Title: [117748] trunk
- Revision
- 117748
- Author
- [email protected]
- Date
- 2012-05-21 01:49:27 -0700 (Mon, 21 May 2012)
Log Message
Crash in -webkit-calc
https://bugs.webkit.org/show_bug.cgi?id=86954
Reviewed by Abhishek Arya.
Source/WebCore:
Ensure that both ends of a blend are checked for being Calculated. The current
check did not cover the case where the 'from' end was Calculated and nonzero,
and the 'to' end was zero and not Calculated.
Blending doesn't work with calculated expressions and is being tracked in
bug http://webkit.org/b/86160
Tests: css3/calc/transition-crash3.html
css3/calc/transition-crash4.html
* platform/Length.h:
(WebCore::Length::blend):
LayoutTests:
* css3/calc/transition-crash3-expected.txt: Added.
* css3/calc/transition-crash3.html: Added.
* css3/calc/transition-crash4-expected.txt: Added.
* css3/calc/transition-crash4.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (117747 => 117748)
--- trunk/LayoutTests/ChangeLog 2012-05-21 08:42:53 UTC (rev 117747)
+++ trunk/LayoutTests/ChangeLog 2012-05-21 08:49:27 UTC (rev 117748)
@@ -1,3 +1,15 @@
+2012-05-21 Mike Lawther <[email protected]>
+
+ Crash in -webkit-calc
+ https://bugs.webkit.org/show_bug.cgi?id=86954
+
+ Reviewed by Abhishek Arya.
+
+ * css3/calc/transition-crash3-expected.txt: Added.
+ * css3/calc/transition-crash3.html: Added.
+ * css3/calc/transition-crash4-expected.txt: Added.
+ * css3/calc/transition-crash4.html: Added.
+
2012-05-21 Sudarsana Nagineni <[email protected]>
[EFL] [DRT] Update EFL baselines after r117412 and r117477
Added: trunk/LayoutTests/css3/calc/transition-crash3-expected.txt (0 => 117748)
--- trunk/LayoutTests/css3/calc/transition-crash3-expected.txt (rev 0)
+++ trunk/LayoutTests/css3/calc/transition-crash3-expected.txt 2012-05-21 08:49:27 UTC (rev 117748)
@@ -0,0 +1 @@
+This tests transitioning of elements containing a calc _expression_. The test passes if it does not crash.
Added: trunk/LayoutTests/css3/calc/transition-crash3.html (0 => 117748)
--- trunk/LayoutTests/css3/calc/transition-crash3.html (rev 0)
+++ trunk/LayoutTests/css3/calc/transition-crash3.html 2012-05-21 08:49:27 UTC (rev 117748)
@@ -0,0 +1,40 @@
+<!DOCTYPE html>
+<style>
+ .test {
+ -webkit-transition: width 30s;
+ }
+ .test:nth-child(2n) {
+ width: -webkit-calc(-8em + 59%);
+ }
+</style>
+
+This tests transitioning of elements containing a calc _expression_. The test passes if it does not crash.
+
+<script>
+ if (window.layoutTestController) {
+ layoutTestController.dumpAsText();
+ layoutTestController.waitUntilDone();
+ }
+
+ elementA = document.createElement('a');
+ document.documentElement.appendChild(elementA);
+ elementQ = document.createElement('q');
+ document.documentElement.appendChild(elementQ);
+ elementStrong = document.createElement('strong');
+ document.documentElement.appendChild(elementStrong);
+ elementFieldSet = document.createElement('fieldset');
+ elementFieldSet.setAttribute('class', 'test');
+ document.documentElement.appendChild(elementFieldSet);
+ elementSection = document.createElement('section');
+
+ function boom() {
+ try {
+ elementSection.appendChild(elementQ);
+ } catch (e) {
+ }
+ if (window.layoutTestController)
+ layoutTestController.notifyDone();
+ }
+
+ setTimeout(boom, 1);
+</script>
\ No newline at end of file
Added: trunk/LayoutTests/css3/calc/transition-crash4-expected.txt (0 => 117748)
--- trunk/LayoutTests/css3/calc/transition-crash4-expected.txt (rev 0)
+++ trunk/LayoutTests/css3/calc/transition-crash4-expected.txt 2012-05-21 08:49:27 UTC (rev 117748)
@@ -0,0 +1 @@
+This tests transitioning of elements containing a calc _expression_. The test passes if it does not crash.
Added: trunk/LayoutTests/css3/calc/transition-crash4.html (0 => 117748)
--- trunk/LayoutTests/css3/calc/transition-crash4.html (rev 0)
+++ trunk/LayoutTests/css3/calc/transition-crash4.html 2012-05-21 08:49:27 UTC (rev 117748)
@@ -0,0 +1,37 @@
+<!DOCTYPE html>
+<style>
+ .test {
+ -webkit-transition: height 1s;
+ }
+ .test:nth-child(2n) {
+ height: -webkit-calc(45em - 81%);
+ }
+</style>
+
+This tests transitioning of elements containing a calc _expression_. The test passes if it does not crash.
+
+<script>
+ if (window.layoutTestController) {
+ layoutTestController.dumpAsText();
+ layoutTestController.waitUntilDone();
+ }
+
+ elementBr = document.createElement('br');
+ document.documentElement.appendChild(elementBr);
+ elementAbbr = document.createElement('abbr');
+ document.documentElement.appendChild(elementAbbr);
+ elementColGroup = document.createElement('colgroup');
+ document.documentElement.appendChild(elementColGroup);
+ elementOptGroup = document.createElement('optgroup');
+ elementIframe = document.createElement('iframe');
+ elementIframe.setAttribute('class', 'test');
+ document.documentElement.appendChild(elementIframe);
+
+ function boom() {
+ elementOptGroup.appendChild(elementBr);
+ if (window.layoutTestController)
+ layoutTestController.notifyDone();
+ }
+
+ setTimeout(boom, 1);
+</script>
\ No newline at end of file
Modified: trunk/Source/WebCore/ChangeLog (117747 => 117748)
--- trunk/Source/WebCore/ChangeLog 2012-05-21 08:42:53 UTC (rev 117747)
+++ trunk/Source/WebCore/ChangeLog 2012-05-21 08:49:27 UTC (rev 117748)
@@ -1,3 +1,23 @@
+2012-05-21 Mike Lawther <[email protected]>
+
+ Crash in -webkit-calc
+ https://bugs.webkit.org/show_bug.cgi?id=86954
+
+ Reviewed by Abhishek Arya.
+
+ Ensure that both ends of a blend are checked for being Calculated. The current
+ check did not cover the case where the 'from' end was Calculated and nonzero,
+ and the 'to' end was zero and not Calculated.
+
+ Blending doesn't work with calculated expressions and is being tracked in
+ bug http://webkit.org/b/86160
+
+ Tests: css3/calc/transition-crash3.html
+ css3/calc/transition-crash4.html
+
+ * platform/Length.h:
+ (WebCore::Length::blend):
+
2012-05-21 Pavel Feldman <[email protected]>
Web Inspector: make search results view more dense
Modified: trunk/Source/WebCore/platform/Length.h (117747 => 117748)
--- trunk/Source/WebCore/platform/Length.h 2012-05-21 08:42:53 UTC (rev 117747)
+++ trunk/Source/WebCore/platform/Length.h 2012-05-21 08:49:27 UTC (rev 117748)
@@ -228,7 +228,7 @@
return *this;
// FIXME http://webkit.org/b/86160 - Blending doesn't work with calculated expressions
- if (type() == Calculated)
+ if (from.type() == Calculated || type() == Calculated)
return *this;
LengthType resultType = type();
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
