::isBorderImageValue):
            (WebCore::CSSValue::isCursorImageValue):
            (WebCore::CSSValue::isFontFamilyValue):
            (WebCore::CSSValue::isReflectValue):
            (WebCore::CSSValue::isShadowValue):
            * css/FontFamilyValue.h:
            (WebCore::FontFamilyValue::isFontFamilyValue):
            * css/SVGCSSStyleSelector.cpp:
            (WebCore::CSSStyleSelector::applySVGProperty):
            * css/ShadowValue.h:
            (WebCore::ShadowValue::isShadowValue):
            * platform/graphics/transforms/TransformOperations.h:
            (WebCore::TransformOperations::clear):
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@71641 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/WebCore/ChangeLog b/WebCore/ChangeLog
index b85e84d..f7a4c75 100644
--- a/WebCore/ChangeLog
+++ b/WebCore/ChangeLog
@@ -1,3 +1,52 @@
+2010-11-09  Simon Fraser  <simon.fraser at apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=49204
+        <rdar://problem/8643412>
+        
+        Add checks to the CSSStyleSelector code to ensure that the
+        casts to the various CSSValue types are safe, and do more
+        rigorous checking of the lengths of CSSValueLists, and
+        non-null members of Pair in some cases.
+
+        * css/CSSBorderImageValue.h:
+        (WebCore::CSSBorderImageValue::isBorderImageValue):
+        * css/CSSCursorImageValue.h:
+        (WebCore::CSSCursorImageValue::isCursorImageValue):
+        * css/CSSImageValue.h:
+        (WebCore::CSSImageValue::isImageValue):
+        * css/CSSReflectValue.h:
+        (WebCore::CSSReflectValue::isReflectValue):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::resolveVariablesForDeclaration):
+        (WebCore::CSSRuleSet::addRulesFromSheet):
+        (WebCore::CSSRuleSet::addStyleRule):
+        (WebCore::applyCounterList):
+        (WebCore::CSSStyleSelector::applyProperty):
+        (WebCore::CSSStyleSelector::mapFillSize):
+        (WebCore::CSSStyleSelector::mapAnimationDelay):
+        (WebCore::CSSStyleSelector::mapAnimationDirection):
+        (WebCore::CSSStyleSelector::mapAnimationFillMode):
+        (WebCore::CSSStyleSelector::mapAnimationName):
+        (WebCore::CSSStyleSelector::mapAnimationPlayState):
+        (WebCore::CSSStyleSelector::mapNinePieceImage):
+        (WebCore::CSSStyleSelector::createTransformOperations):
+        * css/CSSValue.h:
+        (WebCore::CSSValue::isBorderImageValue):
+        (WebCore::CSSValue::isCursorImageValue):
+        (WebCore::CSSValue::isFontFamilyValue):
+        (WebCore::CSSValue::isReflectValue):
+        (WebCore::CSSValue::isShadowValue):
+        * css/FontFamilyValue.h:
+        (WebCore::FontFamilyValue::isFontFamilyValue):
+        * css/SVGCSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applySVGProperty):
+        * css/ShadowValue.h:
+        (WebCore::ShadowValue::isShadowValue):
+        * platform/graphics/transforms/TransformOperations.h:
+        (WebCore::TransformOperations::clear):
+
 2010-11-09  Ben Murdoch  <benm at google.com>
 
         Reviewed by Steve Block.
diff --git a/WebCore/css/CSSBorderImageValue.h b/WebCore/css/CSSBorderImageValue.h
index a17df7d..6e1b964 100644
--- a/WebCore/css/CSSBorderImageValue.h
+++ b/WebCore/css/CSSBorderImageValue.h
@@ -56,6 +56,7 @@ public:
 
 private:
     CSSBorderImageValue(PassRefPtr<CSSValue> image, PassRefPtr<Rect> sliceRect, int horizontalRule, int verticalRule);
+    virtual bool isBorderImageValue() const { return true; }
 };
 
 } // namespace WebCore
diff --git a/WebCore/css/CSSCursorImageValue.h b/WebCore/css/CSSCursorImageValue.h
index 2a95c3a..de03eb8 100644
--- a/WebCore/css/CSSCursorImageValue.h
+++ b/WebCore/css/CSSCursorImageValue.h
@@ -50,6 +50,7 @@ public:
 
 private:
     CSSCursorImageValue(const String& url, const IntPoint& hotSpot);
+    virtual bool isCursorImageValue() const { return true; }
 
     IntPoint m_hotSpot;
 
diff --git a/WebCore/css/CSSImageValue.h b/WebCore/css/CSSImageValue.h
index a9c8c9b..833d7fe 100644
--- a/WebCore/css/CSSImageValue.h
+++ b/WebCore/css/CSSImageValue.h
@@ -41,8 +41,6 @@ public:
     // Returns a StyleCachedImage if the image is cached already, otherwise a StylePendingImage.
     StyleImage* cachedOrPendingImage();
     
-    virtual bool isImageValue() const { return true; }
-
 protected:
     CSSImageValue(const String& url);
 
@@ -52,6 +50,7 @@ protected:
 
 private:
     CSSImageValue();
+    virtual bool isImageValue() const { return true; }
 
     RefPtr<StyleImage> m_image;
     bool m_accessedImage;
diff --git a/WebCore/css/CSSReflectValue.h b/WebCore/css/CSSReflectValue.h
index d61f8c4..1dcb1be 100644
--- a/WebCore/css/CSSReflectValue.h
+++ b/WebCore/css/CSSReflectValue.h
@@ -59,6 +59,8 @@ private:
         , m_mask(mask)
     {
     }
+
+    virtual bool isReflectValue() const { return true; }
     
     CSSReflectionDirection m_direction;
     RefPtr<CSSPrimitiveValue> m_offset;
diff --git a/WebCore/css/CSSStyleSelector.cpp b/WebCore/css/CSSStyleSelector.cpp
index fc8493e..8f408e5 100644
--- a/WebCore/css/CSSStyleSelector.cpp
+++ b/WebCore/css/CSSStyleSelector.cpp
@@ -361,7 +361,7 @@ public:
     
     void addRulesFromSheet(CSSStyleSheet*, const MediaQueryEvaluator&, CSSStyleSelector* = 0);
 
-    void addStyleRule(StyleBase* item);
+    void addStyleRule(CSSStyleRule* item);
     void addRule(CSSStyleRule* rule, CSSSelector* sel);
     void addPageRule(CSSStyleRule* rule, CSSSelector* sel);
     void addToRuleSet(AtomicStringImpl* key, AtomRuleMap& map,
@@ -613,8 +613,8 @@ void CSSStyleSelector::resolveVariablesForDeclaration(CSSMutableStyleDeclaration
         unsigned s = valueList->length();
         bool fullyResolved = true;
         for (unsigned i = 0; i < s; ++i) {
-            CSSValue* val = valueList->item(i);
-            CSSPrimitiveValue* primitiveValue = val->isPrimitiveValue() ? static_cast<CSSPrimitiveValue*>(val) : 0;
+            CSSValue* transformValue = valueList->item(i);
+            CSSPrimitiveValue* primitiveValue = transformValue->isPrimitiveValue() ? static_cast<CSSPrimitiveValue*>(transformValue) : 0;
             if (primitiveValue && primitiveValue->isVariable()) {
                 CSSVariablesRule* rule = m_variablesMap.get(primitiveValue->getStringValue());
                 if (!rule || !rule->variables()) {
@@ -642,7 +642,7 @@ void CSSStyleSelector::resolveVariablesForDeclaration(CSSMutableStyleDeclaration
                 for (unsigned j = 0; j < valueSize; ++j)
                     resolvedValueList.addValue(resolvedVariable->item(j)->parserValue());
             } else
-                resolvedValueList.addValue(val->parserValue());
+                resolvedValueList.addValue(transformValue->parserValue());
         }
         
