<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[179476] trunk/Source/WebCore</title>
</head>
<body>

<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt;  }
#msg dl a { font-weight: bold}
#msg dl a:link    { color:#fc3; }
#msg dl a:active  { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff  {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/179476">179476</a></dd>
<dt>Author</dt> <dd>darin@apple.com</dd>
<dt>Date</dt> <dd>2015-02-02 10:12:32 -0800 (Mon, 02 Feb 2015)</dd>
</dl>

<h3>Log Message</h3>
<pre>REGRESSION (<a href="http://trac.webkit.org/projects/webkit/changeset/170576">r170576</a>): Storage leaks in parsing of CSS image sizes
https://bugs.webkit.org/show_bug.cgi?id=141026

Reviewed by Anders Carlsson.

* css/CSSGrammar.y.in: Fixed all the shift/reduce conflicts caused
by the ENABLE_PICTURE_SIZES code by removing all the redundant
maybe_space which caused them. Rearranged the productions for
ENABLE_PICTURE_SIZES to tighten up the code quite a bit. Changed
the code to build up the source size vector as a Vector instead of
a special class, and use the SourceSize struct from inside the
CSSParser class.'

* css/CSSParser.cpp:
(WebCore::CSSParser::setupParser): Changed this to take a StringView.
In the future we can change all the parsing functions to take StringView,
since they don't work with the String in place.
(WebCore::CSSParser::parseSizesAttribute): Changed to return a vector
of SourceSize instead of a SourceSizeList. This is better because it's
a real CSS data structure that does not contain a CSSParserValue.
(WebCore::CSSParser::sourceSize): Added. Helper that creates a
SourceSize, mapping parser data structures into real CSS ones.

* css/CSSParser.h: Updated for changes above.

* css/MediaQuery.cpp:
(WebCore::MediaQuery::MediaQuery): Use std::make_unique and the copy
constructor directly instead of using a MediaQuery::copy function.

* css/MediaQueryExp.cpp: Streamlined the class a little bit.
* css/MediaQueryExp.h: Removed unneeded includes. Moved functions out
of the class body so the class is easier to read. Removed the unneeded
copy function.

* css/SourceSizeList.cpp:
(WebCore::SourceSize::match): Changed to use WTF::move instead
of releasing and then re-creating the unique_ptr.
(WebCore::computeLength): Added a comment to explain this function
is using an incorrect strategy. Also added some type checking code
to handle cases where a null or non-primitive CSS value might be
returned. Probably dead code, but we don't want to risk a bad cast.
Worthe cleaning up when we fix the strategy.
(WebCore::SourceSizeList::getEffectiveSize): Updated since the
vector now contains actual SourceSize objects rather than pointers
to SourceSize objects on the heap.

* css/SourceSizeList.h: Changed the CSSParserValue argument to be
an rvalue reference to make it clearer that we take ownership of it
when it's moved in. Added a move constructor and a destructor. Added
comments explaining that it's not correct design to use a
CSSParserValue here, outside the parser. Changed SourceSizeList's
append function to move a SourceSize in rather than a unique_ptr.
Made getEffectiveSize private. Moved the various inline functions to
the bottom of the file to make the class definitions easier to read.

* css/SourceSizeList.cpp: Made almost everything about this private
to this source file instead of public in the header.
(WebCore::match): Made this a free function instead of a member function
and made it take the media query expression as an argument.
(WebCore::computeLength): Changed the argument type to CSSValue*,
rather than using CSSParserValue here outside the parser.
(WebCore::parseSizesAttribute): Streamlined and simplified this.
Now that the parser builds the list in the correct order, there was
no need to iterate backwards any more so we could use a modern for
loop.

* css/SourceSizeList.h: Removed almost everything in this header.

* html/HTMLImageElement.cpp:
(WebCore::HTMLImageElement::parseAttribute): Call the
parseSizesAttribute function as free function since it's no longer
a member of a SourceSizeList class.

* html/parser/HTMLPreloadScanner.cpp:
(WebCore::TokenPreloadScanner::StartTagScanner::processAttributes):
Ditto.</pre>

<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkSourceWebCoreChangeLog">trunk/Source/WebCore/ChangeLog</a></li>
<li><a href="#trunkSourceWebCorecssCSSGrammaryin">trunk/Source/WebCore/css/CSSGrammar.y.in</a></li>
<li><a href="#trunkSourceWebCorecssCSSParsercpp">trunk/Source/WebCore/css/CSSParser.cpp</a></li>
<li><a href="#trunkSourceWebCorecssCSSParserh">trunk/Source/WebCore/css/CSSParser.h</a></li>
<li><a href="#trunkSourceWebCorecssMediaQuerycpp">trunk/Source/WebCore/css/MediaQuery.cpp</a></li>
<li><a href="#trunkSourceWebCorecssMediaQueryExpcpp">trunk/Source/WebCore/css/MediaQueryExp.cpp</a></li>
<li><a href="#trunkSourceWebCorecssMediaQueryExph">trunk/Source/WebCore/css/MediaQueryExp.h</a></li>
<li><a href="#trunkSourceWebCorecssSourceSizeListcpp">trunk/Source/WebCore/css/SourceSizeList.cpp</a></li>
<li><a href="#trunkSourceWebCorecssSourceSizeListh">trunk/Source/WebCore/css/SourceSizeList.h</a></li>
<li><a href="#trunkSourceWebCorehtmlHTMLImageElementcpp">trunk/Source/WebCore/html/HTMLImageElement.cpp</a></li>
<li><a href="#trunkSourceWebCorehtmlparserHTMLPreloadScannercpp">trunk/Source/WebCore/html/parser/HTMLPreloadScanner.cpp</a></li>
</ul>

