- Revision
- 97502
- Author
- simon.fra...@apple.com
- Date
- 2011-10-14 13:57:53 -0700 (Fri, 14 Oct 2011)
Log Message
Web Inspector: WebProcess crashes hard when inspecting elements with border-images applied
https://bugs.webkit.org/show_bug.cgi?id=70105
Source/WebCore:
Reviewed by Dave Hyatt.
Fix three different crashes related to getting computed style for border-image.
In both valueForNinePieceImageSlice() and valueForNinePieceImageQuad(),
assign 'right' to 'left' because we've computed a value for 'right' already.
Otherwise this would leave 'right' as null, causing later crashes in cssText().
In mapNinePieceImage(), borderImage->imageValue() can be null for a border-image
shorthand that is missing the image value.
Test: fast/css/getComputedStyle/computed-style-border-image.html
* css/CSSComputedStyleDeclaration.cpp:
(WebCore::valueForNinePieceImageSlice):
(WebCore::valueForNinePieceImageQuad):
* css/CSSStyleSelector.cpp:
(WebCore::CSSStyleSelector::mapNinePieceImage):
LayoutTests:
Reviewed by Dave Hyatt.
Computed style test for border-image.
* fast/css/getComputedStyle/computed-style-border-image-expected.txt: Added.
* fast/css/getComputedStyle/computed-style-border-image.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (97501 => 97502)
--- trunk/LayoutTests/ChangeLog 2011-10-14 20:53:48 UTC (rev 97501)
+++ trunk/LayoutTests/ChangeLog 2011-10-14 20:57:53 UTC (rev 97502)
@@ -1,3 +1,15 @@
+2011-10-14 Simon Fraser <simon.fra...@apple.com>
+
+ Web Inspector: WebProcess crashes hard when inspecting elements with border-images applied
+ https://bugs.webkit.org/show_bug.cgi?id=70105
+
+ Reviewed by Dave Hyatt.
+
+ Computed style test for border-image.
+
+ * fast/css/getComputedStyle/computed-style-border-image-expected.txt: Added.
+ * fast/css/getComputedStyle/computed-style-border-image.html: Added.
+
2011-10-14 Brian Salomon <bsalo...@google.com>
[chromium skia] Add media/video-playing-and-pause.html to test expectations pending rebaseline
Added: trunk/LayoutTests/fast/css/getComputedStyle/computed-style-border-image-expected.txt (0 => 97502)
--- trunk/LayoutTests/fast/css/getComputedStyle/computed-style-border-image-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/css/getComputedStyle/computed-style-border-image-expected.txt 2011-10-14 20:57:53 UTC (rev 97502)
@@ -0,0 +1,26 @@
+Blocked access to external URL http://www.example.com/test.png
+Test computed style for the border-image property and sub-properties
+
+PASS computedBorderImageStyle('12 11 12 11', 'border-image-slice') is '12 11'
+PASS computedBorderImageStyle('url(test.png) 12 11 repeat stretch', 'border-image-slice') is '12 11'
+PASS computedBorderImageStyle('url(test.png) 1 2 3 4 repeat stretch', 'border-image-slice') is '1 2 3 4'
+PASS computedBorderImageStyle('url(test.png) 12 repeat stretch', 'border-image-slice') is '12'
+PASS computedBorderImageStyle('url(test.png) 10 10 5 5 repeat stretch', 'border-image-slice') is '10 10 5 5'
+PASS computedBorderImageStyle('url(test.png) 10 a b c repeat stretch', 'border-image-slice') is '100%'
+PASS computedBorderImageStyle('url(test.png) 10 20 fill', 'border-image-slice') is '10 20 fill'
+FAIL computedBorderImageStyle('url(http://www.example.com/test.png) 10 10 10 10 repeat stretch', 'border-image-source') should be url(http://www.example.com/test.png). Was none.
