- Revision
- 95077
- Author
- [email protected]
- Date
- 2011-09-13 23:46:28 -0700 (Tue, 13 Sep 2011)
Log Message
Unreviewed, rolling out r95058.
http://trac.webkit.org/changeset/95058
https://bugs.webkit.org/show_bug.cgi?id=68058
It made css3/calc/regression-62276.html crash (Requested by
Ossy on #webkit).
Patch by Sheriff Bot <[email protected]> on 2011-09-13
Source/WebCore:
* css/CSSParser.cpp:
(WebCore::BorderImageParseContext::BorderImageParseContext):
(WebCore::BorderImageParseContext::allowBreak):
(WebCore::BorderImageParseContext::allowWidth):
(WebCore::BorderImageParseContext::allowOutset):
(WebCore::BorderImageParseContext::allowRepeat):
(WebCore::BorderImageParseContext::commitImage):
(WebCore::BorderImageParseContext::commitImageSlice):
(WebCore::BorderImageParseContext::commitSlash):
(WebCore::BorderImageParseContext::commitBorderWidth):
(WebCore::BorderImageParseContext::commitBorderOutset):
(WebCore::BorderImageParseContext::commitRepeat):
(WebCore::CSSParser::parseBorderImage):
(WebCore::CSSParser::parseBorderImageRepeat):
(WebCore::CSSParser::parseBorderImageSlice):
(WebCore::CSSParser::parseBorderImageQuad):
* css/CSSParserValues.h:
LayoutTests:
* fast/borders/border-image-scrambled.html: Removed.
* platform/mac/fast/borders/border-image-scrambled-expected.png: Removed.
* platform/mac/fast/borders/border-image-scrambled-expected.txt: Removed.
Modified Paths
Removed Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (95076 => 95077)
--- trunk/LayoutTests/ChangeLog 2011-09-14 06:32:53 UTC (rev 95076)
+++ trunk/LayoutTests/ChangeLog 2011-09-14 06:46:28 UTC (rev 95077)
@@ -1,3 +1,16 @@
+2011-09-13 Sheriff Bot <[email protected]>
+
+ Unreviewed, rolling out r95058.
+ http://trac.webkit.org/changeset/95058
+ https://bugs.webkit.org/show_bug.cgi?id=68058
+
+ It made css3/calc/regression-62276.html crash (Requested by
+ Ossy on #webkit).
+
+ * fast/borders/border-image-scrambled.html: Removed.
+ * platform/mac/fast/borders/border-image-scrambled-expected.png: Removed.
+ * platform/mac/fast/borders/border-image-scrambled-expected.txt: Removed.
+
2011-09-13 Abhishek Arya <[email protected]>
Crash in RenderScrollbarPart::imageChanged.