</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkSourceWebCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/ChangeLog (179475 => 179476)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/ChangeLog        2015-02-02 17:06:19 UTC (rev 179475)
+++ trunk/Source/WebCore/ChangeLog        2015-02-02 18:12:32 UTC (rev 179476)
</span><span class="lines">@@ -1,5 +1,85 @@
</span><span class="cx"> 2015-02-02  Darin Adler  &lt;darin@apple.com&gt;
</span><span class="cx"> 
</span><ins>+        REGRESSION (r170576): Storage leaks in parsing of CSS image sizes
+        https://bugs.webkit.org/show_bug.cgi?id=141026
+
+        Reviewed by Anders Carlsson.
+
+        * css/CSSGrammar.y.in: Fixed all the shift/reduce conflicts caused
+        by the ENABLE_PICTURE_SIZES code by removing all the redundant
+        maybe_space which caused them. Rearranged the productions for
+        ENABLE_PICTURE_SIZES to tighten up the code quite a bit. Changed
+        the code to build up the source size vector as a Vector instead of
+        a special class, and use the SourceSize struct from inside the
+        CSSParser class.'
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::setupParser): Changed this to take a StringView.
+        In the future we can change all the parsing functions to take StringView,
+        since they don't work with the String in place.
+        (WebCore::CSSParser::parseSizesAttribute): Changed to return a vector
+        of SourceSize instead of a SourceSizeList. This is better because it's
+        a real CSS data structure that does not contain a CSSParserValue.
+        (WebCore::CSSParser::sourceSize): Added. Helper that creates a
+        SourceSize, mapping parser data structures into real CSS ones.
+
+        * css/CSSParser.h: Updated for changes above.
+
+        * css/MediaQuery.cpp:
+        (WebCore::MediaQuery::MediaQuery): Use std::make_unique and the copy
+        constructor directly instead of using a MediaQuery::copy function.
+
+        * css/MediaQueryExp.cpp: Streamlined the class a little bit.
+        * css/MediaQueryExp.h: Removed unneeded includes. Moved functions out
+        of the class body so the class is easier to read. Removed the unneeded
+        copy function.
+
+        * css/SourceSizeList.cpp:
+        (WebCore::SourceSize::match): Changed to use WTF::move instead
+        of releasing and then re-creating the unique_ptr.
+        (WebCore::computeLength): Added a comment to explain this function
+        is using an incorrect strategy. Also added some type checking code
+        to handle cases where a null or non-primitive CSS value might be
+        returned. Probably dead code, but we don't want to risk a bad cast.
+        Worthe cleaning up when we fix the strategy.
+        (WebCore::SourceSizeList::getEffectiveSize): Updated since the
+        vector now contains actual SourceSize objects rather than pointers
+        to SourceSize objects on the heap.
+
+        * css/SourceSizeList.h: Changed the CSSParserValue argument to be
+        an rvalue reference to make it clearer that we take ownership of it
+        when it's moved in. Added a move constructor and a destructor. Added
+        comments explaining that it's not correct design to use a
+        CSSParserValue here, outside the parser. Changed SourceSizeList's
+        append function to move a SourceSize in rather than a unique_ptr.
+        Made getEffectiveSize private. Moved the various inline functions to
+        the bottom of the file to make the class definitions easier to read.
+
+
+        * css/SourceSizeList.cpp: Made almost everything about this private
+        to this source file instead of public in the header.
+        (WebCore::match): Made this a free function instead of a member function
+        and made it take the media query expression as an argument.
+        (WebCore::computeLength): Changed the argument type to CSSValue*,
+        rather than using CSSParserValue here outside the parser.
+        (WebCore::parseSizesAttribute): Streamlined and simplified this.
+        Now that the parser builds the list in the correct order, there was
+        no need to iterate backwards any more so we could use a modern for
+        loop.
+
+        * css/SourceSizeList.h: Removed almost everything in this header.
+
+        * html/HTMLImageElement.cpp:
+        (WebCore::HTMLImageElement::parseAttribute): Call the
+        parseSizesAttribute function as free function since it's no longer
+        a member of a SourceSizeList class.
+
+        * html/parser/HTMLPreloadScanner.cpp:
+        (WebCore::TokenPreloadScanner::StartTagScanner::processAttributes):
+        Ditto.
+
+2015-02-02  Darin Adler  &lt;darin@apple.com&gt;
+
</ins><span class="cx">         Fix some leaks found by the leak bot
</span><span class="cx">         https://bugs.webkit.org/show_bug.cgi?id=141149
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceWebCorecssCSSGrammaryin"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/css/CSSGrammar.y.in (179475 => 179476)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/css/CSSGrammar.y.in        2015-02-02 17:06:19 UTC (rev 179475)
+++ trunk/Source/WebCore/css/CSSGrammar.y.in        2015-02-02 18:12:32 UTC (rev 179476)
</span><span class="lines">@@ -1,6 +1,6 @@
</span><span class="cx"> /*
</span><span class="cx">  *  Copyright (C) 2002-2003 Lars Knoll (knoll@kde.org)
</span><del>- *  Copyright (C) 2004-2014 Apple Inc. All rights reserved.
</del><ins>+ *  Copyright (C) 2004-2015 Apple Inc. All rights reserved.
</ins><span class="cx">  *  Copyright (C) 2006 Alexey Proskuryakov (ap@nypop.com)
</span><span class="cx">  *  Copyright (C) 2008 Eric Seidel &lt;eric@webkit.org&gt;
</span><span class="cx">  *  Copyright (C) 2012 Intel Corporation. All rights reserved.
</span><span class="lines">@@ -104,18 +104,10 @@
</span><span class="cx"> %}
</span><span class="cx"> 
</span><span class="cx"> #if ENABLE_CSS_GRID_LAYOUT
</span><del>-#if ENABLE_PICTURE_SIZES
