Merge 95071 - Fix cssText property of counter-valued CSSPrimitiveValue and avoid uninitialized read

Source/WebCore/css/CSSPrimitiveValue.cpp

 /*
  * (C) 1999-2003 Lars Knoll (knoll@kde.org)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
  *
  * This library is distributed in the hope that it will be useful,
@@ skipping 754 matching lines @@
             result.uncheckedAppend(')');
 
             text = String::adopt(result);
             break;
         }
         case CSS_COUNTER_NAME:
             text = "counter(";
             text += m_value.string;
             text += ")";
             break;
-        case CSS_COUNTER:
-            text = "counter(";
-            text += String::number(m_value.num);
+        case CSS_COUNTER: {
+            String separator = m_value.counter->separator();
+            text = separator.isEmpty() ? "counter(" : "counters(";
+            text += m_value.counter->identifier();
+            if (!separator.isEmpty()) {
+                text += ", ";
+                text += quoteCSSStringIfNeeded(separator);
+            }
+            const char* listStyleName = getValueName(m_value.counter->listStyleNumber() + CSSValueDisc);
+            if (listStyleName) {
+                text += ", ";
+                text += listStyleName;
+            }
             text += ")";
-            // FIXME: Add list-style and separator
             break;
+        }
         case CSS_RECT: {
             DEFINE_STATIC_LOCAL(const String, rectParen, ("rect("));
 
             Rect* rectVal = getRectValue();
             Vector<UChar> result;
             result.reserveInitialCapacity(32);
             append(result, rectParen);
 
             append(result, rectVal->top()->cssText());
             result.append(' ');
@@ skipping 99 matching lines @@
     return text;
 }
 
 void CSSPrimitiveValue::addSubresourceStyleURLs(ListHashSet<KURL>& urls, const CSSStyleSheet* styleSheet)
 {
     if (m_type == CSS_URI)
         addSubresourceURL(urls, styleSheet->completeURL(m_value.string));
 }
 
 } // namespace WebCore