Fix inheritance of baseline-shift <length> values

Source/core/css/resolver/StyleBuilderCustom.cpp

 /*
  * Copyright (C) 2013 Google Inc. All rights reserved.
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 2004-2005 Allan Sandfeld Jensen (kde@carewolf.com)
  * Copyright (C) 2006, 2007 Nicholas Shanks (webkit@nickshanks.com)
  * Copyright (C) 2005, 2006, 2007, 2008, 2009, 2010, 2011, 2012, 2013 Apple Inc. All rights reserved.
  * Copyright (C) 2007 Alexey Proskuryakov <ap@webkit.org>
  * Copyright (C) 2007, 2008 Eric Seidel <eric@webkit.org>
  * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  * Copyright (c) 2011, Code Aurora Forum. All rights reserved.
@@ skipping 1345 matching lines @@
 {
     if (value->isPrimitiveValue() && toCSSPrimitiveValue(value)->getValueID() == CSSValueNormal) {
         state.fontBuilder().setFeatureSettingsNormal();
         return;
     }
 
     if (value->isValueList())
         state.fontBuilder().setFeatureSettingsValue(value);
 }
 
+void StyleBuilderFunctions::applyInheritCSSPropertyBaselineShift(StyleResolverState& state)
+{
+    const SVGRenderStyle* parentSvgStyle = state.parentStyle()->svgStyle();
+    EBaselineShift baselineShift = parentSvgStyle->baselineShift();
+    SVGRenderStyle* svgStyle = state.style()->accessSVGStyle();
+    svgStyle->setBaselineShift(baselineShift);

[pdr., 2014/06/24 19:56:33]

Can this lead to either svgStyle or parentSvgStyle changing? If so, we could
have a use after free below.

[Timothy Loh, 2014/06/25 01:33:46]

I'm pretty sure this is fine.

[fs, 2014/06/25 08:02:26]

This is:

void setBaselineShift(EBaselineShift val) {
svg_noninherited_flags.f._baselineShift = val; }

so I don't think the object itself (or the parent) will have it's refcount
decremented.

+    if (baselineShift == BS_LENGTH)
+        svgStyle->setBaselineShiftValue(parentSvgStyle->baselineShiftValue());
+}
 
 void StyleBuilderFunctions::applyValueCSSPropertyBaselineShift(StyleResolverState& state, CSSValue* value)
 {
     if (!value->isPrimitiveValue())
         return;
 
     SVGRenderStyle* svgStyle = state.style()->accessSVGStyle();
     CSSPrimitiveValue* primitiveValue = toCSSPrimitiveValue(value);
     if (primitiveValue->getValueID()) {
         switch (primitiveValue->getValueID()) {
         case CSSValueBaseline:
             svgStyle->setBaselineShift(BS_BASELINE);
             break;
         case CSSValueSub:
             svgStyle->setBaselineShift(BS_SUB);
             break;
         case CSSValueSuper:
             svgStyle->setBaselineShift(BS_SUPER);
             break;
         default:
             break;
         }
     } else {
         svgStyle->setBaselineShift(BS_LENGTH);
         svgStyle->setBaselineShiftValue(SVGLength::fromCSSPrimitiveValue(primitiveValue));
     }
 }
 
 } // namespace WebCore