Crash when creating CSSCalcBinaryOperation
authorantti@apple.com <antti@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Wed, 10 Dec 2014 20:46:15 +0000 (20:46 +0000)
committerantti@apple.com <antti@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Wed, 10 Dec 2014 20:46:15 +0000 (20:46 +0000)
commitbebb53fb341c21f48e698512e581bf201eef216e
tree29dd291c74dc3d52a5757400d1ee71b7fda0961b
parentd9f56224c5427e8eb66a3f305e9b9a585574784f
Crash when creating CSSCalcBinaryOperation
https://bugs.webkit.org/show_bug.cgi?id=134886
rdar://problem/17663561

Reviewed by Chris Dumez.

Source/WebCore:

Test: fast/css/calc-binary-operation-crash.html

* css/CSSCalculationValue.cpp:
(WebCore::determineCategory):

Ensure that both axis are within the addSubtractResult table.
Remove unneeded CalcOther test. The call site guarantees it doesn't happen and the normal cases would handle it anyway.
Also strengthen some asserts.

LayoutTests:

* fast/css/calc-binary-operation-crash-expected.txt: Added.
* fast/css/calc-binary-operation-crash.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@177089 268f45cc-cd09-0410-ab3c-d52691b4dbfc
LayoutTests/ChangeLog
LayoutTests/fast/css/calc-binary-operation-crash-expected.txt [new file with mode: 0644]
LayoutTests/fast/css/calc-binary-operation-crash.html [new file with mode: 0644]
Source/WebCore/ChangeLog
Source/WebCore/css/CSSCalculationValue.cpp