ASSERTION FAILED: !valueWithCalculation.calculation() in WebCore::CSSParser::validate...
authorcdumez@apple.com <cdumez@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Fri, 9 Jan 2015 05:29:09 +0000 (05:29 +0000)
committercdumez@apple.com <cdumez@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Fri, 9 Jan 2015 05:29:09 +0000 (05:29 +0000)
commit19e4f864f61636ec6c0c899b466d961f0ff7af54
treebcd5457f5555f973958187b911118a06dced203d
parentd90f6bfac844f2874e353580f7d0ae74f15c58dc
ASSERTION FAILED: !valueWithCalculation.calculation() in WebCore::CSSParser::validateCalculationUnit
https://bugs.webkit.org/show_bug.cgi?id=140251

Reviewed by Darin Adler.

Source/WebCore:

Using a calculated value for text-shadow's blur-radius was hitting an
assertion in CSSParser::validateCalculationUnit() because validUnit()
is called twice, first with 'FLength' unit, then more stricly with
'FLength|FNonNeg' if parsing the blur-radius as it cannot be negative
as per the specification:
- http://dev.w3.org/csswg/css-text-decor-3/#text-shadow-property
- http://dev.w3.org/csswg/css-backgrounds-3/#shadow

On the second call, the ValueWithCalculation's m_calculation member
was already initialized and the code did not handle this. This patch
updates validateCalculationUnit() to teach it to reuse the previously
parsed calculation in this case. All it needs to do is to update the
existing CSSCalcValue's range to allow negative values or not.

When writing the layout test for this, I also noticed that the CSS
parser was not rejecting negative calculated values for blur-radius
(only negative non-calculated ones). This is because
validateCalculationUnit() was ignoring FNonNeg if the calculated
value is a Length. This patch also addresses the issue.

Test: fast/css/text-shadow-calc-value.html

* css/CSSCalculationValue.h:
(WebCore::CSSCalcValue::setPermittedValueRange):
Add a setter to update the CSSCalculationValue's permitted value range
so that the CSS parser does not need to fully reparse the calculation
only to update the permitted value range.

* css/CSSParser.cpp:
(WebCore::CSSParser::validateCalculationUnit):
- Teach the code to reuse the previously parsed calculation value.
- Do the FNonNeg check for Length calculations as well.

LayoutTests:

Add a layout test to check that using calculated values for
'text-shadow' CSS doesn't crash and works as intended. Also check
that the CSS parser is correctly validating the blur-radius, which
is supposed to be non-negative, as per the specification:
- http://dev.w3.org/csswg/css-text-decor-3/#text-shadow-property
- http://dev.w3.org/csswg/css-backgrounds-3/#shadow

* fast/css/text-shadow-calc-value-expected.txt: Added.
* fast/css/text-shadow-calc-value.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@178156 268f45cc-cd09-0410-ab3c-d52691b4dbfc
LayoutTests/ChangeLog
LayoutTests/fast/css/text-shadow-calc-value-expected.txt [new file with mode: 0644]
LayoutTests/fast/css/text-shadow-calc-value.html [new file with mode: 0644]
Source/WebCore/ChangeLog
Source/WebCore/css/CSSCalculationValue.h
Source/WebCore/css/CSSParser.cpp