Fix the check for divide-by-zero in background image tiling

third_party/WebKit/Source/core/paint/BackgroundImageGeometry.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/paint/BackgroundImageGeometry.h"
 
 #include "core/frame/FrameView.h"
 #include "core/layout/LayoutBox.h"
 #include "core/layout/LayoutBoxModelObject.h"
 #include "core/layout/LayoutView.h"
@@ skipping 283 matching lines @@
         setPhaseY(tileSize().height() ? LayoutUnit(tileSize().height() - fmodf((computedYPosition + top), tileSize().height()))
             : LayoutUnit());
         setSpaceSize(LayoutSize());
     }
 
     if (backgroundRepeatX == RepeatFill) {
         LayoutUnit xOffset = fillLayer.backgroundXOrigin() == RightEdge ? availableWidth - computedXPosition : computedXPosition;
         setPhaseX(tileSize().width() ? LayoutUnit(tileSize().width() - fmodf((xOffset + left), tileSize().width()))
             : LayoutUnit());
         setSpaceSize(LayoutSize());
-    } else if (backgroundRepeatX == SpaceFill && fillTileSize.width() > LayoutUnit()) {
+    } else if (backgroundRepeatX == SpaceFill && tileSize().width() > LayoutUnit()) {
         LayoutUnit space = getSpaceBetweenImageTiles(positioningAreaSize.width(), tileSize().width());
         LayoutUnit actualWidth = tileSize().width() + space;
 
         if (space >= LayoutUnit()) {
             computedXPosition = roundedMinimumValueForLength(Length(), availableWidth);
             setSpaceSize(LayoutSize(space.round(), LayoutUnit()));
             setPhaseX(actualWidth ? LayoutUnit(actualWidth - fmodf((computedXPosition + left), actualWidth)) : LayoutUnit());
         } else {
             backgroundRepeatX = NoRepeatFill;
         }
     }
     if (backgroundRepeatX == NoRepeatFill) {
         LayoutUnit xOffset = fillLayer.backgroundXOrigin() == RightEdge ? availableWidth - computedXPosition : computedXPosition;
         setNoRepeatX(left + xOffset);
         setSpaceSize(LayoutSize(LayoutUnit(), spaceSize().height()));
     }
 
     if (backgroundRepeatY == RepeatFill) {
         LayoutUnit yOffset = fillLayer.backgroundYOrigin() == BottomEdge ? availableHeight - computedYPosition : computedYPosition;
         setPhaseY(tileSize().height() ? LayoutUnit(tileSize().height() - fmodf((yOffset + top), tileSize().height()))
             : LayoutUnit());
         setSpaceSize(LayoutSize(spaceSize().width(), LayoutUnit()));
-    } else if (backgroundRepeatY == SpaceFill && fillTileSize.height() > LayoutUnit()) {
+    } else if (backgroundRepeatY == SpaceFill && tileSize().height() > LayoutUnit()) {
         LayoutUnit space = getSpaceBetweenImageTiles(positioningAreaSize.height(), tileSize().height());
         LayoutUnit actualHeight = tileSize().height() + space;
 
         if (space >= LayoutUnit()) {
             computedYPosition = roundedMinimumValueForLength(Length(), availableHeight);
             setSpaceSize(LayoutSize(spaceSize().width(), space.round()));
             setPhaseY(actualHeight ? LayoutUnit(actualHeight - fmodf((computedYPosition + top), actualHeight)) : LayoutUnit());
         } else {
             backgroundRepeatY = NoRepeatFill;
         }
@@ skipping 10 matching lines @@
     // Clip the final output rect to the paint rect
     m_destRect.intersect(paintRect);
 
     // Snap as-yet unsnapped values.
     setPhase(LayoutPoint(roundedIntPoint(m_phase)));
     setDestRect(LayoutRect(pixelSnappedIntRect(m_destRect)));
 
 }
 
 } // namespace blink