CSSGradientValue should check whether gradientLength is zero or not.
authorcommit-queue@webkit.org <commit-queue@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Tue, 6 Oct 2015 01:22:48 +0000 (01:22 +0000)
committercommit-queue@webkit.org <commit-queue@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Tue, 6 Oct 2015 01:22:48 +0000 (01:22 +0000)
commitdcb75b5dd111850fb0d73d8fb30c008685bcb2c2
tree64f73db857d81dd2126ba2732ec351b05d39f5a7
parentfdb4b9cbe0145629110495b776a8468e07e904c0
CSSGradientValue should check whether gradientLength is zero or not.
https://bugs.webkit.org/show_bug.cgi?id=149373
<rdar://problem/22771418>

Patch by Jiewen Tan <jiewen_tan@apple.com> on 2015-10-05
Reviewed by Darin Adler.

Source/WebCore:

This is a merge of Blink r158220,
https://chromiumcodereview.appspot.com/24350008

Test: fast/gradients/css3-repeating-radial-gradients-crash.html

* css/CSSGradientValue.cpp:
(WebCore::CSSGradientValue::addStops):
Check whether gradientLength > 0 before using it as denominator.

LayoutTests:

* fast/gradients/css3-repeating-radial-gradients-crash-expected.txt: Added.
* fast/gradients/css3-repeating-radial-gradients-crash.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@190597 268f45cc-cd09-0410-ab3c-d52691b4dbfc
LayoutTests/ChangeLog
LayoutTests/fast/gradients/css3-repeating-radial-gradients-crash-expected.txt [new file with mode: 0644]
LayoutTests/fast/gradients/css3-repeating-radial-gradients-crash.html [new file with mode: 0644]
Source/WebCore/ChangeLog
Source/WebCore/css/CSSGradientValue.cpp