-%expect 36
-#else
</del><span class="cx"> %expect 32
</span><del>-#endif
</del><span class="cx"> #else
</span><del>-#if ENABLE_PICTURE_SIZES
-%expect 35
-#else
</del><span class="cx"> %expect 31
</span><span class="cx"> #endif
</span><del>-#endif
</del><span class="cx"> 
</span><span class="cx"> %nonassoc LOWEST_PREC
</span><span class="cx"> 
</span><span class="lines">@@ -265,23 +257,21 @@
</span><span class="cx"> %type &lt;mediaQueryRestrictor&gt; maybe_media_restrictor
</span><span class="cx"> 
</span><span class="cx"> %union { MediaQueryExp* mediaQueryExp; }
</span><del>-%type &lt;mediaQueryExp&gt; media_query_exp
-%destructor { delete $$; } media_query_exp
</del><ins>+%type &lt;mediaQueryExp&gt; media_query_exp base_media_query_exp
+%destructor { delete $$; } media_query_exp base_media_query_exp
</ins><span class="cx"> 
</span><span class="cx"> #if ENABLE_PICTURE_SIZES
</span><del>-%union { MediaQueryExp* mediaCondition; }
-%type &lt;mediaQueryExp&gt; media_condition
-%destructor { delete $$; } media_condition
</del><span class="cx"> 
</span><del>-%union { SourceSize* sourceSize; }
-%type &lt;sourceSize&gt; source_size
-%destructor { delete $$; } source_size
-
-%union { SourceSizeList* sourceSizeList; }
</del><ins>+%union { Vector&lt;CSSParser::SourceSize&gt;* sourceSizeList; }
</ins><span class="cx"> %type &lt;sourceSizeList&gt; source_size_list
</span><span class="cx"> %destructor { delete $$; } source_size_list
</span><span class="cx"> 
</span><ins>+%type &lt;mediaQueryExp&gt; maybe_source_media_query_exp
+%destructor { delete $$; } maybe_source_media_query_exp
+
</ins><span class="cx"> %type &lt;value&gt; source_size_length
</span><ins>+%destructor { destroy($$); } source_size_length
+
</ins><span class="cx"> #endif
</span><span class="cx"> 
</span><span class="cx"> %union { Vector&lt;std::unique_ptr&lt;MediaQueryExp&gt;&gt;* mediaQueryExpList; }
</span><span class="lines">@@ -298,12 +288,12 @@
</span><span class="cx"> %type &lt;keyframeRuleList&gt; keyframes_rule
</span><span class="cx"> %destructor { delete $$; } keyframes_rule
</span><span class="cx"> 
</span><del>-// These two parser values never need to be destroyed because they are never functions or value lists.
-%type &lt;value&gt; key unary_term
</del><ins>+// These parser values never need to be destroyed because they are never functions or value lists.
+%type &lt;value&gt; calc_func_term key unary_term
</ins><span class="cx"> 
</span><span class="cx"> // These parser values need to be destroyed because they might be functions.
</span><del>-%type &lt;value&gt; calc_func_term calc_function function min_or_max_function term
-%destructor { destroy($$); } calc_func_term calc_function function min_or_max_function term
</del><ins>+%type &lt;value&gt; calc_function function min_or_max_function term
+%destructor { destroy($$); } calc_function function min_or_max_function term
</ins><span class="cx"> 
</span><span class="cx"> %union { CSSPropertyID id; }
</span><span class="cx"> %type &lt;id&gt; property
</span><span class="lines">@@ -334,10 +324,13 @@
</span><span class="cx"> %destructor { delete $$; } calc_func_expr calc_func_expr_list calc_func_paren_expr expr key_list maybe_media_value valid_calc_func_expr valid_expr
</span><span class="cx"> 
</span><span class="cx"> #if ENABLE_CSS_SELECTORS_LEVEL4
</span><ins>+
</ins><span class="cx"> %type &lt;string&gt; lang_range
</span><ins>+
</ins><span class="cx"> %union { Vector&lt;CSSParserString&gt;* stringList; }
</span><span class="cx"> %type &lt;stringList&gt; comma_separated_lang_ranges
</span><span class="cx"> %destructor { delete $$; } comma_separated_lang_ranges
</span><ins>+
</ins><span class="cx"> #endif
</span><span class="cx"> 
</span><span class="cx"> %type &lt;string&gt; min_or_max
</span><span class="lines">@@ -348,11 +341,13 @@
</span><span class="cx"> %type &lt;location&gt; error_location
</span><span class="cx"> 
</span><span class="cx"> #if ENABLE_CSS_GRID_LAYOUT
</span><ins>+
</ins><span class="cx"> %type &lt;valueList&gt; ident_list
</span><span class="cx"> %destructor { delete $$; } ident_list
</span><span class="cx"> 
</span><span class="cx"> %type &lt;value&gt; track_names_list
</span><span class="cx"> %destructor { destroy($$); } track_names_list
</span><ins>+
</ins><span class="cx"> #endif
</span><span class="cx"> 
</span><span class="cx"> %token SUPPORTS_AND
</span><span class="lines">@@ -577,55 +572,50 @@
</span><span class="cx"> maybe_media_value: /*empty*/ { $$ = nullptr; } | ':' maybe_space expr maybe_space { $$ = $3; } ;
</span><span class="cx"> 
</span><span class="cx"> #if ENABLE_PICTURE_SIZES
</span><del>-media_condition:
-    maybe_space '(' maybe_space IDENT maybe_space maybe_media_value ')' maybe_space {
-        std::unique_ptr&lt;CSSParserValueList&gt; mediaValue($6);
-        $4.lower();
-        $$ = new MediaQueryExp($4, mediaValue.get());
</del><ins>+
+webkit_source_size_list:
+    WEBKIT_SIZESATTR_SYM WHITESPACE source_size_list maybe_space '}' {
+        parser-&gt;m_sourceSizeList = std::unique_ptr&lt;Vector&lt;CSSParser::SourceSize&gt;&gt;($3);
</ins><span class="cx">     }
</span><span class="cx">     ;
</span><span class="cx"> 
</span><del>-webkit_source_size_list:
-    WEBKIT_SIZESATTR_SYM WHITESPACE source_size_list '}' { parser-&gt;m_sourceSizeList = std::unique_ptr&lt;SourceSizeList&gt;($3); };
-
</del><span class="cx"> source_size_list:
</span><del>-    maybe_space source_size maybe_space {
-        $$ = new SourceSizeList();
-        $$-&gt;append(std::unique_ptr&lt;SourceSize&gt;($2));
</del><ins>+    maybe_source_media_query_exp source_size_length {
+        $$ = new Vector&lt;CSSParser::SourceSize&gt;;
+        $$-&gt;append(parser-&gt;sourceSize(std::unique_ptr&lt;MediaQueryExp&gt;($1), $2));
</ins><span class="cx">     }
</span><del>-    | maybe_space source_size maybe_space ',' maybe_space source_size_list maybe_space {
-        $$ = $6;
-        $$-&gt;append(std::unique_ptr&lt;SourceSize&gt;($2));
-    };
-
-source_size_length:
-    unary_term {