         if (!fullyResolved)
@@ -2876,9 +2876,8 @@ void CSSRuleSet::addRulesFromSheet(CSSStyleSheet* sheet, const MediaQueryEvaluat
 
     for (int i = 0; i < len; i++) {
         StyleBase* item = sheet->item(i);
-        if (item->isStyleRule()) {
-            addStyleRule(item);
-        }
+        if (item->isStyleRule())
+            addStyleRule(static_cast<CSSStyleRule*>(item));
         else if (item->isImportRule()) {
             CSSImportRule* import = static_cast<CSSImportRule*>(item);
             if (!import->media() || medium.eval(import->media(), styleSelector))
@@ -2894,7 +2893,7 @@ void CSSRuleSet::addRulesFromSheet(CSSStyleSheet* sheet, const MediaQueryEvaluat
                     CSSRule *childItem = rules->item(j);
                     if (childItem->isStyleRule()) {
                         // It is a StyleRule, so append it to our list
-                        addStyleRule(childItem);
+                        addStyleRule(static_cast<CSSStyleRule*>(childItem));
                     } else if (childItem->isFontFaceRule() && styleSelector) {
                         // Add this font face to our set.
                         const CSSFontFaceRule* fontFaceRule = static_cast<CSSFontFaceRule*>(childItem);
@@ -2919,13 +2918,12 @@ void CSSRuleSet::addRulesFromSheet(CSSStyleSheet* sheet, const MediaQueryEvaluat
     }
 }
 
-void CSSRuleSet::addStyleRule(StyleBase* item)
+void CSSRuleSet::addStyleRule(CSSStyleRule* rule)
 {
-    if (item->isPageRule()) {
-        CSSPageRule* pageRule = static_cast<CSSPageRule*>(item);
+    if (rule->isPageRule()) {
+        CSSPageRule* pageRule = static_cast<CSSPageRule*>(rule);
         addPageRule(pageRule, pageRule->selectorList().first());
     } else {
-        CSSStyleRule* rule = static_cast<CSSStyleRule*>(item);
         for (CSSSelector* s = rule->selectorList().first(); s; s = CSSSelectorList::next(s))
             addRule(rule, s);
     }
@@ -3079,7 +3077,14 @@ static void applyCounterList(RenderStyle* style, CSSValueList* list, bool isRese
 
     int length = list ? list->length() : 0;
     for (int i = 0; i < length; ++i) {
-        Pair* pair = static_cast<CSSPrimitiveValue*>(list->itemWithoutBoundsCheck(i))->getPairValue();
+        CSSValue* currValue = list->itemWithoutBoundsCheck(i);
+        if (!currValue->isPrimitiveValue())
+            continue;
+
+        Pair* pair = static_cast<CSSPrimitiveValue*>(currValue)->getPairValue();
+        if (!pair || !pair->first() || !pair->second())
+            continue;
+
         AtomicString identifier = static_cast<CSSPrimitiveValue*>(pair->first())->getStringValue();
         // FIXME: What about overflow?
         int value = static_cast<CSSPrimitiveValue*>(pair->second())->getIntValue();
@@ -3566,10 +3571,12 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
                 primitiveValue = static_cast<CSSPrimitiveValue*>(item);
                 int type = primitiveValue->primitiveType();
                 if (type == CSSPrimitiveValue::CSS_URI) {
-                    CSSCursorImageValue* image = static_cast<CSSCursorImageValue*>(primitiveValue);
-                    if (image->updateIfSVGCursorIsUsed(m_element)) // Elements with SVG cursors are not allowed to share style.
-                        m_style->setUnique();
-                    m_style->addCursor(cachedOrPendingFromValue(CSSPropertyCursor, image), image->hotSpot());
+                    if (primitiveValue->isCursorImageValue()) {
+                        CSSCursorImageValue* image = static_cast<CSSCursorImageValue*>(primitiveValue);
+                        if (image->updateIfSVGCursorIsUsed(m_element)) // Elements with SVG cursors are not allowed to share style.
+                            m_style->setUnique();
+                        m_style->addCursor(cachedOrPendingFromValue(CSSPropertyCursor, image), image->hotSpot());
+                    }
                 } else if (type == CSSPrimitiveValue::CSS_IDENT)
                     m_style->setCursor(*primitiveValue);
             }
@@ -4306,10 +4313,10 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
             if (!item->isPrimitiveValue())
                 continue;
             
-            CSSPrimitiveValue* val = static_cast<CSSPrimitiveValue*>(item);
-            switch (val->primitiveType()) {
+            CSSPrimitiveValue* contentValue = static_cast<CSSPrimitiveValue*>(item);
+            switch (contentValue->primitiveType()) {
                 case CSSPrimitiveValue::CSS_STRING:
-                    m_style->setContent(val->getStringValue().impl(), didSet);
+                    m_style->setContent(contentValue->getStringValue().impl(), didSet);
                     didSet = true;
                     break;
                 case CSSPrimitiveValue::CSS_ATTR: {
@@ -4318,7 +4325,7 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
                         m_style->setUnique();
                     else
                         m_parentStyle->setUnique();
-                    QualifiedName attr(nullAtom, val->getStringValue().impl(), nullAtom);
+                    QualifiedName attr(nullAtom, contentValue->getStringValue().impl(), nullAtom);
                     m_style->setContent(m_element->getAttribute(attr).impl(), didSet);
                     didSet = true;
                     // register the fact that the attribute value affects the style
@@ -4326,12 +4333,14 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
                     break;
                 }
                 case CSSPrimitiveValue::CSS_URI: {
-                    m_style->setContent(cachedOrPendingFromValue(CSSPropertyContent, static_cast<CSSImageValue*>(val)), didSet);
+                    if (!contentValue->isImageValue())
+                        break;
+                    m_style->setContent(cachedOrPendingFromValue(CSSPropertyContent, static_cast<CSSImageValue*>(contentValue)), didSet);
                     didSet = true;
                     break;
                 }
                 case CSSPrimitiveValue::CSS_COUNTER: {
-                    Counter* counterValue = val->getCounterValue();
+                    Counter* counterValue = contentValue->getCounterValue();
                     OwnPtr<CounterContent> counter = adoptPtr(new CounterContent(counterValue->identifier(),
                         (EListStyleType)counterValue->listStyleNumber(), counterValue->separator()));
                     m_style->setContent(counter.release(), didSet);
@@ -4393,13 +4402,14 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
             CSSValue* item = list->itemWithoutBoundsCheck(i);
             if (!item->isPrimitiveValue())
                 continue;
-            CSSPrimitiveValue* val = static_cast<CSSPrimitiveValue*>(item);
+            CSSPrimitiveValue* contentValue = static_cast<CSSPrimitiveValue*>(item);
             AtomicString face;
             Settings* settings = m_checker.m_document->settings();
-            if (val->primitiveType() == CSSPrimitiveValue::CSS_STRING)
-                face = static_cast<FontFamilyValue*>(val)->familyName();
-            else if (val->primitiveType() == CSSPrimitiveValue::CSS_IDENT && settings) {
-                switch (val->getIdent()) {
+            if (contentValue->primitiveType() == CSSPrimitiveValue::CSS_STRING) {
+                if (contentValue->isFontFamilyValue())
+                    face = static_cast<FontFamilyValue*>(contentValue)->familyName();
+            } else if (contentValue->primitiveType() == CSSPrimitiveValue::CSS_IDENT && settings) {
+                switch (contentValue->getIdent()) {
                     case CSSValueWebkitBody:
                         face = settings->standardFontFamily();
                         break;
@@ -4460,13 +4470,15 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
         if (primitiveValue && primitiveValue->getIdent() == CSSValueNone) {
             // do nothing
         } else {
-            if (!value->isValueList()) return;
+            if (!value->isValueList())
+                return;
             CSSValueList *list = static_cast<CSSValueList*>(value);
             int len = list->length();
             for (int i = 0; i < len; i++)
             {
                 CSSValue *item = list->itemWithoutBoundsCheck(i);
-                if (!item->isPrimitiveValue()) continue;
+                if (!item->isPrimitiveValue())
+                    continue;
                 primitiveValue = static_cast<CSSPrimitiveValue*>(item);
                 switch (primitiveValue->getIdent()) {
                     case CSSValueNone:
@@ -4800,7 +4812,7 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
             return;
 
