Fix inheritance of baseline-shift <length> values

Fix inheritance of baseline-shift <length> values

Needs custom_inherit because of the enum+length combination.

BUG=304006
Committed: https://src.chromium.org/viewvc/blink?view=rev&revision=176928

[pdr., 2014-06-24 19:56:33]

https://codereview.chromium.org/330913005/diff/1/Source/core/css/resolver/Sty...
File Source/core/css/resolver/StyleBuilderCustom.cpp (right):

https://codereview.chromium.org/330913005/diff/1/Source/core/css/resolver/Sty...
Source/core/css/resolver/StyleBuilderCustom.cpp:1371:
svgStyle->setBaselineShift(baselineShift);
Can this lead to either svgStyle or parentSvgStyle changing? If so, we could
have a use after free below.

[Timothy Loh, 2014-06-25 01:33:46]

lgtm

https://codereview.chromium.org/330913005/diff/1/Source/core/css/resolver/Sty...
File Source/core/css/resolver/StyleBuilderCustom.cpp (right):

https://codereview.chromium.org/330913005/diff/1/Source/core/css/resolver/Sty...
Source/core/css/resolver/StyleBuilderCustom.cpp:1371:
svgStyle->setBaselineShift(baselineShift);
On 2014/06/24 19:56:33, pdr wrote:
> Can this lead to either svgStyle or parentSvgStyle changing? If so, we could
> have a use after free below.

I'm pretty sure this is fine.

[pdr., 2014-06-25 01:39:42]

On 2014/06/25 01:33:46, Timothy Loh wrote:
> lgtm
> 
>
https://codereview.chromium.org/330913005/diff/1/Source/core/css/resolver/Sty...
> File Source/core/css/resolver/StyleBuilderCustom.cpp (right):
> 
>
https://codereview.chromium.org/330913005/diff/1/Source/core/css/resolver/Sty...
> Source/core/css/resolver/StyleBuilderCustom.cpp:1371:
> svgStyle->setBaselineShift(baselineShift);
> On 2014/06/24 19:56:33, pdr wrote:
> > Can this lead to either svgStyle or parentSvgStyle changing? If so, we could
> > have a use after free below.
> 
> I'm pretty sure this is fine.

+cc esprehn

[fs, 2014-06-25 08:02:26]

https://codereview.chromium.org/330913005/diff/1/Source/core/css/resolver/Sty...
File Source/core/css/resolver/StyleBuilderCustom.cpp (right):

https://codereview.chromium.org/330913005/diff/1/Source/core/css/resolver/Sty...
Source/core/css/resolver/StyleBuilderCustom.cpp:1371:
svgStyle->setBaselineShift(baselineShift);
On 2014/06/24 19:56:33, pdr wrote:
> Can this lead to either svgStyle or parentSvgStyle changing? If so, we could
> have a use after free below.

This is:

void setBaselineShift(EBaselineShift val) {
svg_noninherited_flags.f._baselineShift = val; }

so I don't think the object itself (or the parent) will have it's refcount
decremented.

[pdr., 2014-06-25 14:25:15]

On 2014/06/25 08:02:26, fs wrote:
>
https://codereview.chromium.org/330913005/diff/1/Source/core/css/resolver/Sty...
> File Source/core/css/resolver/StyleBuilderCustom.cpp (right):
> 
>
https://codereview.chromium.org/330913005/diff/1/Source/core/css/resolver/Sty...
> Source/core/css/resolver/StyleBuilderCustom.cpp:1371:
> svgStyle->setBaselineShift(baselineShift);
> On 2014/06/24 19:56:33, pdr wrote:
> > Can this lead to either svgStyle or parentSvgStyle changing? If so, we could
> > have a use after free below.
> 
> This is:
> 
> void setBaselineShift(EBaselineShift val) {
> svg_noninherited_flags.f._baselineShift = val; }
> 
> so I don't think the object itself (or the parent) will have it's refcount
> decremented.

Lgtm

[fs, 2014-06-25 14:42:13]

The CQ bit was checked by fs@opera.com

[commit-bot: I haz the power, 2014-06-25 14:42:57]

CQ is trying da patch. Follow status at
 https://chromium-status.appspot.com/cq/fs@opera.com/330913005/1

[commit-bot: I haz the power, 2014-06-25 15:26:29]

Change committed as 176928