</del><ins>+    | source_size_list maybe_space ',' maybe_space maybe_source_media_query_exp source_size_length {
</ins><span class="cx">         $$ = $1;
</span><ins>+        $$-&gt;append(parser-&gt;sourceSize(std::unique_ptr&lt;MediaQueryExp&gt;($5), $6));
</ins><span class="cx">     }
</span><del>-    | calc_function {
-        $$ = $1;
-    };
</del><ins>+    ;
</ins><span class="cx"> 
</span><del>-source_size:
-    media_condition source_size_length {
-        $$ = new SourceSize(std::unique_ptr&lt;MediaQueryExp&gt;($1), $2);
</del><ins>+maybe_source_media_query_exp:
+    /* empty */ {
+        $$ = new MediaQueryExp;
</ins><span class="cx">     }
</span><del>-    | source_size_length {
-        $$ = new SourceSize(std::make_unique&lt;MediaQueryExp&gt;(emptyString(), nullptr), $1);
-    };
</del><ins>+    | base_media_query_exp maybe_space;
+
+source_size_length: unary_term | calc_function;
+
</ins><span class="cx"> #endif
</span><span class="cx"> 
</span><ins>+base_media_query_exp: '(' maybe_space IDENT maybe_space maybe_media_value ')' {
+        std::unique_ptr&lt;CSSParserValueList&gt; mediaValue($5);
+        $3.lower();
+        $$ = new MediaQueryExp($3, mediaValue.get());
+    }
+    ;
+
</ins><span class="cx"> media_query_exp:
</span><del>-    maybe_media_restrictor maybe_space '(' maybe_space IDENT maybe_space maybe_media_value ')' maybe_space {
-        // If restrictor is specified, media query expression is invalid.
-        // Create empty media query expression and continue parsing media query.
-        std::unique_ptr&lt;CSSParserValueList&gt; mediaValue($7);
-        if ($1 != MediaQuery::None)
-            $$ = new MediaQueryExp(emptyString(), nullptr);
-        else {
-            $5.lower();
-            $$ = new MediaQueryExp($5, mediaValue.get());
-        }
</del><ins>+    maybe_media_restrictor maybe_space base_media_query_exp maybe_space {
+        if ($1 != MediaQuery::None) {
+            // If restrictor is specified, media query expression is invalid.
+            // Create empty media query expression and continue parsing media query.
+            delete $3;
+            $$ = new MediaQueryExp;
+        } else
+            $$ = $3;
</ins><span class="cx">     }
</span><span class="cx">     ;
</span><span class="cx"> 
</span><span class="lines">@@ -1915,4 +1905,3 @@
</span><span class="cx">     ;
</span><span class="cx"> 
</span><span class="cx"> %%
</span><del>-
</del></span></pre></div>
<a id="trunkSourceWebCorecssCSSParsercpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/css/CSSParser.cpp (179475 => 179476)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/css/CSSParser.cpp        2015-02-02 17:06:19 UTC (rev 179475)
+++ trunk/Source/WebCore/css/CSSParser.cpp        2015-02-02 18:12:32 UTC (rev 179476)
</span><span class="lines">@@ -377,7 +377,7 @@
</span><span class="cx">     makeLower(characters16(), characters16(), length());
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-void CSSParser::setupParser(const char* prefix, unsigned prefixLength, const String&amp; string, const char* suffix, unsigned suffixLength)
</del><ins>+void CSSParser::setupParser(const char* prefix, unsigned prefixLength, StringView string, const char* suffix, unsigned suffixLength)
</ins><span class="cx"> {
</span><span class="cx">     m_parsedTextPrefixLength = prefixLength;
</span><span class="cx">     unsigned stringLength = string.length();
</span><span class="lines">@@ -1480,18 +1480,43 @@
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> #if ENABLE(PICTURE_SIZES)
</span><del>-std::unique_ptr&lt;SourceSizeList&gt; CSSParser::parseSizesAttribute(const String&amp; string)
</del><ins>+
+Vector&lt;CSSParser::SourceSize&gt; CSSParser::parseSizesAttribute(StringView string)
</ins><span class="cx"> {
</span><ins>+    Vector&lt;SourceSize&gt; result;
+
</ins><span class="cx">     if (string.isEmpty())
</span><del>-        return nullptr;
</del><ins>+        return result;
</ins><span class="cx"> 
</span><del>-    ASSERT(!m_sourceSizeList.get());
</del><ins>+    ASSERT(!m_sourceSizeList);
</ins><span class="cx"> 
</span><span class="cx">     setupParser(&quot;@-webkit-sizesattr &quot;, string, &quot;}&quot;);
</span><span class="cx">     cssyyparse(this);
</span><span class="cx"> 
</span><del>-    return WTF::move(m_sourceSizeList);
</del><ins>+    if (!m_sourceSizeList)
+        return result;
+
+    result = WTF::move(*m_sourceSizeList);
+    m_sourceSizeList = nullptr;
+    return result;
</ins><span class="cx"> }
</span><ins>+
+CSSParser::SourceSize CSSParser::sourceSize(std::unique_ptr&lt;MediaQueryExp&gt;&amp;&amp; expression, CSSParserValue&amp; parserValue)
+{
+    RefPtr&lt;CSSValue&gt; value;
+    if (isCalculation(parserValue)) {
+        auto* args = parserValue.function-&gt;args.get();
+        if (args &amp;&amp; args-&gt;size())
+            value = CSSCalcValue::create(parserValue.function-&gt;name, *args, CalculationRangeNonNegative);
+    }
+    if (!value)
+        value = parserValue.createCSSValue();
+    // FIXME: Using a named local for the result here to work around an MSVC bug.
+    // With the other compilers, this works without explicitly stating the type name SourceSize or using a local.
+    SourceSize result { WTF::move(expression), value };
+    return result;
+}
+
</ins><span class="cx"> #endif
</span><span class="cx"> 
</span><span class="cx"> static inline void filterProperties(bool important, const CSSParser::ParsedPropertyVector&amp; input, Vector&lt;CSSProperty, 256&gt;&amp; output, size_t&amp; unusedEntries, std::bitset&lt;numCSSProperties&gt;&amp; seenProperties)
</span></span></pre></div>
<a id="trunkSourceWebCorecssCSSParserh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/css/CSSParser.h (179475 => 179476)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/css/CSSParser.h        2015-02-02 17:06:19 UTC (rev 179475)
+++ trunk/Source/WebCore/css/CSSParser.h        2015-02-02 18:12:32 UTC (rev 179476)
</span><span class="lines">@@ -1,6 +1,6 @@