         Pair* pair = primitiveValue->getPairValue();
-        if (!pair)
+        if (!pair || !pair->first() || !pair->second())
             return;
 
         Length radiusWidth;
@@ -4878,6 +4890,9 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
         CSSValueList *list = static_cast<CSSValueList*>(value);
         int len = list->length();
         for (int i = 0; i < len; i++) {
+            CSSValue* currValue = list->itemWithoutBoundsCheck(i);
+            if (!currValue->isShadowValue())
+                continue;
             ShadowValue* item = static_cast<ShadowValue*>(list->itemWithoutBoundsCheck(i));
             int x = item->x->computeLengthInt(style(), m_rootElementStyle, zoomFactor);
             int y = item->y->computeLengthInt(style(), m_rootElementStyle, zoomFactor);
@@ -4901,6 +4916,10 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
             m_style->setBoxReflect(RenderStyle::initialBoxReflect());
             return;
         }
+        
+        if (!value->isReflectValue())
+            return;
+
         CSSReflectValue* reflectValue = static_cast<CSSReflectValue*>(value);
         RefPtr<StyleReflection> reflection = StyleReflection::create();
         reflection->setDirection(reflectValue->direction());
@@ -5348,7 +5367,8 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
         return;
     case CSSPropertyWebkitTransformOriginX: {
         HANDLE_INHERIT_AND_INITIAL(transformOriginX, TransformOriginX)
-        CSSPrimitiveValue* primitiveValue = static_cast<CSSPrimitiveValue*>(value);
+        if (!primitiveValue)
+            return;
         Length l;
         int type = primitiveValue->primitiveType();
         if (CSSPrimitiveValue::isUnitTypeLength(type))
@@ -5362,7 +5382,8 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
     }
     case CSSPropertyWebkitTransformOriginY: {
         HANDLE_INHERIT_AND_INITIAL(transformOriginY, TransformOriginY)
-        CSSPrimitiveValue* primitiveValue = static_cast<CSSPrimitiveValue*>(value);
+        if (!primitiveValue)
+            return;
         Length l;
         int type = primitiveValue->primitiveType();
         if (CSSPrimitiveValue::isUnitTypeLength(type))
@@ -5376,7 +5397,8 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
     }
     case CSSPropertyWebkitTransformOriginZ: {
         HANDLE_INHERIT_AND_INITIAL(transformOriginZ, TransformOriginZ)
-        CSSPrimitiveValue* primitiveValue = static_cast<CSSPrimitiveValue*>(value);
+        if (!primitiveValue)
+            return;
         float f;
         int type = primitiveValue->primitiveType();
         if (CSSPrimitiveValue::isUnitTypeLength(type))
@@ -5418,7 +5440,8 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
         return;
     case CSSPropertyWebkitPerspectiveOriginX: {
         HANDLE_INHERIT_AND_INITIAL(perspectiveOriginX, PerspectiveOriginX)
-        CSSPrimitiveValue* primitiveValue = static_cast<CSSPrimitiveValue*>(value);
+        if (!primitiveValue)
+            return;
         Length l;
         int type = primitiveValue->primitiveType();
         if (CSSPrimitiveValue::isUnitTypeLength(type))
@@ -5432,7 +5455,8 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
     }
     case CSSPropertyWebkitPerspectiveOriginY: {
         HANDLE_INHERIT_AND_INITIAL(perspectiveOriginY, PerspectiveOriginY)
-        CSSPrimitiveValue* primitiveValue = static_cast<CSSPrimitiveValue*>(value);
+        if (!primitiveValue)
+            return;
         Length l;
         int type = primitiveValue->primitiveType();
         if (CSSPrimitiveValue::isUnitTypeLength(type))
@@ -5524,6 +5548,8 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
     
     case CSSPropertySpeak:
         HANDLE_INHERIT_AND_INITIAL(speak, Speak);
+        if (!primitiveValue)
+            return;
         m_style->setSpeak(*primitiveValue);
         return;
             
@@ -5928,15 +5954,12 @@ void CSSStyleSelector::mapFillSize(CSSPropertyID, FillLayer* layer, CSSValue* va
     }
 
     Pair* pair = primitiveValue->getPairValue();
-    if (!pair)
+    if (!pair || !pair->first() || !pair->second())
         return;
     
     CSSPrimitiveValue* first = static_cast<CSSPrimitiveValue*>(pair->first());
     CSSPrimitiveValue* second = static_cast<CSSPrimitiveValue*>(pair->second());
     
-    if (!first || !second)
-        return;
-        
     Length firstLength, secondLength;
     int firstType = first->primitiveType();
     int secondType = second->primitiveType();
@@ -6021,6 +6044,9 @@ void CSSStyleSelector::mapAnimationDelay(Animation* animation, CSSValue* value)
         return;
     }
 
+    if (!value->isPrimitiveValue())
+        return;
+
     CSSPrimitiveValue* primitiveValue = static_cast<CSSPrimitiveValue*>(value);
     if (primitiveValue->primitiveType() == CSSPrimitiveValue::CSS_S)
         animation->setDelay(primitiveValue->getFloatValue());
@@ -6035,6 +6061,9 @@ void CSSStyleSelector::mapAnimationDirection(Animation* layer, CSSValue* value)
         return;
     }
 
+    if (!value->isPrimitiveValue())
+        return;
+
     CSSPrimitiveValue* primitiveValue = static_cast<CSSPrimitiveValue*>(value);
     layer->setDirection(primitiveValue->getIdent() == CSSValueAlternate ? Animation::AnimationDirectionAlternate : Animation::AnimationDirectionNormal);
 }
@@ -6063,6 +6092,9 @@ void CSSStyleSelector::mapAnimationFillMode(Animation* layer, CSSValue* value)
         return;
     }
 
