Index: Source/core/css/StylePropertySerializer.cpp |
diff --git a/Source/core/css/StylePropertySerializer.cpp b/Source/core/css/StylePropertySerializer.cpp |
index 4d00705a09c899759868fc66c70fbde7136ad7f1..5fc90b9b7f7482cc9d662c624f940c1a745ea226 100644 |
--- a/Source/core/css/StylePropertySerializer.cpp |
+++ b/Source/core/css/StylePropertySerializer.cpp |
@@ -502,9 +502,9 @@ String StylePropertySerializer::getLayeredShorthandValue(const StylePropertyShor |
for (unsigned j = 0; j < size; j++) { |
RefPtrWillBeRawPtr<CSSValue> value = nullptr; |
if (values[j]) { |
- if (values[j]->isBaseValueList()) |
- value = toCSSValueList(values[j].get())->item(i); |
- else { |
+ if (values[j]->isBaseValueList()) { |
+ value = toCSSValueList(values[j].get())->itemWithBoundsCheck(i); |
+ } else { |
value = values[j]; |
// Color only belongs in the last layer. |
@@ -530,7 +530,7 @@ String StylePropertySerializer::getLayeredShorthandValue(const StylePropertyShor |
RefPtrWillBeRawPtr<CSSValue> yValue = nullptr; |
RefPtrWillBeRawPtr<CSSValue> nextValue = values[j + 1]; |
if (nextValue->isValueList()) |
- yValue = toCSSValueList(nextValue.get())->itemWithoutBoundsCheck(i); |
+ yValue = toCSSValueList(nextValue.get())->item(i); |
else |
yValue = nextValue; |