Deleted: trunk/LayoutTests/fast/borders/border-image-scrambled.html (95076 => 95077)
--- trunk/LayoutTests/fast/borders/border-image-scrambled.html 2011-09-14 06:32:53 UTC (rev 95076)
+++ trunk/LayoutTests/fast/borders/border-image-scrambled.html 2011-09-14 06:46:28 UTC (rev 95077)
@@ -1,36 +0,0 @@
-<html>
-<head>
- <style>
- div {
- border-width: 21px 30px 30px 21px;
- width: 75px;
- height: 75px;
- margin: 10px;
- display: inline-block;
- }
-
- div.rr {
- -webkit-border-image: url("resources/border-image.png") 21 30 30 21 repeat repeat;
- }
-
- div.rs {
- -webkit-border-image: 21 30 30 21 url("resources/border-image.png") repeat stretch;
- }
-
- div.sr {
- -webkit-border-image: stretch repeat 21 30 30 21 url("resources/border-image.png");
- }
-
- div.ss {
- -webkit-border-image: url("resources/border-image.png") stretch stretch 21 30 30 21;
- }
- </style>
-</head>
-<body>
- <div class="rr"></div>
- <div class="rs"></div>
- <br>
- <div class="sr"></div>
- <div class="ss"></div>
-</body>
-</html>
Deleted: trunk/LayoutTests/platform/mac/fast/borders/border-image-scrambled-expected.png
(Binary files differ)
Deleted: trunk/LayoutTests/platform/mac/fast/borders/border-image-scrambled-expected.txt (95076 => 95077)
--- trunk/LayoutTests/platform/mac/fast/borders/border-image-scrambled-expected.txt 2011-09-14 06:32:53 UTC (rev 95076)
+++ trunk/LayoutTests/platform/mac/fast/borders/border-image-scrambled-expected.txt 2011-09-14 06:46:28 UTC (rev 95077)
@@ -1,17 +0,0 @@
-layer at (0,0) size 800x600
- RenderView at (0,0) size 800x600
-layer at (0,0) size 800x600
- RenderBlock {HTML} at (0,0) size 800x600
- RenderBody {BODY} at (8,8) size 784x584
- RenderBlock {DIV} at (10,10) size 126x126 [border: (21px none #000000) (30px none #000000) (21px none #000000)]
- RenderText {#text} at (146,132) size 4x18
- text run at (146,132) width 4: " "
- RenderBlock {DIV} at (160,10) size 126x126 [border: (21px none #000000) (30px none #000000) (21px none #000000)]
- RenderText {#text} at (296,132) size 4x18
- text run at (296,132) width 4: " "
- RenderBR {BR} at (0,0) size 0x0
- RenderBlock {DIV} at (10,160) size 126x126 [border: (21px none #000000) (30px none #000000) (21px none #000000)]
- RenderText {#text} at (146,282) size 4x18
- text run at (146,282) width 4: " "
- RenderBlock {DIV} at (160,160) size 126x126 [border: (21px none #000000) (30px none #000000) (21px none #000000)]
- RenderText {#text} at (0,0) size 0x0
Modified: trunk/Source/WebCore/ChangeLog (95076 => 95077)
--- trunk/Source/WebCore/ChangeLog 2011-09-14 06:32:53 UTC (rev 95076)
+++ trunk/Source/WebCore/ChangeLog 2011-09-14 06:46:28 UTC (rev 95077)
@@ -1,3 +1,30 @@
+2011-09-13 Sheriff Bot <[email protected]>
+
+ Unreviewed, rolling out r95058.
+ http://trac.webkit.org/changeset/95058
+ https://bugs.webkit.org/show_bug.cgi?id=68058
+
+ It made css3/calc/regression-62276.html crash (Requested by
+ Ossy on #webkit).
+
+ * css/CSSParser.cpp:
+ (WebCore::BorderImageParseContext::BorderImageParseContext):
+ (WebCore::BorderImageParseContext::allowBreak):
+ (WebCore::BorderImageParseContext::allowWidth):
+ (WebCore::BorderImageParseContext::allowOutset):
+ (WebCore::BorderImageParseContext::allowRepeat):
+ (WebCore::BorderImageParseContext::commitImage):
+ (WebCore::BorderImageParseContext::commitImageSlice):
+ (WebCore::BorderImageParseContext::commitSlash):
+ (WebCore::BorderImageParseContext::commitBorderWidth):
+ (WebCore::BorderImageParseContext::commitBorderOutset):
+ (WebCore::BorderImageParseContext::commitRepeat):
+ (WebCore::CSSParser::parseBorderImage):
+ (WebCore::CSSParser::parseBorderImageRepeat):
+ (WebCore::CSSParser::parseBorderImageSlice):
+ (WebCore::CSSParser::parseBorderImageQuad):
+ * css/CSSParserValues.h:
+
2011-09-13 Abhishek Arya <[email protected]>
Crash in RenderScrollbarPart::imageChanged.
