The elements in ShadowDOM of meter or progress should not be modifiable.
https://bugs.webkit.org/show_bug.cgi?id=92199

Reviewed by Hajime Morita.

Source/WebCore:

A user can set -webkit-user-modify: read-write to the elements in Shadow DOM in a meter or progress element.
This might cause a undesired crash like Bug 65738. They should be unmodifiable.

We add default css values to elements in ShadowDOM of meter or progress to prohibit editing them.

Tests: fast/html/meter-user-modify.html
       fast/html/progress-user-modify.html

* css/html.css:
Added -webkit-user-modify: read-only !important; for these elements so that they won't be
changed by a user.
(meter::-webkit-meter-bar):
(meter::-webkit-meter-optimum-value):
(meter::-webkit-meter-suboptimum-value):
(meter::-webkit-meter-even-less-good-value):
(progress::-webkit-progress-bar):
(progress::-webkit-progress-value):

LayoutTests:

* fast/html/meter-user-modify.html: Added.
* fast/html/meter-user-modify-expected.txt: Added.
* fast/html/progress-user-modify.html: Added.
* fast/html/progress-user-modify-expected.txt: Added.


git-svn-id: svn://svn.chromium.org/blink/trunk@123704 bbb929c8-8fbe-4397-9dbb-9b2b20218538
diff --git a/Source/WebCore/css/html.css b/Source/WebCore/css/html.css
index c2ce5c8..e5ad78c 100644
--- a/Source/WebCore/css/html.css
+++ b/Source/WebCore/css/html.css
@@ -819,24 +819,28 @@
     background: -webkit-gradient(linear, left top, left bottom, from(#ddd), to(#ddd), color-stop(0.20, #eee), color-stop(0.45, #ccc), color-stop(0.55, #ccc));
     height: 100%;
     width: 100%;
+    -webkit-user-modify: read-only !important;
     -webkit-box-sizing: border-box;
 }
 
 meter::-webkit-meter-optimum-value {
     background: -webkit-gradient(linear, left top, left bottom, from(#ad7), to(#ad7), color-stop(0.20, #cea), color-stop(0.45, #7a3), color-stop(0.55, #7a3));
     height: 100%;
+    -webkit-user-modify: read-only !important;
     -webkit-box-sizing: border-box;
 }
 
 meter::-webkit-meter-suboptimum-value {
     background: -webkit-gradient(linear, left top, left bottom, from(#fe7), to(#fe7), color-stop(0.20, #ffc), color-stop(0.45, #db3), color-stop(0.55, #db3));
     height: 100%;
+    -webkit-user-modify: read-only !important;
     -webkit-box-sizing: border-box;
 }
 
 meter::-webkit-meter-even-less-good-value {
     background: -webkit-gradient(linear, left top, left bottom, from(#f77), to(#f77), color-stop(0.20, #fcc), color-stop(0.45, #d44), color-stop(0.55, #d44));
     height: 100%;
+    -webkit-user-modify: read-only !important;
     -webkit-box-sizing: border-box;
 }
 #endif
@@ -857,6 +861,7 @@
     background-color: gray;
     height: 100%;
     width: 100%;
+    -webkit-user-modify: read-only !important;
     -webkit-box-sizing: border-box;
 }
 
@@ -864,6 +869,7 @@
     background-color: green;
     height: 100%;
     width: 50%; /* should be removed later */
+    -webkit-user-modify: read-only !important;
     -webkit-box-sizing: border-box;
 }
 #endif