<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[206744] trunk</title>
</head>
<body>
<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; }
#msg dl a { font-weight: bold}
#msg dl a:link { color:#fc3; }
#msg dl a:active { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/206744">206744</a></dd>
<dt>Author</dt> <dd>aestes@apple.com</dd>
<dt>Date</dt> <dd>2016-10-03 13:27:33 -0700 (Mon, 03 Oct 2016)</dd>
</dl>
<h3>Log Message</h3>
<pre>ASSERTION FAILED: url.containsOnlyASCII() in WebCore::checkEncodedString() when parsing an invalid CSS cursor URL
https://bugs.webkit.org/show_bug.cgi?id=162763
<rdar://problem/28572758>
Reviewed by Youenn Fablet.
Source/WebCore:
CSSCursorImageValue copies the URL of its underlying CSSImageValue by using the
ParsedURLString URL constructor on the String returned by CSSImageValue::url(). While
CSSImageValues were always being constructed from a URL implicitly converted to a String,
nothing ensured that the URL was valid. For invalid URLs, URL::string() returns the string
it was constructed with, which might still represent a relative URL or contain non-ASCII
characters, violating the preconditions of the ParsedURLString URL constructor and causing
an assertion to fail in Debug builds.
Fix this by having CSSImageValue store its image URL using a WebCore::URL rather than a
String. CSSCursorImageValue can then copy this URL instead of attempting to re-parse a
possibly-invalid URL string.
Test: fast/css/cursor-with-invalid-url.html
* css/CSSCursorImageValue.cpp:
(WebCore::CSSCursorImageValue::CSSCursorImageValue): Copied m_imageValue.url() into
m_originalURL instead of using the ParsedURLString URL constructor, since
CSSImageValue::url() now returns a WebCore::URL.
(WebCore::CSSCursorImageValue::loadImage): Created a URL from cursorElement->href() by
calling Document::completeURL().
* css/CSSImageValue.cpp:
(WebCore::CSSImageValue::CSSImageValue): Changed to take a URL&& instead of a const String&.
(WebCore::CSSImageValue::loadImage): Stopped calling Document::completeURL(), since m_url is
now a WebCore::URL.
* css/CSSImageValue.h: Changed url() to return a const URL&, and changed m_url to be a URL.
* html/HTMLBodyElement.cpp:
(WebCore::HTMLBodyElement::collectStyleForPresentationAttribute): Removed a call to
URL::string().
* html/HTMLTableElement.cpp:
(WebCore::HTMLTableElement::collectStyleForPresentationAttribute): Ditto.
* html/HTMLTablePartElement.cpp:
(WebCore::HTMLTablePartElement::collectStyleForPresentationAttribute): Ditto.
LayoutTests:
* fast/css/cursor-with-invalid-url.html: Added.
* fast/css/cursor-with-invalid-url-expected.txt: Added.</pre>
<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkLayoutTestsChangeLog">trunk/LayoutTests/ChangeLog</a></li>
<li><a href="#trunkSourceWebCoreChangeLog">trunk/Source/WebCore/ChangeLog</a></li>
<li><a href="#trunkSourceWebCorecssCSSCursorImageValuecpp">trunk/Source/WebCore/css/CSSCursorImageValue.cpp</a></li>
<li><a href="#trunkSourceWebCorecssCSSImageValuecpp">trunk/Source/WebCore/css/CSSImageValue.cpp</a></li>
<li><a href="#trunkSourceWebCorecssCSSImageValueh">trunk/Source/WebCore/css/CSSImageValue.h</a></li>
<li><a href="#trunkSourceWebCorehtmlHTMLBodyElementcpp">trunk/Source/WebCore/html/HTMLBodyElement.cpp</a></li>
<li><a href="#trunkSourceWebCorehtmlHTMLTableElementcpp">trunk/Source/WebCore/html/HTMLTableElement.cpp</a></li>
<li><a href="#trunkSourceWebCorehtmlHTMLTablePartElementcpp">trunk/Source/WebCore/html/HTMLTablePartElement.cpp</a></li>
</ul>
<h3>Added Paths</h3>
<ul>
<li><a href="#trunkLayoutTestsfastcsscursorwithinvalidurlexpectedtxt">trunk/LayoutTests/fast/css/cursor-with-invalid-url-expected.txt</a></li>
<li><a href="#trunkLayoutTestsfastcsscursorwithinvalidurlhtml">trunk/LayoutTests/fast/css/cursor-with-invalid-url.html</a></li>
</ul>
</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkLayoutTestsChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/ChangeLog (206743 => 206744)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/ChangeLog 2016-10-03 20:26:00 UTC (rev 206743)
+++ trunk/LayoutTests/ChangeLog 2016-10-03 20:27:33 UTC (rev 206744)
</span><span class="lines">@@ -1,5 +1,16 @@
</span><span class="cx"> 2016-10-03 Andy Estes <aestes@apple.com>
</span><span class="cx">
</span><ins>+ ASSERTION FAILED: url.containsOnlyASCII() in WebCore::checkEncodedString() when parsing an invalid CSS cursor URL
+ https://bugs.webkit.org/show_bug.cgi?id=162763
+ <rdar://problem/28572758>
+
+ Reviewed by Youenn Fablet.
