4 files changed, 26 insertions, 12 deletions

diff --git a/Source/WebCore/css/CSSParser.cpp b/Source/WebCore/css/CSSParser.cpp
index b78a6d0..06e895d 100644
--- a/Source/WebCore/css/CSSParser.cpp
+++ b/Source/WebCore/css/CSSParser.cpp
@@ -5383,6 +5383,8 @@ bool CSSParser::parseRadialGradient(RefPtr<CSSValue>& gradient, CSSGradientRepea
     // parseFillPosition advances the args next pointer.
     parseFillPosition(args, centerX, centerY);
     a = args->current();
+    if (!a)
+        return false;
     
     if (centerX || centerY) {
         // Comma
diff --git a/Source/WebCore/css/CSSPrimitiveValue.cpp b/Source/WebCore/css/CSSPrimitiveValue.cpp
index 04f1089..237844e 100644
--- a/Source/WebCore/css/CSSPrimitiveValue.cpp
+++ b/Source/WebCore/css/CSSPrimitiveValue.cpp
@@ -316,7 +316,8 @@ double CSSPrimitiveValue::computeLengthDouble(RenderStyle* style, RenderStyle* r
             break;
         case CSS_REMS:
             applyZoomMultiplier = false;
-            factor = computingFontSize ? rootStyle->fontDescription().specifiedSize() : rootStyle->fontDescription().computedSize();
+            if (rootStyle)
+                factor = computingFontSize ? rootStyle->fontDescription().specifiedSize() : rootStyle->fontDescription().computedSize();
             break;
         case CSS_PX:
             break;
diff --git a/Source/WebCore/css/CSSStyleSelector.cpp b/Source/WebCore/css/CSSStyleSelector.cpp
index 0b6fd35..e49ad2a 100644
--- a/Source/WebCore/css/CSSStyleSelector.cpp
+++ b/Source/WebCore/css/CSSStyleSelector.cpp
@@ -1194,7 +1194,8 @@ PassRefPtr<RenderStyle> CSSStyleSelector::styleForDocument(Document* document)
     documentStyle->setVisuallyOrdered(document->visuallyOrdered());
     documentStyle->setZoom(frame ? frame->pageZoomFactor() : 1);
     documentStyle->setPageScaleTransform(frame ? frame->pageScaleFactor() : 1);
-    
+    documentStyle->setUserModify(document->inDesignMode() ? READ_WRITE : READ_ONLY);
+
     Element* docElement = document->documentElement();
     RenderObject* docElementRenderer = docElement ? docElement->renderer() : 0;
     if (docElementRenderer) {
@@ -1236,6 +1237,15 @@ PassRefPtr<RenderStyle> CSSStyleSelector::styleForDocument(Document* document)
     return documentStyle.release();
 }
 
+static inline bool isAtShadowBoundary(Element* element)
+{
+    if (!element)
+        return false;
+
+    ContainerNode* parentNode = element->parentNode();
+    return parentNode && parentNode->isShadowBoundary();
+}
+
 // If resolveForRootDefault is true, style based on user agent style sheet only. This is used in media queries, where
 // relative units are interpreted according to document root element style, styled only with UA stylesheet
 
@@ -1278,6 +1288,10 @@ PassRefPtr<RenderStyle> CSSStyleSelector::styleForElement(Element* e, RenderStyl
         initForStyleResolve(e, defaultParent);
     }
 
+    // Don't propagate user-modify into shadow DOM
+    if (isAtShadowBoundary(e))
+        m_style->setUserModify(RenderStyle::initialUserModify());
+
     m_checker.m_matchVisitedPseudoClass = matchVisitedPseudoClass;
 
     m_style = RenderStyle::create();
@@ -1772,15 +1786,6 @@ static void addIntrinsicMargins(RenderStyle* style)
     }
 }
 
-static inline bool isAtShadowBoundary(Element* element)
-{
-    if (!element)
-        return false;
-
-    ContainerNode* parentNode = element->parentNode();
-    return parentNode && parentNode->isShadowBoundary();
-}
-
 void CSSStyleSelector::adjustRenderStyle(RenderStyle* style, RenderStyle* parentStyle, Element *e)
 {
     // Cache our original display.
@@ -4966,6 +4971,11 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
             applyProperty(CSSPropertyFontStyle, font->style.get());
             applyProperty(CSSPropertyFontVariant, font->variant.get());
             applyProperty(CSSPropertyFontWeight, font->weight.get());
+            // The previous properties can dirty our font but they don't try to read the font's
+            // properties back, which is safe. However if font-size is using the 'ex' unit, it will
+            // need query the dirtied font's x-height to get the computed size. To be safe in this
+            // case, let's just update the font now.
+            updateFont();
             applyProperty(CSSPropertyFontSize, font->size.get());
 
             m_lineHeightValue = font->lineHeight.get();
diff --git a/Source/WebCore/css/WebKitCSSKeyframesRule.cpp b/Source/WebCore/css/WebKitCSSKeyframesRule.cpp
index 3b41f43..497bd19 100644
--- a/Source/WebCore/css/WebKitCSSKeyframesRule.cpp
+++ b/Source/WebCore/css/WebKitCSSKeyframesRule.cpp
@@ -66,7 +66,8 @@ void WebKitCSSKeyframesRule::setName(const String& name)
     
     // Since the name is used in the keyframe map list in CSSStyleSelector, we need
     // to recompute the style sheet to get the updated name.
-    stylesheet()->styleSheetChanged();
+    if (stylesheet())
+        stylesheet()->styleSheetChanged();
 }
 
 unsigned WebKitCSSKeyframesRule::length() const