[webkit-changes] [179674] branches/safari-600.1.4.15-branch

Wed, 04 Feb 2015 21:42:01 -0800

Title: [179674] branches/safari-600.1.4.15-branch

Diff

Modified: branches/safari-600.1.4.15-branch/LayoutTests/ChangeLog (179673 => 179674)


--- branches/safari-600.1.4.15-branch/LayoutTests/ChangeLog	2015-02-05 05:20:54 UTC (rev 179673)
+++ branches/safari-600.1.4.15-branch/LayoutTests/ChangeLog	2015-02-05 05:41:30 UTC (rev 179674)
@@ -1,5 +1,20 @@
 2015-02-04  Lucas Forschler  <[email protected]>
 
+        Merge r177089
+
+    2014-12-10  Antti Koivisto  <[email protected]>
+
+            Crash when creating CSSCalcBinaryOperation
+            https://bugs.webkit.org/show_bug.cgi?id=134886
+            rdar://problem/17663561
+
+            Reviewed by Chris Dumez.
+
+            * fast/css/calc-binary-operation-crash-expected.txt: Added.
+            * fast/css/calc-binary-operation-crash.html: Added.
+
+2015-02-04  Lucas Forschler  <[email protected]>
+
         Merge r176750
 
     2014-12-03  Zalan Bujtas  <[email protected]>

Copied: branches/safari-600.1.4.15-branch/LayoutTests/fast/css/calc-binary-operation-crash-expected.txt (from rev 177089, trunk/LayoutTests/fast/css/calc-binary-operation-crash-expected.txt) (0 => 179674)


--- branches/safari-600.1.4.15-branch/LayoutTests/fast/css/calc-binary-operation-crash-expected.txt	                        (rev 0)
+++ branches/safari-600.1.4.15-branch/LayoutTests/fast/css/calc-binary-operation-crash-expected.txt	2015-02-05 05:41:30 UTC (rev 179674)
@@ -0,0 +1,3 @@
+This test passes if it doesn't crash.
+
+X

Copied: branches/safari-600.1.4.15-branch/LayoutTests/fast/css/calc-binary-operation-crash.html (from rev 177089, trunk/LayoutTests/fast/css/calc-binary-operation-crash.html) (0 => 179674)


--- branches/safari-600.1.4.15-branch/LayoutTests/fast/css/calc-binary-operation-crash.html	                        (rev 0)
+++ branches/safari-600.1.4.15-branch/LayoutTests/fast/css/calc-binary-operation-crash.html	2015-02-05 05:41:30 UTC (rev 179674)
@@ -0,0 +1,6 @@
+<script>
+if (window.testRunner)
+    testRunner.dumpAsText();
+</script>
+<p>This test passes if it doesn't crash.</p>
+<p style="text-indent: calc(25s - 3px + 12.5%*2)">X</p>

Modified: branches/safari-600.1.4.15-branch/Source/WebCore/ChangeLog (179673 => 179674)


--- branches/safari-600.1.4.15-branch/Source/WebCore/ChangeLog	2015-02-05 05:20:54 UTC (rev 179673)
+++ branches/safari-600.1.4.15-branch/Source/WebCore/ChangeLog	2015-02-05 05:41:30 UTC (rev 179674)
@@ -1,5 +1,26 @@
 2015-02-04  Lucas Forschler  <[email protected]>
 
+        Merge r177089
+
+    2014-12-10  Antti Koivisto  <[email protected]>
+
+            Crash when creating CSSCalcBinaryOperation
+            https://bugs.webkit.org/show_bug.cgi?id=134886
+            rdar://problem/17663561
+
+            Reviewed by Chris Dumez.
+
+            Test: fast/css/calc-binary-operation-crash.html
+
+            * css/CSSCalculationValue.cpp:
+            (WebCore::determineCategory):
+
+            Ensure that both axis are within the addSubtractResult table.
+            Remove unneeded CalcOther test. The call site guarantees it doesn't happen and the normal cases would handle it anyway.
+            Also strengthen some asserts.
+
+2015-02-04  Lucas Forschler  <[email protected]>
+
         Merge r176750
 
     2014-12-03  Zalan Bujtas  <[email protected]>

Modified: branches/safari-600.1.4.15-branch/Source/WebCore/css/CSSCalculationValue.cpp (179673 => 179674)


--- branches/safari-600.1.4.15-branch/Source/WebCore/css/CSSCalculationValue.cpp	2015-02-05 05:20:54 UTC (rev 179673)
+++ branches/safari-600.1.4.15-branch/Source/WebCore/css/CSSCalculationValue.cpp	2015-02-05 05:41:30 UTC (rev 179674)
@@ -239,6 +239,7 @@
         case CalcOther:
             ASSERT_NOT_REACHED();
         }
+        ASSERT_NOT_REACHED();
         return nullptr;
     }
 
@@ -308,14 +309,13 @@
 {
     CalculationCategory leftCategory = leftSide.category();
     CalculationCategory rightCategory = rightSide.category();
+    ASSERT(leftCategory < CalcOther);
+    ASSERT(rightCategory < CalcOther);
 
-    if (leftCategory == CalcOther || rightCategory == CalcOther)
-        return CalcOther;
-
     switch (op) {
     case CalcAdd:
     case CalcSubtract:
-        if (leftCategory < CalcAngle || rightCategory < CalcAngle)
+        if (leftCategory < CalcAngle && rightCategory < CalcAngle)
             return addSubtractResult[leftCategory][rightCategory];
         if (leftCategory == rightCategory)
             return leftCategory;
@@ -346,7 +346,8 @@
 public:
     static PassRefPtr<CSSCalcBinaryOperation> create(CalcOperator op, PassRefPtr<CSSCalcExpressionNode> leftSide, PassRefPtr<CSSCalcExpressionNode> rightSide)
     {
-        ASSERT(leftSide->category() != CalcOther && rightSide->category() != CalcOther);
+        ASSERT(leftSide->category() < CalcOther);
+        ASSERT(rightSide->category() < CalcOther);
 
         CalculationCategory newCategory = determineCategory(*leftSide, *rightSide, op);
 
@@ -360,7 +361,8 @@
     {
         CalculationCategory leftCategory = leftSide->category();
         CalculationCategory rightCategory = rightSide->category();
-        ASSERT(leftCategory != CalcOther && rightCategory != CalcOther);
+        ASSERT(leftCategory < CalcOther);
+        ASSERT(rightCategory < CalcOther);
 
         bool isInteger = isIntegerResult(op, *leftSide, *rightSide);
 

_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes

Reply via email to