</span><span class="cx"> /*
</span><span class="cx">  * Copyright (C) 2003 Lars Knoll (knoll@kde.org)
</span><del>- * Copyright (C) 2004, 2005, 2006, 2008, 2009, 2010 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2004-2010, 2015 Apple Inc. All rights reserved.
</ins><span class="cx">  * Copyright (C) 2008 Eric Seidel &lt;eric@webkit.org&gt;
</span><span class="cx">  * Copyright (C) 2009 - 2010  Torch Mobile (Beijing) Co. Ltd. All rights reserved.
</span><span class="cx">  *
</span><span class="lines">@@ -117,9 +117,6 @@
</span><span class="cx">     bool parseDeclaration(MutableStyleProperties*, const String&amp;, PassRefPtr&lt;CSSRuleSourceData&gt;, StyleSheetContents* contextStyleSheet);
</span><span class="cx">     static Ref&lt;ImmutableStyleProperties&gt; parseInlineStyleDeclaration(const String&amp;, Element*);
</span><span class="cx">     std::unique_ptr&lt;MediaQuery&gt; parseMediaQuery(const String&amp;);
</span><del>-#if ENABLE(PICTURE_SIZES)
-    std::unique_ptr&lt;SourceSizeList&gt; parseSizesAttribute(const String&amp;);
-#endif
</del><span class="cx"> 
</span><span class="cx">     void addPropertyWithPrefixingVariant(CSSPropertyID, PassRefPtr&lt;CSSValue&gt;, bool important, bool implicit = false);
</span><span class="cx">     void addProperty(CSSPropertyID, PassRefPtr&lt;CSSValue&gt;, bool important, bool implicit = false);
</span><span class="lines">@@ -138,6 +135,15 @@
</span><span class="cx"> 
</span><span class="cx">     PassRefPtr&lt;CSSValue&gt; parseBackgroundColor();
</span><span class="cx"> 
</span><ins>+#if ENABLE(PICTURE_SIZES)
+    struct SourceSize {
+        std::unique_ptr&lt;MediaQueryExp&gt; expression;
+        RefPtr&lt;CSSValue&gt; length;
+    };
+    Vector&lt;SourceSize&gt; parseSizesAttribute(StringView);
+    SourceSize sourceSize(std::unique_ptr&lt;MediaQueryExp&gt;&amp;&amp;, CSSParserValue&amp;);
+#endif
+
</ins><span class="cx">     // FIXME: Maybe these two methods could be combined into one.
</span><span class="cx">     bool parseMaskImage(CSSParserValueList&amp;, RefPtr&lt;CSSValue&gt;&amp;);
</span><span class="cx">     bool parseFillImage(CSSParserValueList&amp;, RefPtr&lt;CSSValue&gt;&amp;);
</span><span class="lines">@@ -366,7 +372,7 @@
</span><span class="cx">     RefPtr&lt;StyleKeyframe&gt; m_keyframe;
</span><span class="cx">     std::unique_ptr&lt;MediaQuery&gt; m_mediaQuery;
</span><span class="cx"> #if ENABLE(PICTURE_SIZES)
</span><del>-    std::unique_ptr&lt;SourceSizeList&gt; m_sourceSizeList;
</del><ins>+    std::unique_ptr&lt;Vector&lt;SourceSize&gt;&gt; m_sourceSizeList;
</ins><span class="cx"> #endif
</span><span class="cx">     std::unique_ptr&lt;CSSParserValueList&gt; m_valueList;
</span><span class="cx">     bool m_supportsCondition;
</span><span class="lines">@@ -514,11 +520,11 @@
</span><span class="cx">     void recheckAtKeyword(const UChar* str, int len);
</span><span class="cx"> 
</span><span class="cx">     template&lt;unsigned prefixLength, unsigned suffixLength&gt;
</span><del>-    inline void setupParser(const char (&amp;prefix)[prefixLength], const String&amp; string, const char (&amp;suffix)[suffixLength])
</del><ins>+    void setupParser(const char (&amp;prefix)[prefixLength], StringView string, const char (&amp;suffix)[suffixLength])
</ins><span class="cx">     {
</span><span class="cx">         setupParser(prefix, prefixLength - 1, string, suffix, suffixLength - 1);
</span><span class="cx">     }
</span><del>-    void setupParser(const char* prefix, unsigned prefixLength, const String&amp;, const char* suffix, unsigned suffixLength);
</del><ins>+    void setupParser(const char* prefix, unsigned prefixLength, StringView, const char* suffix, unsigned suffixLength);
</ins><span class="cx">     bool inShorthand() const { return m_inParseShorthand; }
</span><span class="cx"> 
</span><span class="cx">     bool validateWidth(ValueWithCalculation&amp;);
</span></span></pre></div>
<a id="trunkSourceWebCorecssMediaQuerycpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/css/MediaQuery.cpp (179475 => 179476)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/css/MediaQuery.cpp        2015-02-02 17:06:19 UTC (rev 179475)
+++ trunk/Source/WebCore/css/MediaQuery.cpp        2015-02-02 18:12:32 UTC (rev 179476)
</span><span class="lines">@@ -110,7 +110,7 @@
</span><span class="cx">     , m_serializationCache(o.m_serializationCache)
</span><span class="cx"> {
</span><span class="cx">     for (unsigned i = 0; i &lt; m_expressions-&gt;size(); ++i)
</span><del>-        (*m_expressions)[i] = o.m_expressions-&gt;at(i)-&gt;copy();
</del><ins>+        (*m_expressions)[i] = std::make_unique&lt;MediaQueryExp&gt;(*o.m_expressions-&gt;at(i));
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> MediaQuery::~MediaQuery()
</span></span></pre></div>
<a id="trunkSourceWebCorecssMediaQueryExpcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/css/MediaQueryExp.cpp (179475 => 179476)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/css/MediaQueryExp.cpp        2015-02-02 17:06:19 UTC (rev 179475)
+++ trunk/Source/WebCore/css/MediaQueryExp.cpp        2015-02-02 18:12:32 UTC (rev 179476)
</span><span class="lines">@@ -1,9 +1,7 @@
</span><span class="cx"> /*
</span><del>- * CSS Media Query
- *
</del><span class="cx">  * Copyright (C) 2006 Kimmo Kinnunen &lt;kimmo.t.kinnunen@nokia.com&gt;.
</span><span class="cx">  * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies).
</span><del>- * Copyright (C) 2013 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2013, 2015 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -162,8 +160,6 @@
</span><span class="cx"> 
</span><span class="cx"> MediaQueryExp::MediaQueryExp(const AtomicString&amp; mediaFeature, CSSParserValueList* valueList)
</span><span class="cx">     : m_mediaFeature(mediaFeature)
</span><del>-    , m_value(0)
-    , m_isValid(false)
</del><span class="cx"> {
</span><span class="cx">     // Initialize media query expression that must have 1 or more values.
</span><span class="cx">     if (valueList) {
