Changeset 176301 in webkit

Timestamp:

Nov 18, 2014 6:05:34 PM (9 years ago)

Author:

Chris Dumez

Message:

Crash when setting 'z-index' / 'flex-shrink' CSS properties to a calculated value
​https://bugs.webkit.org/show_bug.cgi?id=138783

Reviewed by Andreas Kling.

Source/WebCore:

Update operators converting CSSPrimitiveValue to integer / floating
point types to properly handle calculated values (e.g. 'calc(2 * 3)').
Previously, this was not working in release builds and we would hit an
ASSERT_NOT_REACHED() in debug builds.

Tests: fast/css/flex-shrink-calculated-value.html

fast/css/z-index-calculated-value.html

• css/CSSPrimitiveValueMappings.h:

(WebCore::CSSPrimitiveValue::operator unsigned short):
(WebCore::CSSPrimitiveValue::operator int):
(WebCore::CSSPrimitiveValue::operator unsigned):
(WebCore::CSSPrimitiveValue::operator float):

LayoutTests:

Add layout tests to check that settings 'z-index' / 'flex-shrink' CSS
properties to a calculated value does not crash and behaves as
expected.

• fast/css/flex-shrink-calculated-value-expected.txt: Added.
• fast/css/flex-shrink-calculated-value.html: Added.
• fast/css/z-index-calculated-value-expected.txt: Added.
• fast/css/z-index-calculated-value.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/css/flex-shrink-calculated-value-expected.txt (added)
• LayoutTests/fast/css/flex-shrink-calculated-value.html (added)
• LayoutTests/fast/css/z-index-calculated-value-expected.txt (added)
• LayoutTests/fast/css/z-index-calculated-value.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/css/CSSPrimitiveValueMappings.h (modified) (4 diffs)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2014-11-18  Chris Dumez  <cdumez@apple.com>
+
+        Crash when setting 'z-index' / 'flex-shrink' CSS properties to a calculated value
+        https://bugs.webkit.org/show_bug.cgi?id=138783
+
+        Reviewed by Andreas Kling.
+
+        Add layout tests to check that settings 'z-index' / 'flex-shrink' CSS
+        properties to a calculated value does not crash and behaves as
+        expected.
+
+        * fast/css/flex-shrink-calculated-value-expected.txt: Added.
+        * fast/css/flex-shrink-calculated-value.html: Added.
+        * fast/css/z-index-calculated-value-expected.txt: Added.
+        * fast/css/z-index-calculated-value.html: Added.
+
 2014-11-18  Commit Queue  <commit-queue@webkit.org>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2014-11-18  Chris Dumez  <cdumez@apple.com>
+
+        Crash when setting 'z-index' / 'flex-shrink' CSS properties to a calculated value
+        https://bugs.webkit.org/show_bug.cgi?id=138783
+
+        Reviewed by Andreas Kling.
+
+        Update operators converting CSSPrimitiveValue to integer / floating
+        point types to properly handle calculated values (e.g. 'calc(2 * 3)').
+        Previously, this was not working in release builds and we would hit an
+        ASSERT_NOT_REACHED() in debug builds.
+
+        Tests: fast/css/flex-shrink-calculated-value.html
+               fast/css/z-index-calculated-value.html
+
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::operator unsigned short):
+        (WebCore::CSSPrimitiveValue::operator int):
+        (WebCore::CSSPrimitiveValue::operator unsigned):
+        (WebCore::CSSPrimitiveValue::operator float):
+
 2014-11-18  Commit Queue  <commit-queue@webkit.org>
 

trunk/Source/WebCore/css/CSSPrimitiveValueMappings.h

@@ -83 +83 @@
 template<> inline CSSPrimitiveValue::operator unsigned short() const
 {
-    if (m_primitiveUnitType == CSS_NUMBER)
-        return clampTo<unsigned short>(m_value.num);
+    if (primitiveType() == CSS_NUMBER)
+        return getValue<unsigned short>();
 
     ASSERT_NOT_REACHED();
@@ -92 +92 @@
 template<> inline CSSPrimitiveValue::operator int() const
 {
-    if (m_primitiveUnitType == CSS_NUMBER)
-        return clampTo<int>(m_value.num);
+    if (primitiveType() == CSS_NUMBER)
+        return getValue<int>();
 
     ASSERT_NOT_REACHED();
@@ -101 +101 @@
 template<> inline CSSPrimitiveValue::operator unsigned() const
 {
-    if (m_primitiveUnitType == CSS_NUMBER)
-        return clampTo<unsigned>(m_value.num);
+    if (primitiveType() == CSS_NUMBER)
+        return getValue<unsigned>();
 
     ASSERT_NOT_REACHED();
@@ -118 +118 @@
 template<> inline CSSPrimitiveValue::operator float() const
 {
-    if (m_primitiveUnitType == CSS_NUMBER)
-        return clampTo<float>(m_value.num);
+    if (primitiveType() == CSS_NUMBER)
+        return getValue<float>();
 
     ASSERT_NOT_REACHED();