+
+ * fast/css/cursor-with-invalid-url.html: Added.
+ * fast/css/cursor-with-invalid-url-expected.txt: Added.
+
+2016-10-03 Andy Estes <aestes@apple.com>
+
</ins><span class="cx"> ASSERTION FAILED: result in WebCore::CSSParser::parseURI
</span><span class="cx"> https://bugs.webkit.org/show_bug.cgi?id=141638
</span><span class="cx"> <rdar://problem/27709952>
</span></span></pre></div>
<a id="trunkLayoutTestsfastcsscursorwithinvalidurlexpectedtxt"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/fast/css/cursor-with-invalid-url-expected.txt (0 => 206744)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/fast/css/cursor-with-invalid-url-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/css/cursor-with-invalid-url-expected.txt 2016-10-03 20:27:33 UTC (rev 206744)
</span><span class="lines">@@ -0,0 +1 @@
</span><ins>+Test that a cursor with an invalid CSS URL does not trigger an assertion in a Debug build.
</ins></span></pre></div>
<a id="trunkLayoutTestsfastcsscursorwithinvalidurlhtml"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/fast/css/cursor-with-invalid-url.html (0 => 206744)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/fast/css/cursor-with-invalid-url.html (rev 0)
+++ trunk/LayoutTests/fast/css/cursor-with-invalid-url.html 2016-10-03 20:27:33 UTC (rev 206744)
</span><span class="lines">@@ -0,0 +1,17 @@
</span><ins>+<!DOCTYPE html>
+<html>
+<head>
+ <script>
+ if (window.testRunner)
+ testRunner.dumpAsText();
+ </script>
+ <style>
+ body {
+ cursor: url(scheme://host:80\ff);
+ }
+ </style>
+</head>
+<body>
+Test that a cursor with an invalid CSS URL does not trigger an assertion in a Debug build.
+</body>
+</html>
</ins></span></pre></div>
<a id="trunkSourceWebCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/ChangeLog (206743 => 206744)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/ChangeLog 2016-10-03 20:26:00 UTC (rev 206743)
+++ trunk/Source/WebCore/ChangeLog 2016-10-03 20:27:33 UTC (rev 206744)
</span><span class="lines">@@ -1,3 +1,44 @@
</span><ins>+2016-10-03 Andy Estes <aestes@apple.com>
+
+ ASSERTION FAILED: url.containsOnlyASCII() in WebCore::checkEncodedString() when parsing an invalid CSS cursor URL
+ https://bugs.webkit.org/show_bug.cgi?id=162763
+ <rdar://problem/28572758>
+
+ Reviewed by Youenn Fablet.
