Index: Source/WebCore/css/StyleResolver.cpp |
diff --git a/Source/WebCore/css/StyleResolver.cpp b/Source/WebCore/css/StyleResolver.cpp |
index 8e2d8c45d8b813c537c7973119034a3fb3b482aa..974a77ab8df1cca68b7ac523439a2aaa583f0af5 100644 |
--- a/Source/WebCore/css/StyleResolver.cpp |
+++ b/Source/WebCore/css/StyleResolver.cpp |
@@ -2121,16 +2121,30 @@ static bool createGridTrackList(CSSValue* value, Vector<GridTrackSize>& trackSiz |
static bool createGridPosition(CSSValue* value, GridPosition& position) |
{ |
- // For now, we only accept: <integer> | 'auto' |
- if (!value->isPrimitiveValue()) |
- return false; |
+ // For now, we only accept: 'auto' | <integer> | span && <integer>? |
+ if (value->isPrimitiveValue()) { |
+ CSSPrimitiveValue* primitiveValue = static_cast<CSSPrimitiveValue*>(value); |
+ if (primitiveValue->getIdent() == CSSValueAuto) |
+ return true; |
- CSSPrimitiveValue* primitiveValue = static_cast<CSSPrimitiveValue*>(value); |
- if (primitiveValue->getIdent() == CSSValueAuto) |
+ if (primitiveValue->getIdent() == CSSValueSpan) { |
+ // If the <integer> is omitted, it defaults to '1'. |
+ position.setSpanPosition(1); |
+ return true; |
+ } |
+ |
+ ASSERT(primitiveValue->isNumber()); |
+ position.setIntegerPosition(primitiveValue->getIntValue()); |
return true; |
+ } |
- ASSERT_WITH_SECURITY_IMPLICATION(primitiveValue->isNumber()); |
- position.setIntegerPosition(primitiveValue->getIntValue()); |
+ ASSERT_WITH_SECURITY_IMPLICATION(value->isValueList()); |
+ CSSValueList* values = static_cast<CSSValueList*>(value); |
+ ASSERT(values->length() == 2); |
+ ASSERT_WITH_SECURITY_IMPLICATION(values->itemWithoutBoundsCheck(1)->isPrimitiveValue()); |
+ CSSPrimitiveValue* numericValue = static_cast<CSSPrimitiveValue*>(values->itemWithoutBoundsCheck(1)); |
+ ASSERT(numericValue->isNumber()); |
+ position.setSpanPosition(numericValue->getIntValue()); |
return true; |
} |