Remove explicit bounds check from CSSValueList::item

Source/core/css/StylePropertySerializer.cpp

 /*
  * (C) 1999-2003 Lars Knoll (knoll@kde.org)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2012 Apple Inc. All rights reserved.
  * Copyright (C) 2011 Research In Motion Limited. All rights reserved.
  * Copyright (C) 2013 Intel Corporation. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
@@ skipping 484 matching lines @@
     // can safely be omitted.
     for (size_t i = 0; i < numLayers; i++) {
         StringBuilder layerResult;
         bool useRepeatXShorthand = false;
         bool useRepeatYShorthand = false;
         bool useSingleWordShorthand = false;
         bool foundPositionYCSSProperty = false;
         for (unsigned j = 0; j < size; j++) {
             RefPtrWillBeRawPtr<CSSValue> value = nullptr;
             if (values[j]) {
-                if (values[j]->isBaseValueList())
-                    value = toCSSValueList(values[j].get())->item(i);
-                else {
+                if (values[j]->isBaseValueList()) {
+                    CSSValueList* list = toCSSValueList(values[j].get());
+                    value = i < list->length() ? list->item(i) : nullptr;

[alancutter (OOO until 2018), 2014/06/26 00:36:35]

itemWithBoundsCheck()

+                } else {
                     value = values[j];
 
                     // Color only belongs in the last layer.
                     if (shorthand.properties()[j] == CSSPropertyBackgroundColor) {
                         if (i != numLayers - 1)
                             value = nullptr;
                     } else if (i) {
                         // Other singletons only belong in the first layer.
                         value = nullptr;
                     }
                 }
             }
 
             // We need to report background-repeat as it was written in the CSS. If the property is implicit,
             // then it was written with only one value. Here we figure out which value that was so we can
             // report back correctly.
             if ((shorthand.properties()[j] == CSSPropertyBackgroundRepeatX && m_propertySet.isPropertyImplicit(shorthand.properties()[j]))
                 || (shorthand.properties()[j] == CSSPropertyWebkitMaskRepeatX && m_propertySet.isPropertyImplicit(shorthand.properties()[j]))) {
 
                 // BUG 49055: make sure the value was not reset in the layer check just above.
                 if ((j < size - 1 && shorthand.properties()[j + 1] == CSSPropertyBackgroundRepeatY && value)
                     || (j < size - 1 && shorthand.properties()[j + 1] == CSSPropertyWebkitMaskRepeatY && value)) {
                     RefPtrWillBeRawPtr<CSSValue> yValue = nullptr;
                     RefPtrWillBeRawPtr<CSSValue> nextValue = values[j + 1];
                     if (nextValue->isValueList())
-                        yValue = toCSSValueList(nextValue.get())->itemWithoutBoundsCheck(i);
+                        yValue = toCSSValueList(nextValue.get())->item(i);
                     else
                         yValue = nextValue;
 
                     // background-repeat-x(y) or mask-repeat-x(y) may be like this : "initial, repeat". We can omit the implicit initial values
                     // before starting to compare their values.
                     if (value->isImplicitInitialValue() || yValue->isImplicitInitialValue())
                         continue;
 
                     // FIXME: At some point we need to fix this code to avoid returning an invalid shorthand,
                     // since some longhand combinations are not serializable into a single shorthand.
@@ skipping 319 matching lines @@
             isInitialValue = false;
         if (!value->isInheritedValue())
             isInheritedValue = false;
         if (isImportant != m_propertySet.propertyIsImportant(shorthand.properties()[i]))
             return false;
     }
     return isInitialValue || isInheritedValue;
 }
 
 }