+    if (!value->isPrimitiveValue())
+        return;
+
     CSSPrimitiveValue* primitiveValue = static_cast<CSSPrimitiveValue*>(value);
     switch (primitiveValue->getIdent()) {
     case CSSValueNone:
@@ -6104,8 +6136,10 @@ void CSSStyleSelector::mapAnimationName(Animation* layer, CSSValue* value)
         return;
     }
 
+    if (!value->isPrimitiveValue())
+        return;
+
     CSSPrimitiveValue* primitiveValue = static_cast<CSSPrimitiveValue*>(value);
-    
     if (primitiveValue->getIdent() == CSSValueNone)
         layer->setIsNoneAnimation(true);
     else
@@ -6119,6 +6153,9 @@ void CSSStyleSelector::mapAnimationPlayState(Animation* layer, CSSValue* value)
         return;
     }
 
+    if (!value->isPrimitiveValue())
+        return;
+
     CSSPrimitiveValue* primitiveValue = static_cast<CSSPrimitiveValue*>(value);
     EAnimPlayState playState = (primitiveValue->getIdent() == CSSValuePaused) ? AnimPlayStatePaused : AnimPlayStatePlaying;
     layer->setPlayState(playState);
@@ -6194,7 +6231,7 @@ void CSSStyleSelector::mapAnimationTimingFunction(Animation* animation, CSSValue
 void CSSStyleSelector::mapNinePieceImage(CSSPropertyID property, CSSValue* value, NinePieceImage& image)
 {
     // If we're a primitive value, then we are "none" and don't need to alter the empty image at all.
-    if (!value || value->isPrimitiveValue())
+    if (!value || value->isPrimitiveValue() || !value->isBorderImageValue())
         return;
 
     // Retrieve the border image value.
@@ -6598,241 +6635,266 @@ static TransformOperation::OperationType getTransformOperationType(WebKitCSSTran
 
 bool CSSStyleSelector::createTransformOperations(CSSValue* inValue, RenderStyle* style, RenderStyle* rootStyle, TransformOperations& outOperations)
 {
-    float zoomFactor = style ? style->effectiveZoom() : 1;
+    if (!inValue || !inValue->isValueList()) {
+        outOperations.clear();
+        return false;
+    }
 
+    float zoomFactor = style ? style->effectiveZoom() : 1;
     TransformOperations operations;
-    if (inValue && !inValue->isPrimitiveValue()) {
-        CSSValueList* list = static_cast<CSSValueList*>(inValue);
-        unsigned size = list->length();
-        for (unsigned i = 0; i < size; i++) {
-            WebKitCSSTransformValue* val = static_cast<WebKitCSSTransformValue*>(list->itemWithoutBoundsCheck(i));
-            
-            CSSPrimitiveValue* firstValue = static_cast<CSSPrimitiveValue*>(val->itemWithoutBoundsCheck(0));
-             
-            switch (val->operationType()) {
-                case WebKitCSSTransformValue::ScaleTransformOperation:
-                case WebKitCSSTransformValue::ScaleXTransformOperation:
-                case WebKitCSSTransformValue::ScaleYTransformOperation: {
-                    double sx = 1.0;
-                    double sy = 1.0;
-                    if (val->operationType() == WebKitCSSTransformValue::ScaleYTransformOperation)
-                        sy = firstValue->getDoubleValue();
-                    else { 
-                        sx = firstValue->getDoubleValue();
-                        if (val->operationType() != WebKitCSSTransformValue::ScaleXTransformOperation) {
-                            if (val->length() > 1) {
-                                CSSPrimitiveValue* secondValue = static_cast<CSSPrimitiveValue*>(val->itemWithoutBoundsCheck(1));
-                                sy = secondValue->getDoubleValue();
-                            } else 
-                                sy = sx;
-                        }
+    CSSValueList* list = static_cast<CSSValueList*>(inValue);
+    unsigned size = list->length();
+    for (unsigned i = 0; i < size; i++) {
+        CSSValue* currValue = list->itemWithoutBoundsCheck(i);
+        if (!currValue->isWebKitCSSTransformValue())
+            continue;
+
+        WebKitCSSTransformValue* transformValue = static_cast<WebKitCSSTransformValue*>(list->itemWithoutBoundsCheck(i));
+        if (!transformValue->length())
+            continue;
+
+        bool haveNonPrimitiveValue = false;
+        for (unsigned j = 0; j < transformValue->length(); ++j) {
+            if (!transformValue->itemWithoutBoundsCheck(j)->isPrimitiveValue()) {
+                haveNonPrimitiveValue = true;
+                break;
+            }
+        }
+        if (haveNonPrimitiveValue)
+            continue;
+        
+        CSSPrimitiveValue* firstValue = static_cast<CSSPrimitiveValue*>(transformValue->itemWithoutBoundsCheck(0));
+         
+        switch (transformValue->operationType()) {
+            case WebKitCSSTransformValue::ScaleTransformOperation:
+            case WebKitCSSTransformValue::ScaleXTransformOperation:
+            case WebKitCSSTransformValue::ScaleYTransformOperation: {
+                double sx = 1.0;
+                double sy = 1.0;
+                if (transformValue->operationType() == WebKitCSSTransformValue::ScaleYTransformOperation)
+                    sy = firstValue->getDoubleValue();
+                else { 
+                    sx = firstValue->getDoubleValue();
+                    if (transformValue->operationType() != WebKitCSSTransformValue::ScaleXTransformOperation) {
+                        if (transformValue->length() > 1) {
+                            CSSPrimitiveValue* secondValue = static_cast<CSSPrimitiveValue*>(transformValue->itemWithoutBoundsCheck(1));
+                            sy = secondValue->getDoubleValue();
+                        } else 
+                            sy = sx;
                     }
-                    operations.operations().append(ScaleTransformOperation::create(sx, sy, 1.0, getTransformOperationType(val->operationType())));
-                    break;
                 }
-                case WebKitCSSTransformValue::ScaleZTransformOperation:
-                case WebKitCSSTransformValue::Scale3DTransformOperation: {
-                    double sx = 1.0;
-                    double sy = 1.0;
-                    double sz = 1.0;
-                    if (val->operationType() == WebKitCSSTransformValue::ScaleZTransformOperation)
-                        sz = firstValue->getDoubleValue();
-                    else if (val->operationType() == WebKitCSSTransformValue::ScaleYTransformOperation)
-                        sy = firstValue->getDoubleValue();
-                    else { 
-                        sx = firstValue->getDoubleValue();
-                        if (val->operationType() != WebKitCSSTransformValue::ScaleXTransformOperation) {
-                            if (val->length() > 2) {
-                                CSSPrimitiveValue* thirdValue = static_cast<CSSPrimitiveValue*>(val->itemWithoutBoundsCheck(2));
-                                sz = thirdValue->getDoubleValue();
-                            }
-                            if (val->length() > 1) {
-                                CSSPrimitiveValue* secondValue = static_cast<CSSPrimitiveValue*>(val->itemWithoutBoundsCheck(1));
-                                sy = secondValue->getDoubleValue();
-                            } else 
-                                sy = sx;
+                operations.operations().append(ScaleTransformOperation::create(sx, sy, 1.0, getTransformOperationType(transformValue->operationType())));
+                break;
+            }
+            case WebKitCSSTransformValue::ScaleZTransformOperation:
+            case WebKitCSSTransformValue::Scale3DTransformOperation: {
+                double sx = 1.0;
+                double sy = 1.0;
+                double sz = 1.0;
+                if (transformValue->operationType() == WebKitCSSTransformValue::ScaleZTransformOperation)
+                    sz = firstValue->getDoubleValue();
+                else if (transformValue->operationType() == WebKitCSSTransformValue::ScaleYTransformOperation)
+                    sy = firstValue->getDoubleValue();
+                else { 
+                    sx = firstValue->getDoubleValue();
+                    if (transformValue->operationType() != WebKitCSSTransformValue::ScaleXTransformOperation) {
+                        if (transformValue->length() > 2) {
+                            CSSPrimitiveValue* thirdValue = static_cast<CSSPrimitiveValue*>(transformValue->itemWithoutBoundsCheck(2));
+                            sz = thirdValue->getDoubleValue();
                         }
+                        if (transformValue->length() > 1) {
+                            CSSPrimitiveValue* secondValue = static_cast<CSSPrimitiveValue*>(transformValue->itemWithoutBoundsCheck(1));
+                            sy = secondValue->getDoubleValue();
+                        } else 
+                            sy = sx;
                     }
-                    operations.operations().append(ScaleTransformOperation::create(sx, sy, sz, getTransformOperationType(val->operationType())));
-                    break;
                 }
-                case WebKitCSSTransformValue::TranslateTransformOperation:
-                case WebKitCSSTransformValue::TranslateXTransformOperation:
-                case WebKitCSSTransformValue::TranslateYTransformOperation: {
-                    bool ok = true;
-                    Length tx = Length(0, Fixed);
-                    Length ty = Length(0, Fixed);
-                    if (val->operationType() == WebKitCSSTransformValue::TranslateYTransformOperation)
-                        ty = convertToLength(firstValue, style, rootStyle, zoomFactor, &ok);
-                    else { 
-                        tx = convertToLength(firstValue, style, rootStyle, zoomFactor, &ok);
-                        if (val->operationType() != WebKitCSSTransformValue::TranslateXTransformOperation) {
-                            if (val->length() > 1) {
-                                CSSPrimitiveValue* secondValue = static_cast<CSSPrimitiveValue*>(val->itemWithoutBoundsCheck(1));
-                                ty = convertToLength(secondValue, style, rootStyle, zoomFactor, &ok);
-                            }
+                operations.operations().append(ScaleTransformOperation::create(sx, sy, sz, getTransformOperationType(transformValue->operationType())));
+                break;
+            }
+            case WebKitCSSTransformValue::TranslateTransformOperation:
+            case WebKitCSSTransformValue::TranslateXTransformOperation:
+            case WebKitCSSTransformValue::TranslateYTransformOperation: {
+                bool ok = true;
+                Length tx = Length(0, Fixed);
+                Length ty = Length(0, Fixed);
+                if (transformValue->operationType() == WebKitCSSTransformValue::TranslateYTransformOperation)
+                    ty = convertToLength(firstValue, style, rootStyle, zoomFactor, &ok);
+                else { 
+                    tx = convertToLength(firstValue, style, rootStyle, zoomFactor, &ok);
+                    if (transformValue->operationType() != WebKitCSSTransformValue::TranslateXTransformOperation) {
+                        if (transformValue->length() > 1) {
+                            CSSPrimitiveValue* secondValue = static_cast<CSSPrimitiveValue*>(transformValue->itemWithoutBoundsCheck(1));
+                            ty = convertToLength(secondValue, style, rootStyle, zoomFactor, &ok);
                         }
                     }
+                }
 
