diff options
| author | Antti Koivisto <antti@apple.com> | 2014-12-10 20:46:15 +0000 |
|---|---|---|
| committer | Konstantin Tokarev <annulen@yandex.ru> | 2016-09-27 07:16:59 +0000 |
| commit | 6ca6514fa0caae5bf1df1aae126c51efb618d757 (patch) | |
| tree | 49a33769120144055ccc163d90e94c3e1e0d0eb8 /Source/WebKit/English.lproj/WebJavaScriptTextInputPanel.nib/keyedobjects.nib | |
| parent | 502b4a55ac778d036a33c32fec51eecbbc73e1a9 (diff) | |
| download | qtwebkit-6ca6514fa0caae5bf1df1aae126c51efb618d757.tar.gz | |
Crash when creating CSSCalcBinaryOperation
https://bugs.webkit.org/show_bug.cgi?id=134886
rdar://problem/17663561
Reviewed by Chris Dumez.
Source/WebCore:
Test: fast/css/calc-binary-operation-crash.html
* css/CSSCalculationValue.cpp:
(WebCore::determineCategory):
Ensure that both axis are within the addSubtractResult table.
Remove unneeded CalcOther test. The call site guarantees it doesn't happen and the normal cases would handle it anyway.
Also strengthen some asserts.
LayoutTests:
* fast/css/calc-binary-operation-crash-expected.txt: Added.
* fast/css/calc-binary-operation-crash.html: Added.
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@177089 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Change-Id: Iaf7199800b78c1397da9335bb3420ab6784f9227
Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
Diffstat (limited to 'Source/WebKit/English.lproj/WebJavaScriptTextInputPanel.nib/keyedobjects.nib')
0 files changed, 0 insertions, 0 deletions