diff options
| author | Allan Sandfeld Jensen <allan.jensen@qt.io> | 2020-08-03 17:38:58 +0200 |
|---|---|---|
| committer | Allan Sandfeld Jensen <allan.jensen@qt.io> | 2020-08-03 15:47:28 +0000 |
| commit | 05942008bf7a5ca403b2e33901905dba6e78acc9 (patch) | |
| tree | 61a20e2da0da0e9e9e72713e1557b71ae5130df9 | |
| parent | 91ec8de034384375e9e63e6694a09948ce4941f2 (diff) | |
| download | qtwebengine-chromium-05942008bf7a5ca403b2e33901905dba6e78acc9.tar.gz | |
[Backport] Handle invalid type mixing in CSS clamp()
Bug: 1050608
Commit-Queue: Xiaocheng Hu <xiaochengh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#740710}
Fixes: QTBUG-85863
Change-Id: If05d806be6ff35c209c983ef8d79790ecd1addb7
Reviewed-by: Michael Brüning <michael.bruning@qt.io>
| -rw-r--r-- | chromium/third_party/blink/renderer/core/css/css_math_expression_node.cc | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/chromium/third_party/blink/renderer/core/css/css_math_expression_node.cc b/chromium/third_party/blink/renderer/core/css/css_math_expression_node.cc index 4e6fa5e20e4..f5fe60cb8a6 100644 --- a/chromium/third_party/blink/renderer/core/css/css_math_expression_node.cc +++ b/chromium/third_party/blink/renderer/core/css/css_math_expression_node.cc @@ -1083,8 +1083,14 @@ class CSSMathExpressionNodeParser { auto* nested = CSSMathExpressionVariadicOperation::Create( {val_operand, max_operand}, CSSMathOperator::kMin); + if (!nested) + return nullptr; + auto* result = CSSMathExpressionVariadicOperation::Create( {min_operand, nested}, CSSMathOperator::kMax); + if (!result) + return nullptr; + result->SetIsClamp(); return result; } |