-                    if (!ok)
-                        return false;
+                if (!ok)
+                    return false;
 
-                    operations.operations().append(TranslateTransformOperation::create(tx, ty, Length(0, Fixed), getTransformOperationType(val->operationType())));
-                    break;
-                }
-                case WebKitCSSTransformValue::TranslateZTransformOperation:
-                case WebKitCSSTransformValue::Translate3DTransformOperation: {
-                    bool ok = true;
-                    Length tx = Length(0, Fixed);
-                    Length ty = Length(0, Fixed);
-                    Length tz = Length(0, Fixed);
-                    if (val->operationType() == WebKitCSSTransformValue::TranslateZTransformOperation)
-                        tz = convertToLength(firstValue, style, rootStyle, zoomFactor, &ok);
-                    else if (val->operationType() == WebKitCSSTransformValue::TranslateYTransformOperation)
-                        ty = convertToLength(firstValue, style, rootStyle, zoomFactor, &ok);
-                    else { 
-                        tx = convertToLength(firstValue, style, rootStyle, zoomFactor, &ok);
-                        if (val->operationType() != WebKitCSSTransformValue::TranslateXTransformOperation) {
-                            if (val->length() > 2) {
-                                CSSPrimitiveValue* thirdValue = static_cast<CSSPrimitiveValue*>(val->itemWithoutBoundsCheck(2));
-                                tz = convertToLength(thirdValue, style, rootStyle, zoomFactor, &ok);
-                            }
-                            if (val->length() > 1) {
-                                CSSPrimitiveValue* secondValue = static_cast<CSSPrimitiveValue*>(val->itemWithoutBoundsCheck(1));
-                                ty = convertToLength(secondValue, style, rootStyle, zoomFactor, &ok);
-                            }
+                operations.operations().append(TranslateTransformOperation::create(tx, ty, Length(0, Fixed), getTransformOperationType(transformValue->operationType())));
+                break;
+            }
+            case WebKitCSSTransformValue::TranslateZTransformOperation:
+            case WebKitCSSTransformValue::Translate3DTransformOperation: {
+                bool ok = true;
+                Length tx = Length(0, Fixed);
+                Length ty = Length(0, Fixed);
+                Length tz = Length(0, Fixed);
+                if (transformValue->operationType() == WebKitCSSTransformValue::TranslateZTransformOperation)
+                    tz = convertToLength(firstValue, style, rootStyle, zoomFactor, &ok);
+                else if (transformValue->operationType() == WebKitCSSTransformValue::TranslateYTransformOperation)
+                    ty = convertToLength(firstValue, style, rootStyle, zoomFactor, &ok);
+                else { 
+                    tx = convertToLength(firstValue, style, rootStyle, zoomFactor, &ok);
+                    if (transformValue->operationType() != WebKitCSSTransformValue::TranslateXTransformOperation) {
+                        if (transformValue->length() > 2) {
+                            CSSPrimitiveValue* thirdValue = static_cast<CSSPrimitiveValue*>(transformValue->itemWithoutBoundsCheck(2));
+                            tz = convertToLength(thirdValue, style, rootStyle, zoomFactor, &ok);
+                        }
+                        if (transformValue->length() > 1) {
+                            CSSPrimitiveValue* secondValue = static_cast<CSSPrimitiveValue*>(transformValue->itemWithoutBoundsCheck(1));
+                            ty = convertToLength(secondValue, style, rootStyle, zoomFactor, &ok);
                         }
                     }
+                }
 
-                    if (!ok)
-                        return false;
+                if (!ok)
+                    return false;
 