Modified: trunk/Source/WebCore/css/CSSParser.cpp (95076 => 95077)
--- trunk/Source/WebCore/css/CSSParser.cpp 2011-09-14 06:32:53 UTC (rev 95076)
+++ trunk/Source/WebCore/css/CSSParser.cpp 2011-09-14 06:46:28 UTC (rev 95077)
@@ -5158,103 +5158,51 @@
struct BorderImageParseContext {
BorderImageParseContext(CSSPrimitiveValueCache* primitiveValueCache)
: m_primitiveValueCache(primitiveValueCache)
- , m_canAdvance(false)
- , m_allowCommit(true)
- , m_allowImage(true)
- , m_allowImageSlice(true)
- , m_allowRepeat(true)
+ , m_allowBreak(false)
, m_allowSlash(false)
- , m_requireWidth(false)
- , m_requireOutset(false)
+ , m_allowWidth(false)
+ , m_allowOutset(false)
+ , m_allowRepeat(false)
{}
- bool canAdvance() const { return m_canAdvance; }
- void setCanAdvance(bool canAdvance) { m_canAdvance = canAdvance; }
-
- bool allowCommit() const { return m_allowCommit; }
- bool allowImage() const { return m_allowImage; }
- bool allowImageSlice() const { return m_allowImageSlice; }
- bool allowRepeat() const { return m_allowRepeat; }
+ bool allowBreak() const { return m_allowBreak; }
bool allowSlash() const { return m_allowSlash; }
+ bool allowWidth() const { return m_allowWidth; }
+ bool allowOutset() const { return m_allowOutset; }
+ bool allowRepeat() const { return m_allowRepeat; }
- bool requireWidth() const { return m_requireWidth; }
- bool requireOutset() const { return m_requireOutset; }
-
- void commitImage(PassRefPtr<CSSValue> image)
- {
- m_image = image;
- m_canAdvance = true;
- m_allowCommit = true;
- m_allowImage = false;
- m_allowSlash = false;
- m_requireWidth = false;
- m_requireOutset = false;
- m_allowImageSlice = !m_imageSlice;
- m_allowRepeat = !m_repeat;
- }
+ void commitImage(PassRefPtr<CSSValue> image) { m_image = image; }
void commitImageSlice(PassRefPtr<CSSBorderImageSliceValue> slice)
{
m_imageSlice = slice;
- m_canAdvance = true;
- m_allowCommit = true;
- m_allowSlash = true;
- m_allowImageSlice = false;
- m_requireWidth = false;
- m_requireOutset = false;
- m_allowImage = !m_image;
- m_allowRepeat = !m_repeat;
+ m_allowBreak = m_allowSlash = m_allowRepeat = true;
}
void commitSlash()
{
- m_canAdvance = true;
- m_allowCommit = false;
- m_allowImage = false;
- m_allowImageSlice = false;
- m_allowRepeat = false;
- m_allowSlash = false;
- if (!m_borderSlice) {
- m_requireWidth = true;
- m_requireOutset = false;
- } else {
- m_requireOutset = true;
- m_requireWidth = false;
- }
+ m_allowBreak = m_allowSlash = m_allowRepeat = false;
+ if (!m_borderSlice)
+ m_allowWidth = true;
+ else
+ m_allowOutset = true;
}
void commitBorderWidth(PassRefPtr<CSSPrimitiveValue> slice)
{
m_borderSlice = slice;
- m_canAdvance = true;
- m_allowCommit = true;
+ m_allowBreak = m_allowRepeat = true;
+ m_allowWidth = false;
m_allowSlash = true;
- m_allowImageSlice = false;
- m_requireWidth = false;
- m_requireOutset = false;
- m_allowImage = !m_image;
