Remove explicit bounds check from CSSValueList::item

Source/core/css/StylePropertySerializer.cpp

Index: Source/core/css/StylePropertySerializer.cpp
diff --git a/Source/core/css/StylePropertySerializer.cpp b/Source/core/css/StylePropertySerializer.cpp
index 4d00705a09c899759868fc66c70fbde7136ad7f1..33e5106e1792a8d5f9ba430885b259cd4afa206a 100644
--- a/Source/core/css/StylePropertySerializer.cpp
+++ b/Source/core/css/StylePropertySerializer.cpp
@@ -502,9 +502,10 @@ String StylePropertySerializer::getLayeredShorthandValue(const StylePropertyShor
         for (unsigned j = 0; j < size; j++) {
             RefPtrWillBeRawPtr<CSSValue> value = nullptr;
             if (values[j]) {
-                if (values[j]->isBaseValueList())
-                    value = toCSSValueList(values[j].get())->item(i);
-                else {
+                if (values[j]->isBaseValueList()) {
+                    CSSValueList* list = toCSSValueList(values[j].get());
+                    value = i < list->length() ? list->item(i) : nullptr;

[alancutter (OOO until 2018), 2014/06/26 00:36:35]

itemWithBoundsCheck()

+                } else {
                     value = values[j];
 
                     // Color only belongs in the last layer.
@@ -530,7 +531,7 @@ String StylePropertySerializer::getLayeredShorthandValue(const StylePropertyShor
                     RefPtrWillBeRawPtr<CSSValue> yValue = nullptr;
                     RefPtrWillBeRawPtr<CSSValue> nextValue = values[j + 1];
                     if (nextValue->isValueList())
-                        yValue = toCSSValueList(nextValue.get())->itemWithoutBoundsCheck(i);
+                        yValue = toCSSValueList(nextValue.get())->item(i);
                     else
                         yValue = nextValue;