+
+ CSSCursorImageValue copies the URL of its underlying CSSImageValue by using the
+ ParsedURLString URL constructor on the String returned by CSSImageValue::url(). While
+ CSSImageValues were always being constructed from a URL implicitly converted to a String,
+ nothing ensured that the URL was valid. For invalid URLs, URL::string() returns the string
+ it was constructed with, which might still represent a relative URL or contain non-ASCII
+ characters, violating the preconditions of the ParsedURLString URL constructor and causing
+ an assertion to fail in Debug builds.
+
+ Fix this by having CSSImageValue store its image URL using a WebCore::URL rather than a
+ String. CSSCursorImageValue can then copy this URL instead of attempting to re-parse a
+ possibly-invalid URL string.
+
+ Test: fast/css/cursor-with-invalid-url.html
+
+ * css/CSSCursorImageValue.cpp:
+ (WebCore::CSSCursorImageValue::CSSCursorImageValue): Copied m_imageValue.url() into
+ m_originalURL instead of using the ParsedURLString URL constructor, since
+ CSSImageValue::url() now returns a WebCore::URL.
+ (WebCore::CSSCursorImageValue::loadImage): Created a URL from cursorElement->href() by
+ calling Document::completeURL().
+ * css/CSSImageValue.cpp:
+ (WebCore::CSSImageValue::CSSImageValue): Changed to take a URL&& instead of a const String&.
+ (WebCore::CSSImageValue::loadImage): Stopped calling Document::completeURL(), since m_url is
+ now a WebCore::URL.
+ * css/CSSImageValue.h: Changed url() to return a const URL&, and changed m_url to be a URL.
+ * html/HTMLBodyElement.cpp:
+ (WebCore::HTMLBodyElement::collectStyleForPresentationAttribute): Removed a call to
+ URL::string().
+ * html/HTMLTableElement.cpp:
+ (WebCore::HTMLTableElement::collectStyleForPresentationAttribute): Ditto.
+ * html/HTMLTablePartElement.cpp:
+ (WebCore::HTMLTablePartElement::collectStyleForPresentationAttribute): Ditto.
+
</ins><span class="cx"> 2016-10-03 Zalan Bujtas <zalan@apple.com>
</span><span class="cx">
</span><span class="cx"> Log an error to stderr when FrameView::layout() fails to clean all the renderers.
</span></span></pre></div>
<a id="trunkSourceWebCorecssCSSCursorImageValuecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/css/CSSCursorImageValue.cpp (206743 => 206744)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/css/CSSCursorImageValue.cpp 2016-10-03 20:26:00 UTC (rev 206743)
+++ trunk/Source/WebCore/css/CSSCursorImageValue.cpp 2016-10-03 20:27:33 UTC (rev 206744)
</span><span class="lines">@@ -44,7 +44,7 @@
</span><span class="cx"> , m_hotSpot(hotSpot)
</span><span class="cx"> {
</span><span class="cx"> if (is<CSSImageValue>(m_imageValue.get()))
</span><del>- m_originalURL = { ParsedURLString, downcast<CSSImageValue>(m_imageValue.get()).url() };
</del><ins>+ m_originalURL = downcast<CSSImageValue>(m_imageValue.get()).url();
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> CSSCursorImageValue::~CSSCursorImageValue()
</span><span class="lines">@@ -107,7 +107,7 @@
</span><span class="cx">
</span><span class="cx"> if (auto* cursorElement = updateCursorElement(*loader.document())) {
</span><span class="cx"> if (cursorElement->href() != downcast<CSSImageValue>(m_imageValue.get()).url())
</span><del>- m_imageValue = CSSImageValue::create(cursorElement->href());
</del><ins>+ m_imageValue = CSSImageValue::create(loader.document()->completeURL(cursorElement->href()));
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> return { downcast<CSSImageValue>(m_imageValue.get()).loadImage(loader, options), 1 };
</span></span></pre></div>
<a id="trunkSourceWebCorecssCSSImageValuecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/css/CSSImageValue.cpp (206743 => 206744)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/css/CSSImageValue.cpp 2016-10-03 20:26:00 UTC (rev 206743)