</span><span class="lines">@@ -228,10 +224,6 @@
</span><span class="cx">         m_isValid = true;
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-MediaQueryExp::~MediaQueryExp()
-{
-}
-
</del><span class="cx"> String MediaQueryExp::serialize() const
</span><span class="cx"> {
</span><span class="cx">     if (!m_serializationCache.isNull())
</span><span class="lines">@@ -246,7 +238,7 @@
</span><span class="cx">     }
</span><span class="cx">     result.append(')');
</span><span class="cx"> 
</span><del>-    const_cast&lt;MediaQueryExp*&gt;(this)-&gt;m_serializationCache = result.toString();
</del><ins>+    m_serializationCache = result.toString();
</ins><span class="cx">     return m_serializationCache;
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceWebCorecssMediaQueryExph"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/css/MediaQueryExp.h (179475 => 179476)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/css/MediaQueryExp.h        2015-02-02 17:06:19 UTC (rev 179475)
+++ trunk/Source/WebCore/css/MediaQueryExp.h        2015-02-02 18:12:32 UTC (rev 179476)
</span><span class="lines">@@ -1,8 +1,7 @@
</span><span class="cx"> /*
</span><del>- * CSS Media Query
- *
</del><span class="cx">  * Copyright (C) 2006 Kimmo Kinnunen &lt;kimmo.t.kinnunen@nokia.com&gt;.
</span><span class="cx">  * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies).
</span><ins>+ * Copyright (C) 2015 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -32,53 +31,70 @@
</span><span class="cx"> #include &quot;CSSValue.h&quot;
</span><span class="cx"> #include &quot;MediaFeatureNames.h&quot;
</span><span class="cx"> #include &lt;memory&gt;
</span><del>-#include &lt;wtf/RefPtr.h&gt;
</del><span class="cx"> #include &lt;wtf/text/AtomicString.h&gt;
</span><span class="cx"> 
</span><span class="cx"> namespace WebCore {
</span><ins>+
</ins><span class="cx"> class CSSParserValueList;
</span><span class="cx"> 
</span><span class="cx"> class MediaQueryExp {
</span><span class="cx">     WTF_MAKE_FAST_ALLOCATED;
</span><span class="cx"> public:
</span><del>-    MediaQueryExp(const AtomicString&amp; mediaFeature, CSSParserValueList* values);
-    ~MediaQueryExp();
</del><ins>+    explicit MediaQueryExp(const AtomicString&amp; mediaFeature = emptyAtom, CSSParserValueList* values = nullptr);
</ins><span class="cx"> 
</span><del>-    AtomicString mediaFeature() const { return m_mediaFeature; }
</del><ins>+    const AtomicString&amp; mediaFeature() const;
+    CSSValue* value() const;
</ins><span class="cx"> 
</span><del>-    CSSValue* value() const { return m_value.get(); }
</del><ins>+    bool isValid() const;
+    bool isViewportDependent() const;
</ins><span class="cx"> 
</span><del>-    bool operator==(const MediaQueryExp&amp; other) const
-    {
-        return (other.m_mediaFeature == m_mediaFeature)
-            &amp;&amp; ((!other.m_value &amp;&amp; !m_value)
-                || (other.m_value &amp;&amp; m_value &amp;&amp; other.m_value-&gt;equals(*m_value)));
-    }
-
-    bool isValid() const { return m_isValid; }
-
-    bool isViewportDependent() const { return m_mediaFeature == MediaFeatureNames::widthMediaFeature
-                                            || m_mediaFeature == MediaFeatureNames::heightMediaFeature
-                                            || m_mediaFeature == MediaFeatureNames::min_widthMediaFeature
-                                            || m_mediaFeature == MediaFeatureNames::min_heightMediaFeature
-                                            || m_mediaFeature == MediaFeatureNames::max_widthMediaFeature
-                                            || m_mediaFeature == MediaFeatureNames::max_heightMediaFeature
-                                            || m_mediaFeature == MediaFeatureNames::orientationMediaFeature
-                                            || m_mediaFeature == MediaFeatureNames::aspect_ratioMediaFeature
-                                            || m_mediaFeature == MediaFeatureNames::min_aspect_ratioMediaFeature
-                                            || m_mediaFeature == MediaFeatureNames::max_aspect_ratioMediaFeature;  }
-
</del><span class="cx">     String serialize() const;
</span><span class="cx"> 
</span><del>-    std::unique_ptr&lt;MediaQueryExp&gt; copy() const { return std::make_unique&lt;MediaQueryExp&gt;(*this); }
</del><ins>+    bool operator==(const MediaQueryExp&amp;) const;
</ins><span class="cx"> 
</span><span class="cx"> private:
</span><span class="cx">     AtomicString m_mediaFeature;
</span><span class="cx">     RefPtr&lt;CSSValue&gt; m_value;
</span><del>-    bool m_isValid;
-    String m_serializationCache;
</del><ins>+    bool m_isValid { false };
+    mutable String m_serializationCache;
</ins><span class="cx"> };
</span><span class="cx"> 
</span><ins>+inline const AtomicString&amp; MediaQueryExp::mediaFeature() const
+{
+    return m_mediaFeature;
+}
+
+inline CSSValue* MediaQueryExp::value() const
+{
+    return m_value.get();
+}
+
+inline bool MediaQueryExp::operator==(const MediaQueryExp&amp; other) const
+{
+    return (other.m_mediaFeature == m_mediaFeature)
+        &amp;&amp; ((!other.m_value &amp;&amp; !m_value)
+            || (other.m_value &amp;&amp; m_value &amp;&amp; other.m_value-&gt;equals(*m_value)));
+}
+
+inline bool MediaQueryExp::isValid() const
+{
+    return m_isValid;
+}
+
+inline bool MediaQueryExp::isViewportDependent() const
+{
+    return m_mediaFeature == MediaFeatureNames::widthMediaFeature
+        || m_mediaFeature == MediaFeatureNames::heightMediaFeature
+        || m_mediaFeature == MediaFeatureNames::min_widthMediaFeature
+        || m_mediaFeature == MediaFeatureNames::min_heightMediaFeature
+        || m_mediaFeature == MediaFeatureNames::max_widthMediaFeature
+        || m_mediaFeature == MediaFeatureNames::max_heightMediaFeature
+        || m_mediaFeature == MediaFeatureNames::orientationMediaFeature
+        || m_mediaFeature == MediaFeatureNames::aspect_ratioMediaFeature