- m_allowRepeat = !m_repeat;
}
void commitBorderOutset(PassRefPtr<CSSPrimitiveValue> outset)
{
m_outset = outset;
- m_canAdvance = true;
- m_allowCommit = true;
- m_allowImageSlice = false;
- m_allowSlash = false;
- m_requireWidth = false;
- m_requireOutset = false;
- m_allowImage = !m_image;
- m_allowRepeat = !m_repeat;
+ m_allowBreak = m_allowRepeat = true;
+ m_allowWidth = m_allowOutset = m_allowSlash = false;
}
void commitRepeat(PassRefPtr<CSSValue> repeat)
{
m_repeat = repeat;
- m_canAdvance = true;
- m_allowCommit = true;
- m_allowRepeat = false;
- m_allowSlash = false;
- m_requireWidth = false;
- m_requireOutset = false;
- m_allowImageSlice = !m_imageSlice;
- m_allowImage = !m_image;
+ m_allowRepeat = m_allowSlash = m_allowWidth = m_allowOutset = false;
+ m_allowBreak = true;
}
PassRefPtr<CSSValue> commitBorderImage()
@@ -5265,16 +5213,11 @@
CSSPrimitiveValueCache* m_primitiveValueCache;
- bool m_canAdvance;
-
- bool m_allowCommit;
- bool m_allowImage;
- bool m_allowImageSlice;
- bool m_allowRepeat;
+ bool m_allowBreak;
bool m_allowSlash;
-
- bool m_requireWidth;
- bool m_requireOutset;
+ bool m_allowWidth;
+ bool m_allowOutset;
+ bool m_allowRepeat;
RefPtr<CSSValue> m_image;
RefPtr<CSSBorderImageSliceValue> m_imageSlice;
@@ -5286,58 +5229,59 @@
bool CSSParser::parseBorderImage(int propId, RefPtr<CSSValue>& result)
{
+ // Look for an image initially. If the first value is not a URI or the keyword "none", then we're done.
ShorthandScope scope(this, propId);
BorderImageParseContext context(primitiveValueCache());
- while (CSSParserValue* val = m_valueList->current()) {
- if (!context.canAdvance() && context.allowSlash() && val->unit == CSSParserValue::Operator && val->iValue == '/')
+ CSSParserValue* val = m_valueList->current();
+ if (val->unit == CSSPrimitiveValue::CSS_URI && m_styleSheet) {
+ // FIXME: The completeURL call should be done when using the CSSImageValue,
+ // not when creating it.
+ context.commitImage(CSSImageValue::create(m_styleSheet->completeURL(val->string)));
+ } else if (isGeneratedImageValue(val)) {
+ RefPtr<CSSValue> value;
+ if (parseGeneratedImage(value))
+ context.commitImage(value);
+ else
+ return false;
+ } else if (val->id == CSSValueNone)
+ context.commitImage(CSSImageValue::create());
+ else
+ return false;
+
+ // Parse the slice next.
+ m_valueList->next();
+ RefPtr<CSSBorderImageSliceValue> imageSlice;
+ if (!parseBorderImageSlice(propId, imageSlice))
+ return false;
+ context.commitImageSlice(imageSlice.release());
+
+ while ((val = m_valueList->current())) {
+ if (context.allowSlash() && val->unit == CSSParserValue::Operator && val->iValue == '/') {
context.commitSlash();
-
- if (!context.canAdvance() && context.allowImage()) {
- if (val->unit == CSSPrimitiveValue::CSS_URI && m_styleSheet) {
- // FIXME: The completeURL call should be done when using the CSSImageValue,
- // not when creating it.
