Michael Goddard <michael.goddard@trolltech.com>
authorhausmann@webkit.org <hausmann@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Thu, 24 Jan 2008 14:18:34 +0000 (14:18 +0000)
committerhausmann@webkit.org <hausmann@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Thu, 24 Jan 2008 14:18:34 +0000 (14:18 +0000)
commit6ab99440821fdf0660c15d0681d73cd0ae33bfc0
tree2d1374100a1fa87d3f0b4c7f1d15459290013b2c
parent021c00705e167823db2cd5cd46f6c43a9f7b0675
Michael Goddard  <michael.goddard@trolltech.com>

http://bugs.webkit.org/show_bug.cgi?id=16888

Fix for CSS crash in -webkit-border-image.
Reviewed by Darin.

While parsing -webkit-border-image, store
the border widths as naked pointers rather
than as OwnPtrs, since they point to the
middle of an array.

Test: fast/css/border-image-crash.html

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@29764 268f45cc-cd09-0410-ab3c-d52691b4dbfc
LayoutTests/ChangeLog
LayoutTests/fast/css/border-image-crash-expected.txt [new file with mode: 0644]
LayoutTests/fast/css/border-image-crash.html [new file with mode: 0644]
WebCore/ChangeLog
WebCore/css/CSSParser.cpp