Fix inheritance of baseline-shift <length> values

Source/core/css/resolver/StyleBuilderCustom.cpp

Index: Source/core/css/resolver/StyleBuilderCustom.cpp
diff --git a/Source/core/css/resolver/StyleBuilderCustom.cpp b/Source/core/css/resolver/StyleBuilderCustom.cpp
index c9e9af60fb0ef27727a9db1c944eb2c7f89edc94..ccd7365f089e27626b2e109ffd8c65614121b792 100644
--- a/Source/core/css/resolver/StyleBuilderCustom.cpp
+++ b/Source/core/css/resolver/StyleBuilderCustom.cpp
@@ -1363,6 +1363,15 @@ void StyleBuilderFunctions::applyValueCSSPropertyWebkitFontFeatureSettings(Style
         state.fontBuilder().setFeatureSettingsValue(value);
 }
 
+void StyleBuilderFunctions::applyInheritCSSPropertyBaselineShift(StyleResolverState& state)
+{
+    const SVGRenderStyle* parentSvgStyle = state.parentStyle()->svgStyle();
+    EBaselineShift baselineShift = parentSvgStyle->baselineShift();
+    SVGRenderStyle* svgStyle = state.style()->accessSVGStyle();
+    svgStyle->setBaselineShift(baselineShift);

[pdr., 2014/06/24 19:56:33]

Can this lead to either svgStyle or parentSvgStyle changing? If so, we could
have a use after free below.

[Timothy Loh, 2014/06/25 01:33:46]

I'm pretty sure this is fine.

[fs, 2014/06/25 08:02:26]

This is:

void setBaselineShift(EBaselineShift val) {
svg_noninherited_flags.f._baselineShift = val; }

so I don't think the object itself (or the parent) will have it's refcount
decremented.

+    if (baselineShift == BS_LENGTH)
+        svgStyle->setBaselineShiftValue(parentSvgStyle->baselineShiftValue());
+}
 
 void StyleBuilderFunctions::applyValueCSSPropertyBaselineShift(StyleResolverState& state, CSSValue* value)
 {