Changeset 117748 in webkit

Timestamp:

May 21, 2012, 1:49:27 AM (14 years ago)

Author:

mikelawther@chromium.org

Message:

Crash in -webkit-calc
​https://bugs.webkit.org/show_bug.cgi?id=86954

Reviewed by Abhishek Arya.

Source/WebCore:

Ensure that both ends of a blend are checked for being Calculated. The current
check did not cover the case where the 'from' end was Calculated and nonzero,
and the 'to' end was zero and not Calculated.

Blending doesn't work with calculated expressions and is being tracked in
bug ​http://webkit.org/b/86160

Tests: css3/calc/transition-crash3.html

css3/calc/transition-crash4.html

• platform/Length.h:

(WebCore::Length::blend):

LayoutTests:

• css3/calc/transition-crash3-expected.txt: Added.
• css3/calc/transition-crash3.html: Added.
• css3/calc/transition-crash4-expected.txt: Added.
• css3/calc/transition-crash4.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/css3/calc/transition-crash3-expected.txt (added)
• LayoutTests/css3/calc/transition-crash3.html (added)
• LayoutTests/css3/calc/transition-crash4-expected.txt (added)
• LayoutTests/css3/calc/transition-crash4.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/platform/Length.h (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2012-05-21  Mike Lawther  <mikelawther@chromium.org>
+
+        Crash in -webkit-calc
+        https://bugs.webkit.org/show_bug.cgi?id=86954
+
+        Reviewed by Abhishek Arya.
+
+        * css3/calc/transition-crash3-expected.txt: Added.
+        * css3/calc/transition-crash3.html: Added.
+        * css3/calc/transition-crash4-expected.txt: Added.
+        * css3/calc/transition-crash4.html: Added.
+
 2012-05-21  Sudarsana Nagineni  <sudarsana.nagineni@linux.intel.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2012-05-21  Mike Lawther  <mikelawther@chromium.org>
+
+        Crash in -webkit-calc
+        https://bugs.webkit.org/show_bug.cgi?id=86954
+
+        Reviewed by Abhishek Arya.
+
+        Ensure that both ends of a blend are checked for being Calculated. The current
+        check did not cover the case where the 'from' end was Calculated and nonzero,
+        and the 'to' end was zero and not Calculated. 
+
+        Blending doesn't work with calculated expressions and is being tracked in
+        bug http://webkit.org/b/86160
+
+        Tests: css3/calc/transition-crash3.html
+               css3/calc/transition-crash4.html
+
+        * platform/Length.h:
+        (WebCore::Length::blend):
+
 2012-05-21  Pavel Feldman  <pfeldman@chromium.org>
 

trunk/Source/WebCore/platform/Length.h

@@ -229 +229 @@
 
         // FIXME http://webkit.org/b/86160 - Blending doesn't work with calculated expressions
-        if (type() == Calculated)
+        if (from.type() == Calculated || type() == Calculated)
             return *this;