+        || m_mediaFeature == MediaFeatureNames::min_aspect_ratioMediaFeature
+        || m_mediaFeature == MediaFeatureNames::max_aspect_ratioMediaFeature;
+}
+
</ins><span class="cx"> } // namespace
</span><span class="cx"> 
</span><span class="cx"> #endif
</span></span></pre></div>
<a id="trunkSourceWebCorecssSourceSizeListcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/css/SourceSizeList.cpp (179475 => 179476)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/css/SourceSizeList.cpp        2015-02-02 17:06:19 UTC (rev 179475)
+++ trunk/Source/WebCore/css/SourceSizeList.cpp        2015-02-02 18:12:32 UTC (rev 179476)
</span><span class="lines">@@ -1,5 +1,6 @@
</span><span class="cx"> /*
</span><span class="cx">  * Copyright (C) 2014 Yoav Weiss &lt;yoav@yoav.ws&gt;
</span><ins>+ * Copyright (C) 2015 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * This library is free software; you can redistribute it and/or
</span><span class="cx">  * modify it under the terms of the GNU Library General Public
</span><span class="lines">@@ -22,23 +23,31 @@
</span><span class="cx"> 
</span><span class="cx"> #include &quot;CSSParser.h&quot;
</span><span class="cx"> #include &quot;CSSToLengthConversionData.h&quot;
</span><del>-#include &quot;Document.h&quot;
</del><span class="cx"> #include &quot;MediaList.h&quot;
</span><span class="cx"> #include &quot;MediaQuery.h&quot;
</span><span class="cx"> #include &quot;MediaQueryEvaluator.h&quot;
</span><del>-#include &quot;RenderObject.h&quot;
</del><ins>+#include &quot;MediaQueryExp.h&quot;
</ins><span class="cx"> #include &quot;RenderStyle.h&quot;
</span><span class="cx"> #include &quot;RenderView.h&quot;
</span><span class="cx"> 
</span><span class="cx"> namespace WebCore {
</span><span class="cx"> 
</span><del>-#if ENABLE(PICTURE_SIZES)
-bool SourceSize::match(RenderStyle&amp; style, Frame* frame)
</del><ins>+#if !ENABLE(PICTURE_SIZES)
+
+unsigned parseSizesAttribute(StringView, RenderView*, Frame*)
</ins><span class="cx"> {
</span><del>-    if (m_mediaExp-&gt;mediaFeature().isEmpty())
</del><ins>+    return 0;
+}
+
+#else
+
+static bool match(std::unique_ptr&lt;MediaQueryExp&gt;&amp;&amp; expression, RenderStyle&amp; style, Frame* frame)
+{
+    if (expression-&gt;mediaFeature().isEmpty())
</ins><span class="cx">         return true;
</span><ins>+
</ins><span class="cx">     auto expList = std::make_unique&lt;Vector&lt;std::unique_ptr&lt;MediaQueryExp&gt;&gt;&gt;();
</span><del>-    expList-&gt;append(m_mediaExp.release());
</del><ins>+    expList-&gt;append(WTF::move(expression));
</ins><span class="cx"> 
</span><span class="cx">     RefPtr&lt;MediaQuerySet&gt; mediaQuerySet = MediaQuerySet::create();
</span><span class="cx">     mediaQuerySet-&gt;addMediaQuery(std::make_unique&lt;MediaQuery&gt;(MediaQuery::None, &quot;all&quot;, WTF::move(expList)));
</span><span class="lines">@@ -47,60 +56,28 @@
</span><span class="cx">     return mediaQueryEvaluator.eval(mediaQuerySet.get());
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-static unsigned computeLength(CSSParserValue&amp; value, RenderStyle&amp; style, RenderView* view)
</del><ins>+static unsigned computeLength(CSSValue* value, RenderStyle&amp; style, RenderView* view)
</ins><span class="cx"> {
</span><span class="cx">     CSSToLengthConversionData conversionData(&amp;style, &amp;style, view);
</span><del>-    if (CSSParser::isCalculation(value)) {
-        CSSParserValueList* args = value.function-&gt;args.get();
-        if (args &amp;&amp; args-&gt;size()) {
-            RefPtr&lt;CSSCalcValue&gt; calcValue = CSSCalcValue::create(value.function-&gt;name, *args, CalculationRangeNonNegative);
-            Length length(calcValue-&gt;createCalculationValue(conversionData));
-            RefPtr&lt;CSSPrimitiveValue&gt; primitiveValue = CSSPrimitiveValue::create(length, &amp;style);
-            return primitiveValue-&gt;computeLength&lt;unsigned&gt;(conversionData);
-        }
</del><ins>+    if (is&lt;CSSPrimitiveValue&gt;(value))
+        return downcast&lt;CSSPrimitiveValue&gt;(*value).computeLength&lt;unsigned&gt;(conversionData);
+    if (is&lt;CSSCalcValue&gt;(value)) {
+        Length length(downcast&lt;CSSCalcValue&gt;(*value).createCalculationValue(conversionData));
+        return CSSPrimitiveValue::create(length, &amp;style)-&gt;computeLength&lt;unsigned&gt;(conversionData);
</ins><span class="cx">     }
</span><del>-    RefPtr&lt;CSSValue&gt; cssValue = value.createCSSValue();
-    RefPtr&lt;CSSPrimitiveValue&gt; primitiveValue = downcast&lt;CSSPrimitiveValue&gt;(cssValue.get());
-    return primitiveValue-&gt;computeLength&lt;unsigned&gt;(conversionData);
</del><ins>+    return 0;
</ins><span class="cx"> }
</span><span class="cx"> 
</span><del>-static unsigned defaultValue(RenderStyle&amp; style, RenderView* view)
</del><ins>+unsigned parseSizesAttribute(StringView sizesAttribute, RenderView* view, Frame* frame)
</ins><span class="cx"> {
</span><del>-    const unsigned defaultSizesAttributeValueInVW = 100;
-
-    CSSParserValue value;
-    value.id = CSSValueInvalid;
-    value.isInt = true;
-    value.fValue = defaultSizesAttributeValueInVW;
-    value.unit = CSSPrimitiveValue::CSS_VW;
-
-    return computeLength(value, style, view);
-}
-
-unsigned SourceSize::length(RenderStyle&amp; style, RenderView* view)
-{
-    return computeLength(m_length, style, view);
-}
-
-unsigned SourceSizeList::parseSizesAttribute(const String&amp; sizesAttribute, RenderView* view, Frame* frame)
-{
</del><span class="cx">     if (!view)
</span><span class="cx">         return 0;
</span><del>-    CSSParser parser(CSSStrictMode);
-    std::unique_ptr&lt;SourceSizeList&gt; sourceSizeList = parser.parseSizesAttribute(sizesAttribute);
-    if (!sourceSizeList)
-        return defaultValue(view-&gt;style(), view);
-    return sourceSizeList-&gt;getEffectiveSize(view-&gt;style(), view, frame);
-}
-
-unsigned SourceSizeList::getEffectiveSize(RenderStyle&amp; style, RenderView* view, Frame* frame)
-{
-    for (int i = m_list.size() - 1; i &gt;= 0; --i) {