+++ trunk/Source/WebCore/css/CSSImageValue.cpp 2016-10-03 20:27:33 UTC (rev 206744)
</span><span class="lines">@@ -35,9 +35,9 @@
</span><span class="cx">
</span><span class="cx"> namespace WebCore {
</span><span class="cx">
</span><del>-CSSImageValue::CSSImageValue(const String& url)
</del><ins>+CSSImageValue::CSSImageValue(URL&& url)
</ins><span class="cx"> : CSSValue(ImageClass)
</span><del>- , m_url(url)
</del><ins>+ , m_url(WTFMove(url))
</ins><span class="cx"> , m_accessedImage(false)
</span><span class="cx"> {
</span><span class="cx"> }
</span><span class="lines">@@ -65,7 +65,7 @@
</span><span class="cx"> if (!m_accessedImage) {
</span><span class="cx"> m_accessedImage = true;
</span><span class="cx">
</span><del>- CachedResourceRequest request(ResourceRequest(loader.document()->completeURL(m_url)), options);
</del><ins>+ CachedResourceRequest request(ResourceRequest(m_url), options);
</ins><span class="cx"> if (m_initiatorName.isEmpty())
</span><span class="cx"> request.setInitiator(cachedResourceRequestInitiators().css);
</span><span class="cx"> else
</span></span></pre></div>
<a id="trunkSourceWebCorecssCSSImageValueh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/css/CSSImageValue.h (206743 => 206744)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/css/CSSImageValue.h 2016-10-03 20:26:00 UTC (rev 206743)
+++ trunk/Source/WebCore/css/CSSImageValue.h 2016-10-03 20:27:33 UTC (rev 206744)
</span><span class="lines">@@ -18,24 +18,22 @@
</span><span class="cx"> * Boston, MA 02110-1301, USA.
</span><span class="cx"> */
</span><span class="cx">
</span><del>-#ifndef CSSImageValue_h
-#define CSSImageValue_h
</del><ins>+#pragma once
</ins><span class="cx">
</span><span class="cx"> #include "CSSValue.h"
</span><span class="cx"> #include "CachedResourceHandle.h"
</span><del>-#include <wtf/RefPtr.h>
</del><ins>+#include <wtf/Ref.h>
</ins><span class="cx">
</span><span class="cx"> namespace WebCore {
</span><span class="cx">
</span><span class="cx"> class CachedImage;
</span><span class="cx"> class CachedResourceLoader;
</span><del>-class Element;
</del><span class="cx"> class RenderElement;
</span><span class="cx"> struct ResourceLoaderOptions;
</span><span class="cx">
</span><span class="cx"> class CSSImageValue final : public CSSValue {
</span><span class="cx"> public:
</span><del>- static Ref<CSSImageValue> create(const String& url) { return adoptRef(*new CSSImageValue(url)); }
</del><ins>+ static Ref<CSSImageValue> create(URL&& url) { return adoptRef(*new CSSImageValue(WTFMove(url))); }
</ins><span class="cx"> static Ref<CSSImageValue> create(CachedImage& image) { return adoptRef(*new CSSImageValue(image)); }
</span><span class="cx"> ~CSSImageValue();
</span><span class="cx">
</span><span class="lines">@@ -43,7 +41,7 @@
</span><span class="cx"> CachedImage* loadImage(CachedResourceLoader&, const ResourceLoaderOptions&);
</span><span class="cx"> CachedImage* cachedImage() const { return m_cachedImage.get(); }
</span><span class="cx">
</span><del>- const String& url() const { return m_url; }
</del><ins>+ const URL& url() const { return m_url; }
</ins><span class="cx">
</span><span class="cx"> String customCSSText() const;
</span><span class="cx">
</span><span class="lines">@@ -58,10 +56,10 @@
</span><span class="cx"> void setInitiator(const AtomicString& name) { m_initiatorName = name; }
</span><span class="cx">
</span><span class="cx"> private:
</span><del>- explicit CSSImageValue(const String& url);
</del><ins>+ explicit CSSImageValue(URL&&);
</ins><span class="cx"> explicit CSSImageValue(CachedImage&);
