commit 2fa5e2ca1cd510f943c77836e282645dd03a0a86
author simon.fraser@apple.com <simon.fraser@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc> Wed Aug 31 19:12:36 2011 +0000
committer simon.fraser@apple.com <simon.fraser@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc> Wed Aug 31 19:12:36 2011 +0000
tree 576bfd516b74e83994e52aab4dff0b96b9d5a170
parent e3e7b60dce83241fe9a9ee648c63a71e8a878c62

Crash with -webkit-radial-gradient(top) gradient
https://bugs.webkit.org/show_bug.cgi?id=66686

Source/WebCore:

Reviewed by Darin Adler.

Null-check the current value after calling parseFillPosition(),
since it may be null for gradients with degenerate arguments.

Test: fast/gradients/css3-radial-gradient-crash.html

* css/CSSParser.cpp:
(WebCore::CSSParser::parseRadialGradient):

LayoutTests:

Reviewed by Darin Adler.

Test case with degenerate arguments in a radial gradient.

* fast/gradients/css3-radial-gradient-crash-expected.txt: Added.
* fast/gradients/css3-radial-gradient-crash.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@94215 268f45cc-cd09-0410-ab3c-d52691b4dbfc