-        SourceSize* sourceSize = m_list[i].get();
-        if (sourceSize-&gt;match(style, frame))
-            return sourceSize-&gt;length(style, view);
</del><ins>+    RenderStyle&amp; style = view-&gt;style();
+    for (auto&amp; sourceSize : CSSParser(CSSStrictMode).parseSizesAttribute(sizesAttribute)) {
+        if (match(WTF::move(sourceSize.expression), style, frame))
+            return computeLength(sourceSize.length.get(), style, view);
</ins><span class="cx">     }
</span><del>-    return defaultValue(style, view);
</del><ins>+    return computeLength(CSSPrimitiveValue::create(100, CSSPrimitiveValue::CSS_VW).ptr(), style, view);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> #endif
</span></span></pre></div>
<a id="trunkSourceWebCorecssSourceSizeListh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/css/SourceSizeList.h (179475 => 179476)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/css/SourceSizeList.h        2015-02-02 17:06:19 UTC (rev 179475)
+++ trunk/Source/WebCore/css/SourceSizeList.h        2015-02-02 18:12:32 UTC (rev 179476)
</span><span class="lines">@@ -1,5 +1,6 @@
</span><span class="cx"> /*
</span><span class="cx">  * Copyright (C) 2014 Yoav Weiss &lt;yoav@yoav.ws&gt;
</span><ins>+ * Copyright (C) 2015 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * This library is free software; you can redistribute it and/or
</span><span class="cx">  * modify it under the terms of the GNU Library General Public
</span><span class="lines">@@ -20,51 +21,15 @@
</span><span class="cx"> #ifndef SourceSizeList_h
</span><span class="cx"> #define SourceSizeList_h
</span><span class="cx"> 
</span><del>-#if ENABLE(PICTURE_SIZES)
</del><ins>+#include &lt;wtf/Forward.h&gt;
</ins><span class="cx"> 
</span><del>-#include &quot;CSSParserValues.h&quot;
-#include &quot;MediaQueryExp.h&quot;
-#include &lt;memory&gt;
-
</del><span class="cx"> namespace WebCore {
</span><span class="cx"> 
</span><del>-class RenderStyle;
-class RenderView;
</del><span class="cx"> class Frame;
</span><ins>+class RenderView;
</ins><span class="cx"> 
</span><del>-class SourceSize {
-public:
-    SourceSize(std::unique_ptr&lt;MediaQueryExp&gt; mediaExp, const CSSParserValue&amp; length)
-        : m_mediaExp(WTF::move(mediaExp))
-        , m_length(length)
-    {
-    }
</del><ins>+unsigned parseSizesAttribute(StringView sizesAttribute, RenderView*, Frame*);
</ins><span class="cx"> 
</span><del>-    bool match(RenderStyle&amp;, Frame*);
-    unsigned length(RenderStyle&amp;, RenderView*);
-
-private:
-    std::unique_ptr&lt;MediaQueryExp&gt; m_mediaExp;
-    CSSParserValue m_length;
-};
-
-class SourceSizeList {
-public:
-    void append(std::unique_ptr&lt;SourceSize&gt; sourceSize)
-    {
-        m_list.append(WTF::move(sourceSize));
-    }
-
-    static unsigned parseSizesAttribute(const String&amp; sizesAttribute, RenderView*, Frame*);
-    unsigned getEffectiveSize(RenderStyle&amp;, RenderView*, Frame*);
-
-private:
-    Vector&lt;std::unique_ptr&lt;SourceSize&gt;&gt; m_list;
-};
-
</del><span class="cx"> } // namespace WebCore
</span><span class="cx"> 
</span><del>-#endif // ENABLE(PICTURE_SIZES)
-
</del><span class="cx"> #endif // SourceSizeList_h
</span><del>-
</del></span></pre></div>
<a id="trunkSourceWebCorehtmlHTMLImageElementcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/html/HTMLImageElement.cpp (179475 => 179476)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/html/HTMLImageElement.cpp        2015-02-02 17:06:19 UTC (rev 179475)
+++ trunk/Source/WebCore/html/HTMLImageElement.cpp        2015-02-02 18:12:32 UTC (rev 179476)
</span><span class="lines">@@ -143,10 +143,7 @@
</span><span class="cx">         if (is&lt;RenderImage&gt;(renderer()))
</span><span class="cx">             downcast&lt;RenderImage&gt;(*renderer()).updateAltText();
</span><span class="cx">     } else if (name == srcAttr || name == srcsetAttr) {
</span><del>-        unsigned sourceSize = 0;
-#if ENABLE(PICTURE_SIZES)
-        sourceSize = SourceSizeList::parseSizesAttribute(fastGetAttribute(sizesAttr), document().renderView(), document().frame());
-#endif
</del><ins>+        unsigned sourceSize = parseSizesAttribute(fastGetAttribute(sizesAttr).string(), document().renderView(), document().frame());
</ins><span class="cx">         ImageCandidate candidate = bestFitSourceForImageAttributes(document().deviceScaleFactor(), fastGetAttribute(srcAttr), fastGetAttribute(srcsetAttr), sourceSize);
</span><span class="cx">         setBestFitURLAndDPRFromImageCandidate(candidate);
</span><span class="cx">         m_imageLoader.updateFromElementIgnoringPreviousError();
</span></span></pre></div>
<a id="trunkSourceWebCorehtmlparserHTMLPreloadScannercpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/html/parser/HTMLPreloadScanner.cpp (179475 => 179476)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/html/parser/HTMLPreloadScanner.cpp        2015-02-02 17:06:19 UTC (rev 179475)
+++ trunk/Source/WebCore/html/parser/HTMLPreloadScanner.cpp        2015-02-02 18:12:32 UTC (rev 179476)
</span><span class="lines">@@ -107,12 +107,7 @@
</span><span class="cx"> 
</span><span class="cx">         // Resolve between src and srcSet if we have them.
</span><span class="cx">         if (!m_srcSetAttribute.isEmpty()) {
</span><del>-            unsigned sourceSize = 0;
-#if ENABLE(PICTURE_SIZES)
-            sourceSize = SourceSizeList::parseSizesAttribute(m_sizesAttribute, document.renderView(), document.frame());
-#else
-            UNUSED_PARAM(document);
-#endif
</del><ins>+            unsigned sourceSize = parseSizesAttribute(m_sizesAttribute, document.renderView(), document.frame());
</ins><span class="cx">             ImageCandidate imageCandidate = bestFitSourceForImageAttributes(m_deviceScaleFactor, m_urlToLoad, m_srcSetAttribute, sourceSize);
</span><span class="cx">             setUrlToLoad(imageCandidate.string.toString(), true);
</span><span class="cx">         }
</span></span></pre>
</div>
</div>

</body>
</html>