Title: [171811] branches/safari-600.1-branch

Diff

Modified: branches/safari-600.1-branch/LayoutTests/ChangeLog (171810 => 171811)


--- branches/safari-600.1-branch/LayoutTests/ChangeLog	2014-07-30 20:33:00 UTC (rev 171810)
+++ branches/safari-600.1-branch/LayoutTests/ChangeLog	2014-07-30 20:36:45 UTC (rev 171811)
@@ -1,5 +1,22 @@
 2014-07-30  Lucas Forschler  <[email protected]>
 
+        Merge r171785
+
+    2014-07-29  Andreas Kling  <[email protected]>
+
+            Crash when using 'em' units to specify font-size inside animation keyframe.
+            <https://webkit.org/b/135395>
+            <rdar://problem/17851910>
+
+            Add a reduced test case to cover this bug.
+
+            Reviewed by Simon Fraser.
+
+            * fast/animation/keyframe-with-font-size-in-em-units-expected.txt: Added.
+            * fast/animation/keyframe-with-font-size-in-em-units.html: Added.
+
+2014-07-30  Lucas Forschler  <[email protected]>
+
         Merge r171718
 
     2014-07-28  Zalan Bujtas  <[email protected]>

Copied: branches/safari-600.1-branch/LayoutTests/fast/animation/keyframe-with-font-size-in-em-units-expected.txt (from rev 171785, trunk/LayoutTests/fast/animation/keyframe-with-font-size-in-em-units-expected.txt) (0 => 171811)


--- branches/safari-600.1-branch/LayoutTests/fast/animation/keyframe-with-font-size-in-em-units-expected.txt	                        (rev 0)
+++ branches/safari-600.1-branch/LayoutTests/fast/animation/keyframe-with-font-size-in-em-units-expected.txt	2014-07-30 20:36:45 UTC (rev 171811)
@@ -0,0 +1 @@
+PASS (no crash)

Copied: branches/safari-600.1-branch/LayoutTests/fast/animation/keyframe-with-font-size-in-em-units.html (from rev 171785, trunk/LayoutTests/fast/animation/keyframe-with-font-size-in-em-units.html) (0 => 171811)


--- branches/safari-600.1-branch/LayoutTests/fast/animation/keyframe-with-font-size-in-em-units.html	                        (rev 0)
+++ branches/safari-600.1-branch/LayoutTests/fast/animation/keyframe-with-font-size-in-em-units.html	2014-07-30 20:36:45 UTC (rev 171811)
@@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+@-webkit-keyframes foo {
+    from {
+        font-size: 2em;
+    }
+}
+#foo {
+    -webkit-animation: foo 1s linear 0.0s infinite;
+}
+</style>
+<script>
+if (window.testRunner)
+    testRunner.dumpAsText();
+</script>
+</head>
+<body>
+<div id="foo"></div>
+<span>PASS (no crash)</span>
+</body>
+</html>

Modified: branches/safari-600.1-branch/Source/WebCore/ChangeLog (171810 => 171811)


--- branches/safari-600.1-branch/Source/WebCore/ChangeLog	2014-07-30 20:33:00 UTC (rev 171810)
+++ branches/safari-600.1-branch/Source/WebCore/ChangeLog	2014-07-30 20:36:45 UTC (rev 171811)
@@ -1,5 +1,29 @@
 2014-07-30  Lucas Forschler  <[email protected]>
 
+        Merge r171785
+
+    2014-07-29  Andreas Kling  <[email protected]>
+
+            Crash when using 'em' units to specify font-size inside animation keyframe.
+            <https://webkit.org/b/135395>
+            <rdar://problem/17851910>
+
+            We'd forgotten to initialize the "parent style" when resolving keyframe
+            styles, and this led to a crash in length conversion where the code
+            assumes a parent style will be present.
+
+            To keep this fix minimal, simply make the "parent style" a clone of the
+            base element style.
+
+            Reviewed by Simon Fraser.
+
+            Test: fast/animation/keyframe-with-font-size-in-em-units.html
+
+            * css/StyleResolver.cpp:
+            (WebCore::StyleResolver::styleForKeyframe):
+
+2014-07-30  Lucas Forschler  <[email protected]>
+
         Merge r171766
 
     2014-07-29  Pratik Solanki  <[email protected]>

Modified: branches/safari-600.1-branch/Source/WebCore/css/StyleResolver.cpp (171810 => 171811)


--- branches/safari-600.1-branch/Source/WebCore/css/StyleResolver.cpp	2014-07-30 20:33:00 UTC (rev 171810)
+++ branches/safari-600.1-branch/Source/WebCore/css/StyleResolver.cpp	2014-07-30 20:36:45 UTC (rev 171811)
@@ -825,6 +825,7 @@
 
     // Create the style
     state.setStyle(RenderStyle::clone(elementStyle));
+    state.setParentStyle(RenderStyle::clone(elementStyle));
     state.setLineHeightValue(0);
 
     TextDirection direction;
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes

Reply via email to