tree 86f9f1810b311988c1302660fb684104232503dd
parent 75ae984f802a331eb69d491395fd7d74db79f3e2
author cdumez@apple.com <cdumez@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc> 1422487236 +0000
committer cdumez@apple.com <cdumez@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc> 1422487236 +0000

Regression(r177494): Bad cast to WebKitCSSResourceValue in StyleBuilderConverter::convertMaskImageOperations()
https://bugs.webkit.org/show_bug.cgi?id=140991
<rdar://problem/19625305>

Reviewed by Antti Koivisto.

Source/WebCore:

convertMaskImageOperations() was assuming that the CSSValueList's values
were always WebKitCSSResourceValue values. However, they can be
CSSInitialValues as well so we should check before casting.

Test: css3/masking/mask-image-initial-value-crash.html

* css/StyleBuilderConverter.h:
(WebCore::maskImageValueFromIterator):
(WebCore::StyleBuilderConverter::convertMaskImageOperations):

LayoutTests:

Add layout test to cover the case where a CSSValue is incorrectly casted to
a WebKitCSSResourceValue in StyleBuilderConverter::convertMaskImageOperations(),
thus hitting an assertion in downcast<>() on debug builds.

* css3/masking/mask-image-initial-value-crash-expected.txt: Added.
* css3/masking/mask-image-initial-value-crash.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@179308 268f45cc-cd09-0410-ab3c-d52691b4dbfc