-                    operations.operations().append(TranslateTransformOperation::create(tx, ty, tz, getTransformOperationType(val->operationType())));
-                    break;
-                }
-                case WebKitCSSTransformValue::RotateTransformOperation: {
-                    double angle = firstValue->getDoubleValue();
-                    if (firstValue->primitiveType() == CSSPrimitiveValue::CSS_RAD)
-                        angle = rad2deg(angle);
-                    else if (firstValue->primitiveType() == CSSPrimitiveValue::CSS_GRAD)
-                        angle = grad2deg(angle);
-                    else if (firstValue->primitiveType() == CSSPrimitiveValue::CSS_TURN)
-                        angle = turn2deg(angle);
-                    
-                    operations.operations().append(RotateTransformOperation::create(0, 0, 1, angle, getTransformOperationType(val->operationType())));
-                    break;
-                }
-                case WebKitCSSTransformValue::RotateXTransformOperation:
-                case WebKitCSSTransformValue::RotateYTransformOperation:
-                case WebKitCSSTransformValue::RotateZTransformOperation: {
-                    double x = 0;
-                    double y = 0;
-                    double z = 0;
-                    double angle = firstValue->getDoubleValue();
-                    if (firstValue->primitiveType() == CSSPrimitiveValue::CSS_RAD)
-                        angle = rad2deg(angle);
-                    else if (firstValue->primitiveType() == CSSPrimitiveValue::CSS_GRAD)
-                        angle = grad2deg(angle);
-                    
-                    if (val->operationType() == WebKitCSSTransformValue::RotateXTransformOperation)
-                        x = 1;
-                    else if (val->operationType() == WebKitCSSTransformValue::RotateYTransformOperation)
-                        y = 1;
-                    else
-                        z = 1;
-                    operations.operations().append(RotateTransformOperation::create(x, y, z, angle, getTransformOperationType(val->operationType())));
-                    break;
-                }
-                case WebKitCSSTransformValue::Rotate3DTransformOperation: {
-                    CSSPrimitiveValue* secondValue = static_cast<CSSPrimitiveValue*>(val->itemWithoutBoundsCheck(1));
-                    CSSPrimitiveValue* thirdValue = static_cast<CSSPrimitiveValue*>(val->itemWithoutBoundsCheck(2));
-                    CSSPrimitiveValue* fourthValue = static_cast<CSSPrimitiveValue*>(val->itemWithoutBoundsCheck(3));
-                    double x = firstValue->getDoubleValue();
-                    double y = secondValue->getDoubleValue();
-                    double z = thirdValue->getDoubleValue();
-                    double angle = fourthValue->getDoubleValue();
-                    if (fourthValue->primitiveType() == CSSPrimitiveValue::CSS_RAD)
-                        angle = rad2deg(angle);
-                    else if (fourthValue->primitiveType() == CSSPrimitiveValue::CSS_GRAD)
-                        angle = grad2deg(angle);
-                    operations.operations().append(RotateTransformOperation::create(x, y, z, angle, getTransformOperationType(val->operationType())));
+                operations.operations().append(TranslateTransformOperation::create(tx, ty, tz, getTransformOperationType(transformValue->operationType())));
+                break;
+            }
+            case WebKitCSSTransformValue::RotateTransformOperation: {
+                double angle = firstValue->getDoubleValue();
+                if (firstValue->primitiveType() == CSSPrimitiveValue::CSS_RAD)
+                    angle = rad2deg(angle);
+                else if (firstValue->primitiveType() == CSSPrimitiveValue::CSS_GRAD)
+                    angle = grad2deg(angle);
+                else if (firstValue->primitiveType() == CSSPrimitiveValue::CSS_TURN)
+                    angle = turn2deg(angle);
+                
+                operations.operations().append(RotateTransformOperation::create(0, 0, 1, angle, getTransformOperationType(transformValue->operationType())));
+                break;
+            }
+            case WebKitCSSTransformValue::RotateXTransformOperation:
+            case WebKitCSSTransformValue::RotateYTransformOperation:
+            case WebKitCSSTransformValue::RotateZTransformOperation: {
+                double x = 0;
+                double y = 0;
+                double z = 0;
+                double angle = firstValue->getDoubleValue();
+                if (firstValue->primitiveType() == CSSPrimitiveValue::CSS_RAD)
+                    angle = rad2deg(angle);
+                else if (firstValue->primitiveType() == CSSPrimitiveValue::CSS_GRAD)
+                    angle = grad2deg(angle);
+                
+                if (transformValue->operationType() == WebKitCSSTransformValue::RotateXTransformOperation)
+                    x = 1;
+                else if (transformValue->operationType() == WebKitCSSTransformValue::RotateYTransformOperation)
+                    y = 1;
+                else
+                    z = 1;
+                operations.operations().append(RotateTransformOperation::create(x, y, z, angle, getTransformOperationType(transformValue->operationType())));
+                break;
+            }
+            case WebKitCSSTransformValue::Rotate3DTransformOperation: {
+                if (transformValue->length() < 4)
                     break;
-                }
-                case WebKitCSSTransformValue::SkewTransformOperation:
-                case WebKitCSSTransformValue::SkewXTransformOperation:
-                case WebKitCSSTransformValue::SkewYTransformOperation: {
-                    double angleX = 0;
-                    double angleY = 0;
-                    double angle = firstValue->getDoubleValue();
-                    if (firstValue->primitiveType() == CSSPrimitiveValue::CSS_RAD)
-                        angle = rad2deg(angle);
-                    else if (firstValue->primitiveType() == CSSPrimitiveValue::CSS_GRAD)
-                        angle = grad2deg(angle);
-                    else if (firstValue->primitiveType() == CSSPrimitiveValue::CSS_TURN)
-                        angle = turn2deg(angle);
-                    if (val->operationType() == WebKitCSSTransformValue::SkewYTransformOperation)
-                        angleY = angle;
-                    else {
-                        angleX = angle;
-                        if (val->operationType() == WebKitCSSTransformValue::SkewTransformOperation) {
-                            if (val->length() > 1) {
-                                CSSPrimitiveValue* secondValue = static_cast<CSSPrimitiveValue*>(val->itemWithoutBoundsCheck(1));
-                                angleY = secondValue->getDoubleValue();
-                                if (secondValue->primitiveType() == CSSPrimitiveValue::CSS_RAD)
-                                    angleY = rad2deg(angleY);
-                                else if (secondValue->primitiveType() == CSSPrimitiveValue::CSS_GRAD)
-                                    angleY = grad2deg(angleY);
-                                else if (secondValue->primitiveType() == CSSPrimitiveValue::CSS_TURN)
-                                    angleY = turn2deg(angleY);
-                            }
+                CSSPrimitiveValue* secondValue = static_cast<CSSPrimitiveValue*>(transformValue->itemWithoutBoundsCheck(1));
+                CSSPrimitiveValue* thirdValue = static_cast<CSSPrimitiveValue*>(transformValue->itemWithoutBoundsCheck(2));
+                CSSPrimitiveValue* fourthValue = static_cast<CSSPrimitiveValue*>(transformValue->itemWithoutBoundsCheck(3));
+                double x = firstValue->getDoubleValue();
+                double y = secondValue->getDoubleValue();
+                double z = thirdValue->getDoubleValue();
+                double angle = fourthValue->getDoubleValue();
+                if (fourthValue->primitiveType() == CSSPrimitiveValue::CSS_RAD)
+                    angle = rad2deg(angle);
+                else if (fourthValue->primitiveType() == CSSPrimitiveValue::CSS_GRAD)
+                    angle = grad2deg(angle);
+                operations.operations().append(RotateTransformOperation::create(x, y, z, angle, getTransformOperationType(transformValue->operationType())));
+                break;
+            }
+            case WebKitCSSTransformValue::SkewTransformOperation:
+            case WebKitCSSTransformValue::SkewXTransformOperation:
+            case WebKitCSSTransformValue::SkewYTransformOperation: {
+                double angleX = 0;
+                double angleY = 0;
+                double angle = firstValue->getDoubleValue();
+                if (firstValue->primitiveType() == CSSPrimitiveValue::CSS_RAD)
+                    angle = rad2deg(angle);
+                else if (firstValue->primitiveType() == CSSPrimitiveValue::CSS_GRAD)
+                    angle = grad2deg(angle);
+                else if (firstValue->primitiveType() == CSSPrimitiveValue::CSS_TURN)