+PASS computedBorderImageStyle('url(test.png) 10', 'border-image-repeat') is 'stretch'
+PASS computedBorderImageStyle('url(test.png) 10 stretch', 'border-image-repeat') is 'stretch'
+PASS computedBorderImageStyle('url(test.png) 10 kittens', 'border-image-repeat') is 'stretch'
+PASS computedBorderImageStyle('url(test.png) 10 stretch stretch fill', 'border-image-repeat') is 'stretch'
+PASS computedBorderImageStyle('url(test.png) 10 repeat stretch', 'border-image-repeat') is 'repeat stretch'
+PASS computedBorderImageStyle('url(test.png) 10 round space', 'border-image-repeat') is 'round space'
+PASS computedBorderImageStyle('url(test.png) 10 / 13px 1.5em 1em 10px', 'border-image-width') is '13px 24px 16px 10px'
+PASS computedBorderImageStyle('url(test.png) 10 / 14px 10%', 'border-image-width') is '14px 10%'
+PASS computedBorderImageStyle('url(test.png) 10 / 13px / 11px', 'border-image-outset') is '11px'
+PASS computedBorderImageStyle('url(test.png) 10 / 13px / 11px', 'border-image-outset') is '11px'
+PASS computedBorderImageStyle('url(test.png) 10 / 13px / 11px repeat stretch', 'border-image-outset') is '11px'
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
Property changes on: trunk/LayoutTests/fast/css/getComputedStyle/computed-style-border-image-expected.txt
___________________________________________________________________
Added: svn:mime-type
Added: svn:keywords
Added: svn:eol-style
Added: trunk/LayoutTests/fast/css/getComputedStyle/computed-style-border-image.html (0 => 97502)
--- trunk/LayoutTests/fast/css/getComputedStyle/computed-style-border-image.html (rev 0)
+++ trunk/LayoutTests/fast/css/getComputedStyle/computed-style-border-image.html 2011-10-14 20:57:53 UTC (rev 97502)
@@ -0,0 +1,52 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="utf-8">
+<link rel="stylesheet" href=""
+<script src=""
+</head>
+<body>
+<p>Test computed style for the border-image property and sub-properties</p>
+<div id="console"></div>
+<script>
+
+var testDiv = document.createElement('div');
+testDiv.style.borderWidth = '10px';
+document.body.appendChild(testDiv);
+
+function computedBorderImageStyle(borderImageStyle, property) {
+ testDiv.style.borderImage = 'none';
+ testDiv.style.borderImage = borderImageStyle;
+ return window.getComputedStyle(testDiv).getPropertyValue(property);
+}
+
+shouldBe("computedBorderImageStyle('12 11 12 11', 'border-image-slice')", "'12 11'");
+shouldBe("computedBorderImageStyle('url(test.png) 12 11 repeat stretch', 'border-image-slice')", "'12 11'");
+shouldBe("computedBorderImageStyle('url(test.png) 1 2 3 4 repeat stretch', 'border-image-slice')", "'1 2 3 4'");
+shouldBe("computedBorderImageStyle('url(test.png) 12 repeat stretch', 'border-image-slice')", "'12'");
+shouldBe("computedBorderImageStyle('url(test.png) 10 10 5 5 repeat stretch', 'border-image-slice')", "'10 10 5 5'");
+shouldBe("computedBorderImageStyle('url(test.png) 10 a b c repeat stretch', 'border-image-slice')", "'100%'");
+shouldBe("computedBorderImageStyle('url(test.png) 10 20 fill', 'border-image-slice')", "'10 20 fill'");
+
+shouldBe("computedBorderImageStyle('url(dummy://test.png) 10 10 10 10 repeat stretch', 'border-image-source')", "'url(dummy://test.png)'");
+
+shouldBe("computedBorderImageStyle('url(test.png) 10', 'border-image-repeat')", "'stretch'");
+shouldBe("computedBorderImageStyle('url(test.png) 10 stretch', 'border-image-repeat')", "'stretch'");
+shouldBe("computedBorderImageStyle('url(test.png) 10 kittens', 'border-image-repeat')", "'stretch'");
+shouldBe("computedBorderImageStyle('url(test.png) 10 stretch stretch fill', 'border-image-repeat')", "'stretch'");
+shouldBe("computedBorderImageStyle('url(test.png) 10 repeat stretch', 'border-image-repeat')", "'repeat stretch'");
