Crash when creating CSSCalcBinaryOperation

[WebKit-https.git] / Source / WebCore / css / CSSCalculationValue.cpp

diff --git a/Source/WebCore/css/CSSCalculationValue.cpp b/Source/WebCore/css/CSSCalculationValue.cpp
index 5a9041d..fa995f6 100644 (file)
--- a/Source/WebCore/css/CSSCalculationValue.cpp
+++ b/Source/WebCore/css/CSSCalculationValue.cpp
@@ -242,6 +242,7 @@ private:
         case CalcOther:
             ASSERT_NOT_REACHED();
         }
         case CalcOther:
             ASSERT_NOT_REACHED();
         }

+        ASSERT_NOT_REACHED();

         return nullptr;
     }
 
         return nullptr;
     }
 


@@ -311,14 +312,13 @@ static CalculationCategory determineCategory(const CSSCalcExpressionNode& leftSi
 {
     CalculationCategory leftCategory = leftSide.category();
     CalculationCategory rightCategory = rightSide.category();
 {
     CalculationCategory leftCategory = leftSide.category();
     CalculationCategory rightCategory = rightSide.category();

-
-    if (leftCategory == CalcOther || rightCategory == CalcOther)
-        return CalcOther;
+    ASSERT(leftCategory < CalcOther);
+    ASSERT(rightCategory < CalcOther);

 
     switch (op) {
     case CalcAdd:
     case CalcSubtract:
 
     switch (op) {
     case CalcAdd:
     case CalcSubtract:

-        if (leftCategory < CalcAngle || rightCategory < CalcAngle)
+        if (leftCategory < CalcAngle && rightCategory < CalcAngle)

             return addSubtractResult[leftCategory][rightCategory];
         if (leftCategory == rightCategory)
             return leftCategory;
             return addSubtractResult[leftCategory][rightCategory];
         if (leftCategory == rightCategory)
             return leftCategory;


@@ -349,7 +349,8 @@ class CSSCalcBinaryOperation final : public CSSCalcExpressionNode {
 public:
     static PassRefPtr<CSSCalcBinaryOperation> create(CalcOperator op, PassRefPtr<CSSCalcExpressionNode> leftSide, PassRefPtr<CSSCalcExpressionNode> rightSide)
     {
 public:
     static PassRefPtr<CSSCalcBinaryOperation> create(CalcOperator op, PassRefPtr<CSSCalcExpressionNode> leftSide, PassRefPtr<CSSCalcExpressionNode> rightSide)
     {

-        ASSERT(leftSide->category() != CalcOther && rightSide->category() != CalcOther);
+        ASSERT(leftSide->category() < CalcOther);
+        ASSERT(rightSide->category() < CalcOther);

 
         CalculationCategory newCategory = determineCategory(*leftSide, *rightSide, op);
 
 
         CalculationCategory newCategory = determineCategory(*leftSide, *rightSide, op);
 


@@ -363,7 +364,8 @@ public:
     {
         CalculationCategory leftCategory = leftSide->category();
         CalculationCategory rightCategory = rightSide->category();
     {
         CalculationCategory leftCategory = leftSide->category();
         CalculationCategory rightCategory = rightSide->category();

-        ASSERT(leftCategory != CalcOther && rightCategory != CalcOther);
+        ASSERT(leftCategory < CalcOther);
+        ASSERT(rightCategory < CalcOther);

 
         bool isInteger = isIntegerResult(op, *leftSide, *rightSide);
 
 
         bool isInteger = isIntegerResult(op, *leftSide, *rightSide);