+                    angle = turn2deg(angle);
+                if (transformValue->operationType() == WebKitCSSTransformValue::SkewYTransformOperation)
+                    angleY = angle;
+                else {
+                    angleX = angle;
+                    if (transformValue->operationType() == WebKitCSSTransformValue::SkewTransformOperation) {
+                        if (transformValue->length() > 1) {
+                            CSSPrimitiveValue* secondValue = static_cast<CSSPrimitiveValue*>(transformValue->itemWithoutBoundsCheck(1));
+                            angleY = secondValue->getDoubleValue();
+                            if (secondValue->primitiveType() == CSSPrimitiveValue::CSS_RAD)
+                                angleY = rad2deg(angleY);
+                            else if (secondValue->primitiveType() == CSSPrimitiveValue::CSS_GRAD)
+                                angleY = grad2deg(angleY);
+                            else if (secondValue->primitiveType() == CSSPrimitiveValue::CSS_TURN)
+                                angleY = turn2deg(angleY);
                         }
                     }
-                    operations.operations().append(SkewTransformOperation::create(angleX, angleY, getTransformOperationType(val->operationType())));
-                    break;
                 }
-                case WebKitCSSTransformValue::MatrixTransformOperation: {
-                    double a = firstValue->getDoubleValue();
-                    double b = static_cast<CSSPrimitiveValue*>(val->itemWithoutBoundsCheck(1))->getDoubleValue();
-                    double c = static_cast<CSSPrimitiveValue*>(val->itemWithoutBoundsCheck(2))->getDoubleValue();
-                    double d = static_cast<CSSPrimitiveValue*>(val->itemWithoutBoundsCheck(3))->getDoubleValue();
-                    double e = static_cast<CSSPrimitiveValue*>(val->itemWithoutBoundsCheck(4))->getDoubleValue();
-                    double f = static_cast<CSSPrimitiveValue*>(val->itemWithoutBoundsCheck(5))->getDoubleValue();
-                    operations.operations().append(MatrixTransformOperation::create(a, b, c, d, e, f));
-                    break;
-                }
-                case WebKitCSSTransformValue::Matrix3DTransformOperation: {
-                    TransformationMatrix matrix(static_cast<CSSPrimitiveValue*>(val->itemWithoutBoundsCheck(0))->getDoubleValue(),
-                                       static_cast<CSSPrimitiveValue*>(val->itemWithoutBoundsCheck(1))->getDoubleValue(),
-                                       static_cast<CSSPrimitiveValue*>(val->itemWithoutBoundsCheck(2))->getDoubleValue(),
-                                       static_cast<CSSPrimitiveValue*>(val->itemWithoutBoundsCheck(3))->getDoubleValue(),
-                                       static_cast<CSSPrimitiveValue*>(val->itemWithoutBoundsCheck(4))->getDoubleValue(),
-                                       static_cast<CSSPrimitiveValue*>(val->itemWithoutBoundsCheck(5))->getDoubleValue(),
-                                       static_cast<CSSPrimitiveValue*>(val->itemWithoutBoundsCheck(6))->getDoubleValue(),
-                                       static_cast<CSSPrimitiveValue*>(val->itemWithoutBoundsCheck(7))->getDoubleValue(),
-                                       static_cast<CSSPrimitiveValue*>(val->itemWithoutBoundsCheck(8))->getDoubleValue(),
-                                       static_cast<CSSPrimitiveValue*>(val->itemWithoutBoundsCheck(9))->getDoubleValue(),
-                                       static_cast<CSSPrimitiveValue*>(val->itemWithoutBoundsCheck(10))->getDoubleValue(),
-                                       static_cast<CSSPrimitiveValue*>(val->itemWithoutBoundsCheck(11))->getDoubleValue(),
-                                       static_cast<CSSPrimitiveValue*>(val->itemWithoutBoundsCheck(12))->getDoubleValue(),
-                                       static_cast<CSSPrimitiveValue*>(val->itemWithoutBoundsCheck(13))->getDoubleValue(),
-                                       static_cast<CSSPrimitiveValue*>(val->itemWithoutBoundsCheck(14))->getDoubleValue(),
-                                       static_cast<CSSPrimitiveValue*>(val->itemWithoutBoundsCheck(15))->getDoubleValue());
-                    operations.operations().append(Matrix3DTransformOperation::create(matrix));
-                    break;
-                }   
-                case WebKitCSSTransformValue::PerspectiveTransformOperation: {
-                    double p = firstValue->getDoubleValue();
-                    if (p < 0.0)
-                        return false;
-                    operations.operations().append(PerspectiveTransformOperation::create(p));
+                operations.operations().append(SkewTransformOperation::create(angleX, angleY, getTransformOperationType(transformValue->operationType())));
+                break;
+            }
+            case WebKitCSSTransformValue::MatrixTransformOperation: {
+                if (transformValue->length() < 6)
                     break;
-                }
-                case WebKitCSSTransformValue::UnknownTransformOperation:
-                    ASSERT_NOT_REACHED();
+                double a = firstValue->getDoubleValue();
+                double b = static_cast<CSSPrimitiveValue*>(transformValue->itemWithoutBoundsCheck(1))->getDoubleValue();
+                double c = static_cast<CSSPrimitiveValue*>(transformValue->itemWithoutBoundsCheck(2))->getDoubleValue();
+                double d = static_cast<CSSPrimitiveValue*>(transformValue->itemWithoutBoundsCheck(3))->getDoubleValue();
+                double e = static_cast<CSSPrimitiveValue*>(transformValue->itemWithoutBoundsCheck(4))->getDoubleValue();
+                double f = static_cast<CSSPrimitiveValue*>(transformValue->itemWithoutBoundsCheck(5))->getDoubleValue();
+                operations.operations().append(MatrixTransformOperation::create(a, b, c, d, e, f));
+                break;
+            }
+            case WebKitCSSTransformValue::Matrix3DTransformOperation: {
+                if (transformValue->length() < 16)
                     break;
+                TransformationMatrix matrix(static_cast<CSSPrimitiveValue*>(transformValue->itemWithoutBoundsCheck(0))->getDoubleValue(),
+                                   static_cast<CSSPrimitiveValue*>(transformValue->itemWithoutBoundsCheck(1))->getDoubleValue(),
+                                   static_cast<CSSPrimitiveValue*>(transformValue->itemWithoutBoundsCheck(2))->getDoubleValue(),
+                                   static_cast<CSSPrimitiveValue*>(transformValue->itemWithoutBoundsCheck(3))->getDoubleValue(),
+                                   static_cast<CSSPrimitiveValue*>(transformValue->itemWithoutBoundsCheck(4))->getDoubleValue(),
+                                   static_cast<CSSPrimitiveValue*>(transformValue->itemWithoutBoundsCheck(5))->getDoubleValue(),
+                                   static_cast<CSSPrimitiveValue*>(transformValue->itemWithoutBoundsCheck(6))->getDoubleValue(),
+                                   static_cast<CSSPrimitiveValue*>(transformValue->itemWithoutBoundsCheck(7))->getDoubleValue(),
+                                   static_cast<CSSPrimitiveValue*>(transformValue->itemWithoutBoundsCheck(8))->getDoubleValue(),
+                                   static_cast<CSSPrimitiveValue*>(transformValue->itemWithoutBoundsCheck(9))->getDoubleValue(),
+                                   static_cast<CSSPrimitiveValue*>(transformValue->itemWithoutBoundsCheck(10))->getDoubleValue(),
+                                   static_cast<CSSPrimitiveValue*>(transformValue->itemWithoutBoundsCheck(11))->getDoubleValue(),
+                                   static_cast<CSSPrimitiveValue*>(transformValue->itemWithoutBoundsCheck(12))->getDoubleValue(),
+                                   static_cast<CSSPrimitiveValue*>(transformValue->itemWithoutBoundsCheck(13))->getDoubleValue(),
+                                   static_cast<CSSPrimitiveValue*>(transformValue->itemWithoutBoundsCheck(14))->getDoubleValue(),
+                                   static_cast<CSSPrimitiveValue*>(transformValue->itemWithoutBoundsCheck(15))->getDoubleValue());
+                operations.operations().append(Matrix3DTransformOperation::create(matrix));
+                break;
+            }   
+            case WebKitCSSTransformValue::PerspectiveTransformOperation: {
+                double p = firstValue->getDoubleValue();
+                if (p < 0.0)
+                    return false;
+                operations.operations().append(PerspectiveTransformOperation::create(p));
+                break;
             }
+            case WebKitCSSTransformValue::UnknownTransformOperation:
+                ASSERT_NOT_REACHED();
+                break;
         }
     }
+
     outOperations = operations;
     return true;
 }
diff --git a/WebCore/css/CSSValue.h b/WebCore/css/CSSValue.h
index 0bd6496..3235cb0 100644
--- a/WebCore/css/CSSValue.h
+++ b/WebCore/css/CSSValue.h
@@ -53,11 +53,16 @@ public:
     virtual String cssText() const = 0;
     void setCssText(const String&, ExceptionCode&) { } // FIXME: Not implemented.
 