- context.commitImage(CSSImageValue::create(m_styleSheet->completeURL(val->string)));
- } else if (isGeneratedImageValue(val)) {
- RefPtr<CSSValue> value;
- if (parseGeneratedImage(value))
- context.commitImage(value);
- else
- return false;
- } else if (val->id == CSSValueNone)
- context.commitImage(CSSImageValue::create());
- }
-
- if (!context.canAdvance() && context.allowImageSlice()) {
- RefPtr<CSSBorderImageSliceValue> imageSlice;
- if (parseBorderImageSlice(propId, imageSlice))
- context.commitImageSlice(imageSlice.release());
- }
-
- if (!context.canAdvance() && context.allowRepeat()) {
+ } else if (context.allowWidth()) {
+ RefPtr<CSSPrimitiveValue> borderSlice;
+ if (!parseBorderImageWidth(borderSlice))
+ return false;
+ context.commitBorderWidth(borderSlice.release());
+ continue;
+ } else if (context.allowOutset()) {
+ RefPtr<CSSPrimitiveValue> borderOutset;
+ if (!parseBorderImageOutset(borderOutset))
+ return false;
+ context.commitBorderOutset(borderOutset.release());
+ continue;
+ } else if (context.allowRepeat()) {
RefPtr<CSSValue> repeat;
if (parseBorderImageRepeat(repeat))
context.commitRepeat(repeat);
+ } else {
+ // Something invalid was encountered.
+ return false;
}
-
- if (!context.canAdvance() && context.requireWidth()) {
- RefPtr<CSSPrimitiveValue> borderSlice;
- if (parseBorderImageWidth(borderSlice))
- context.commitBorderWidth(borderSlice.release());
- }
-
- if (!context.canAdvance() && context.requireOutset()) {
- RefPtr<CSSPrimitiveValue> borderOutset;
- if (parseBorderImageOutset(borderOutset))
- context.commitBorderOutset(borderOutset.release());
- }
-
- if (context.canAdvance()) {
- m_valueList->next();
- context.setCanAdvance(false);
- }
+ m_valueList->next();
}
- if (context.allowCommit()) {
+ if (context.allowBreak()) {
// Need to fully commit as a single value.
result = context.commitBorderImage();
return true;
@@ -5365,14 +5309,8 @@
if (val) {
if (isBorderImageRepeatKeyword(val->id))
secondValue = primitiveValueCache()->createIdentifierValue(val->id);
- else if (!inShorthand()) {
- // If we're not parsing a shorthand then we are invalid.
+ else
return false;
- } else {
- // We need to rewind the value list, so that when its advanced we'll
- // end up back at this value.
- m_valueList->previous();
- }
} else
secondValue = firstValue;
@@ -5470,16 +5408,11 @@
context.commitNumber(val);
} else if (context.allowFill() && val->id == CSSValueFill)
context.commitFill();
- else if (!inShorthand()) {
+ else if (propId == CSSPropertyBorderImageSlice || propId == CSSPropertyWebkitMaskBoxImageSlice) {
// If we're not parsing a shorthand then we are invalid.
return false;
- } else {
- if (context.allowFinalCommit()) {
- // We're going to successfully parse, but we don't want to consume this token.
- m_valueList->previous();
- }
+ } else
break;
- }
m_valueList->next();
}
@@ -5590,11 +5523,8 @@
} else if (!inShorthand()) {
// If we're not parsing a shorthand then we are invalid.
return false;
- } else {
- if (context.allowFinalCommit())
- m_valueList->previous(); // The shorthand loop will advance back to this point.
+ } else
break;
- }
m_valueList->next();
}
Modified: trunk/Source/WebCore/css/CSSParserValues.h (95076 => 95077)
--- trunk/Source/WebCore/css/CSSParserValues.h 2011-09-14 06:32:53 UTC (rev 95076)
+++ trunk/Source/WebCore/css/CSSParserValues.h 2011-09-14 06:46:28 UTC (rev 95077)
@@ -78,13 +78,6 @@
unsigned size() const { return m_values.size(); }
CSSParserValue* current() { return m_current < m_values.size() ? &m_values[m_current] : 0; }
CSSParserValue* next() { ++m_current; return current(); }
- CSSParserValue* previous()
- {
- if (!m_current)
- return 0;
- --m_current;
- return current();
- }
CSSParserValue* valueAt(unsigned i) { return i < m_values.size() ? &m_values[i] : 0; }