+shouldBe("computedBorderImageStyle('url(test.png) 10 round space', 'border-image-repeat')", "'round space'");
+
+shouldBe("computedBorderImageStyle('url(test.png) 10 / 13px 1.5em 1em 10px', 'border-image-width')", "'13px 24px 16px 10px'");
+shouldBe("computedBorderImageStyle('url(test.png) 10 / 14px 10%', 'border-image-width')", "'14px 10%'");
+shouldBe("computedBorderImageStyle('url(test.png) 10 / 13px / 11px', 'border-image-outset')", "'11px'");
+shouldBe("computedBorderImageStyle('url(test.png) 10 / 13px / 11px', 'border-image-outset')", "'11px'");
+
+shouldBe("computedBorderImageStyle('url(test.png) 10 / 13px / 11px repeat stretch', 'border-image-outset')", "'11px'");
+
+var successfullyParsed = true;
+
+</script>
+<script src=""
+</body>
+</html>
Property changes on: trunk/LayoutTests/fast/css/getComputedStyle/computed-style-border-image.html
___________________________________________________________________
Added: svn:mime-type
Added: svn:keywords
Added: svn:eol-style
Modified: trunk/Source/WebCore/ChangeLog (97501 => 97502)
--- trunk/Source/WebCore/ChangeLog 2011-10-14 20:53:48 UTC (rev 97501)
+++ trunk/Source/WebCore/ChangeLog 2011-10-14 20:57:53 UTC (rev 97502)
@@ -1,3 +1,26 @@
+2011-10-14 Simon Fraser <simon.fra...@apple.com>
+
+ Web Inspector: WebProcess crashes hard when inspecting elements with border-images applied
+ https://bugs.webkit.org/show_bug.cgi?id=70105
+
+ Reviewed by Dave Hyatt.
+
+ Fix three different crashes related to getting computed style for border-image.
+ In both valueForNinePieceImageSlice() and valueForNinePieceImageQuad(),
+ assign 'right' to 'left' because we've computed a value for 'right' already.
+ Otherwise this would leave 'right' as null, causing later crashes in cssText().
+
+ In mapNinePieceImage(), borderImage->imageValue() can be null for a border-image
+ shorthand that is missing the image value.
+
+ Test: fast/css/getComputedStyle/computed-style-border-image.html
+
+ * css/CSSComputedStyleDeclaration.cpp:
+ (WebCore::valueForNinePieceImageSlice):
+ (WebCore::valueForNinePieceImageQuad):
+ * css/CSSStyleSelector.cpp:
+ (WebCore::CSSStyleSelector::mapNinePieceImage):
+
2011-10-14 Ryosuke Niwa <rn...@webkit.org>
Mac build fix after r97497.
Modified: trunk/Source/WebCore/css/CSSComputedStyleDeclaration.cpp (97501 => 97502)
--- trunk/Source/WebCore/css/CSSComputedStyleDeclaration.cpp 2011-10-14 20:53:48 UTC (rev 97501)
+++ trunk/Source/WebCore/css/CSSComputedStyleDeclaration.cpp 2011-10-14 20:57:53 UTC (rev 97502)
@@ -363,7 +363,7 @@
if (image.imageSlices().bottom() == image.imageSlices().top() && image.imageSlices().right() == image.imageSlices().left()) {
bottom = top;
- right = left;
+ left = right;
} else {
if (image.imageSlices().bottom().isPercent())
bottom = primitiveValueCache->createValue(image.imageSlices().bottom().value(), CSSPrimitiveValue::CSS_PERCENTAGE);
@@ -415,7 +415,7 @@
if (box.bottom() == box.top() && box.right() == box.left()) {
bottom = top;
- right = left;
+ left = right;
} else {
if (box.bottom().isRelative())
bottom = primitiveValueCache->createValue(box.bottom().value(), CSSPrimitiveValue::CSS_NUMBER);
Modified: trunk/Source/WebCore/css/CSSStyleSelector.cpp (97501 => 97502)
--- trunk/Source/WebCore/css/CSSStyleSelector.cpp 2011-10-14 20:53:48 UTC (rev 97501)
+++ trunk/Source/WebCore/css/CSSStyleSelector.cpp 2011-10-14 20:57:53 UTC (rev 97502)
@@ -4523,7 +4523,9 @@
imageProperty = CSSPropertyWebkitMaskBoxImageSource;
else
imageProperty = property;
- image.setImage(styleImage(imageProperty, borderImage->imageValue()));
+
+ if (CSSValue* imageValue = borderImage->imageValue())
+ image.setImage(styleImage(imageProperty, imageValue));
// Map in the image slices.
mapNinePieceImageSlice(borderImage->m_imageSlice.get(), image);