+    virtual bool isBorderImageValue() const { return false; }
+    virtual bool isCursorImageValue() const { return false; }
+    virtual bool isFontFamilyValue() const { return false; }
     virtual bool isFontValue() const { return false; }
     virtual bool isImageGeneratorValue() const { return false; }
     virtual bool isImageValue() const { return false; }
     virtual bool isImplicitInitialValue() const { return false; }
     virtual bool isPrimitiveValue() const { return false; }
+    virtual bool isReflectValue() const { return false; }
+    virtual bool isShadowValue() const { return false; }
     virtual bool isTimingFunctionValue() const { return false; }
     virtual bool isValueList() const { return false; }
     virtual bool isWebKitCSSTransformValue() const { return false; }
diff --git a/WebCore/css/FontFamilyValue.h b/WebCore/css/FontFamilyValue.h
index 087d22a..3f7d3a3 100644
--- a/WebCore/css/FontFamilyValue.h
+++ b/WebCore/css/FontFamilyValue.h
@@ -41,6 +41,7 @@ public:
 
 private:
     FontFamilyValue(const String& familyName);
+    virtual bool isFontFamilyValue() const { return true; }
 
     String m_familyName;
 };
diff --git a/WebCore/css/SVGCSSStyleSelector.cpp b/WebCore/css/SVGCSSStyleSelector.cpp
index 5ddaf99..5f3c46b 100644
--- a/WebCore/css/SVGCSSStyleSelector.cpp
+++ b/WebCore/css/SVGCSSStyleSelector.cpp
@@ -161,7 +161,8 @@ void CSSStyleSelector::applySVGProperty(int id, CSSValue* value)
         case CSSPropertyKerning:
         {
             HANDLE_INHERIT_AND_INITIAL(kerning, Kerning);
-            svgstyle->setKerning(SVGLength::fromCSSPrimitiveValue(primitiveValue));
+            if (primitiveValue)
+                svgstyle->setKerning(SVGLength::fromCSSPrimitiveValue(primitiveValue));
             break;
         }
         case CSSPropertyDominantBaseline:
@@ -261,10 +262,11 @@ void CSSStyleSelector::applySVGProperty(int id, CSSValue* value)
             Vector<SVGLength> array;
             size_t length = dashes->length();
             for (size_t i = 0; i < length; ++i) {
-                CSSPrimitiveValue* dash = static_cast<CSSPrimitiveValue*>(dashes->itemWithoutBoundsCheck(i));
-                if (!dash)
+                CSSValue* currValue = dashes->itemWithoutBoundsCheck(i);
+                if (!currValue->isPrimitiveValue())
                     continue;
 
+                CSSPrimitiveValue* dash = static_cast<CSSPrimitiveValue*>(dashes->itemWithoutBoundsCheck(i));
                 array.append(SVGLength::fromCSSPrimitiveValue(dash));
             }
 
@@ -549,8 +551,13 @@ void CSSStyleSelector::applySVGProperty(int id, CSSValue* value)
                 return;
 
             CSSValueList *list = static_cast<CSSValueList*>(value);
-            ASSERT(list->length() == 1);
-            ShadowValue* item = static_cast<ShadowValue*>(list->itemWithoutBoundsCheck(0));
+            if (!list->length())
+                return;
+
+            CSSValue* firstValue = list->itemWithoutBoundsCheck(0);
+            if (!firstValue->isShadowValue())
+                return;
+            ShadowValue* item = static_cast<ShadowValue*>(firstValue);
             int x = item->x->computeLengthInt(style(), m_rootElementStyle);
             int y = item->y->computeLengthInt(style(), m_rootElementStyle);
             int blur = item->blur ? item->blur->computeLengthInt(style(), m_rootElementStyle) : 0;
diff --git a/WebCore/css/ShadowValue.h b/WebCore/css/ShadowValue.h
index a88a0e7..fab1071 100644
--- a/WebCore/css/ShadowValue.h
+++ b/WebCore/css/ShadowValue.h
@@ -58,6 +58,8 @@ private:
         PassRefPtr<CSSPrimitiveValue> spread,
         PassRefPtr<CSSPrimitiveValue> style,
         PassRefPtr<CSSPrimitiveValue> color);
+
+    virtual bool isShadowValue() const { return true; }
 };
 
 } // namespace
diff --git a/WebCore/platform/graphics/transforms/TransformOperations.h b/WebCore/platform/graphics/transforms/TransformOperations.h
index 08efd23..c0da377 100644
--- a/WebCore/platform/graphics/transforms/TransformOperations.h
+++ b/WebCore/platform/graphics/transforms/TransformOperations.h
@@ -57,6 +57,11 @@ public:
         return false;
     }
     
+    void clear()
+    {
+        m_operations.clear();
+    }
+    
     Vector<RefPtr<TransformOperation> >& operations() { return m_operations; }
     const Vector<RefPtr<TransformOperation> >& operations() const { return m_operations; }
 

-- 
WebKit Debian packaging



More information about the Pkg-webkit-commits mailing list