</span><span class="cx">
</span><del>- String m_url;
</del><ins>+ URL m_url;
</ins><span class="cx"> CachedResourceHandle<CachedImage> m_cachedImage;
</span><span class="cx"> bool m_accessedImage;
</span><span class="cx"> AtomicString m_initiatorName;
</span><span class="lines">@@ -70,5 +68,3 @@
</span><span class="cx"> } // namespace WebCore
</span><span class="cx">
</span><span class="cx"> SPECIALIZE_TYPE_TRAITS_CSS_VALUE(CSSImageValue, isImageValue())
</span><del>-
-#endif // CSSImageValue_h
</del></span></pre></div>
<a id="trunkSourceWebCorehtmlHTMLBodyElementcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/html/HTMLBodyElement.cpp (206743 => 206744)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/html/HTMLBodyElement.cpp 2016-10-03 20:26:00 UTC (rev 206743)
+++ trunk/Source/WebCore/html/HTMLBodyElement.cpp 2016-10-03 20:27:33 UTC (rev 206744)
</span><span class="lines">@@ -82,7 +82,7 @@
</span><span class="cx"> if (name == backgroundAttr) {
</span><span class="cx"> String url = stripLeadingAndTrailingHTMLSpaces(value);
</span><span class="cx"> if (!url.isEmpty()) {
</span><del>- auto imageValue = CSSImageValue::create(document().completeURL(url).string());
</del><ins>+ auto imageValue = CSSImageValue::create(document().completeURL(url));
</ins><span class="cx"> imageValue.get().setInitiator(localName());
</span><span class="cx"> style.setProperty(CSSProperty(CSSPropertyBackgroundImage, WTFMove(imageValue)));
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceWebCorehtmlHTMLTableElementcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/html/HTMLTableElement.cpp (206743 => 206744)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/html/HTMLTableElement.cpp 2016-10-03 20:26:00 UTC (rev 206743)
+++ trunk/Source/WebCore/html/HTMLTableElement.cpp 2016-10-03 20:27:33 UTC (rev 206744)
</span><span class="lines">@@ -332,7 +332,7 @@
</span><span class="cx"> else if (name == backgroundAttr) {
</span><span class="cx"> String url = stripLeadingAndTrailingHTMLSpaces(value);
</span><span class="cx"> if (!url.isEmpty())
</span><del>- style.setProperty(CSSProperty(CSSPropertyBackgroundImage, CSSImageValue::create(document().completeURL(url).string())));
</del><ins>+ style.setProperty(CSSProperty(CSSPropertyBackgroundImage, CSSImageValue::create(document().completeURL(url))));
</ins><span class="cx"> } else if (name == valignAttr) {
</span><span class="cx"> if (!value.isEmpty())
</span><span class="cx"> addPropertyToPresentationAttributeStyle(style, CSSPropertyVerticalAlign, value);
</span></span></pre></div>
<a id="trunkSourceWebCorehtmlHTMLTablePartElementcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/html/HTMLTablePartElement.cpp (206743 => 206744)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/html/HTMLTablePartElement.cpp 2016-10-03 20:26:00 UTC (rev 206743)
+++ trunk/Source/WebCore/html/HTMLTablePartElement.cpp 2016-10-03 20:27:33 UTC (rev 206744)
</span><span class="lines">@@ -52,7 +52,7 @@
</span><span class="cx"> else if (name == backgroundAttr) {
</span><span class="cx"> String url = stripLeadingAndTrailingHTMLSpaces(value);
</span><span class="cx"> if (!url.isEmpty())
</span><del>- style.setProperty(CSSProperty(CSSPropertyBackgroundImage, CSSImageValue::create(document().completeURL(url).string())));
</del><ins>+ style.setProperty(CSSProperty(CSSPropertyBackgroundImage, CSSImageValue::create(document().completeURL(url))));
</ins><span class="cx"> } else if (name == valignAttr) {
</span><span class="cx"> if (equalLettersIgnoringASCIICase(value, "top"))
</span><span class="cx"> addPropertyToPresentationAttributeStyle(style, CSSPropertyVerticalAlign, CSSValueTop);
</span></span></pre>
</div>
</div>
</body>
</html>