Fixes a crash when copying elements with font-weight lighter or bolder

Source/core/editing/EditingStyle.cpp

Index: Source/core/editing/EditingStyle.cpp
diff --git a/Source/core/editing/EditingStyle.cpp b/Source/core/editing/EditingStyle.cpp
index 614038c2de9597891c66cd616b64410bf9c9d821..6e34dc978950576d277db9c8fc51457cfa61d900 100644
--- a/Source/core/editing/EditingStyle.cpp
+++ b/Source/core/editing/EditingStyle.cpp
@@ -1492,8 +1492,6 @@ static void diffTextDecorations(MutableStylePropertySet* style, CSSPropertyID pr
 
 static bool fontWeightIsBold(CSSValue* fontWeight)
 {
-    if (!fontWeight)
-        return false;
     if (!fontWeight->isPrimitiveValue())
         return false;
 
@@ -1521,18 +1519,13 @@ static bool fontWeightIsBold(CSSValue* fontWeight)
     return false;
 }
 
-static bool fontWeightIsBold(CSSStyleDeclaration* style)
+static bool fontWeightNeedsResolving(CSSValue* fontWeight)
 {
-    ASSERT(style);
-    RefPtr<CSSValue> fontWeight = style->getPropertyCSSValueInternal(CSSPropertyFontWeight);
-    return fontWeightIsBold(fontWeight.get());
-}
+    if (!fontWeight->isPrimitiveValue())
+        return true;
 
-static bool fontWeightIsBold(StylePropertySet* style)
-{
-    ASSERT(style);
-    RefPtr<CSSValue> fontWeight = style->getPropertyCSSValue(CSSPropertyFontWeight);
-    return fontWeightIsBold(fontWeight.get());
+    CSSValueID value = toCSSPrimitiveValue(fontWeight)->getValueID();
+    return value == CSSValueLighter || value == CSSValueBolder;
 }
 
 PassRefPtr<MutableStylePropertySet> getPropertiesNotIn(StylePropertySet* styleWithRedundantProperties, CSSStyleDeclaration* baseStyle)
@@ -1547,8 +1540,12 @@ PassRefPtr<MutableStylePropertySet> getPropertiesNotIn(StylePropertySet* styleWi
     diffTextDecorations(result.get(), CSSPropertyTextDecoration, baseTextDecorationsInEffect.get());
     diffTextDecorations(result.get(), CSSPropertyWebkitTextDecorationsInEffect, baseTextDecorationsInEffect.get());
 
-    if (baseStyle->getPropertyCSSValueInternal(CSSPropertyFontWeight) && fontWeightIsBold(result.get()) == fontWeightIsBold(baseStyle))
-        result->removeProperty(CSSPropertyFontWeight);
+    if (RefPtr<CSSValue> baseFontWeight = baseStyle->getPropertyCSSValueInternal(CSSPropertyFontWeight)) {
+        if (RefPtr<CSSValue> fontWeight = result->getPropertyCSSValue(CSSPropertyFontWeight)) {
+            if (!fontWeightNeedsResolving(fontWeight.get()) && (fontWeightIsBold(fontWeight.get()) == fontWeightIsBold(baseFontWeight.get())))

[rniwa-cr, 2013/08/16 05:56:53]

This is still incorrect. This function MUST remove the property if they're
equal. Not removing it results in incorrect behavior elsewhere.

+                result->removeProperty(CSSPropertyFontWeight);
+        }
+    }
 
     if (baseStyle->getPropertyCSSValueInternal(CSSPropertyColor) && getRGBAFontColor(result.get()) == getRGBAFontColor(baseStyle))
         result->removeProperty(CSSPropertyColor);