Fix CSSParserValue::createCSSValue() for viewport based units.
Created attachment 160080 [details] Patch
Comment on attachment 160080 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=160080&action=review > LayoutTests/ChangeLog:8 > + Add test that uses variables, calc and viewport units together. Does the test have to use variables to reproduce? It would be nice if we could have a test case that runs on all ports.
(In reply to comment #2) > (From update of attachment 160080 [details]) > View in context: https://bugs.webkit.org/attachment.cgi?id=160080&action=review > > > LayoutTests/ChangeLog:8 > > + Add test that uses variables, calc and viewport units together. > > Does the test have to use variables to reproduce? It would be nice if we could have a test case that runs on all ports. For the test case (found by fuzz testing) without the variable definition you don't get the call to createCSSValue from the parser. There could be other code paths that can make it here too, but if so it's surprising that fuzz testing hasn't hit them yet.
Comment on attachment 160080 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=160080&action=review >>> LayoutTests/ChangeLog:8 >>> + Add test that uses variables, calc and viewport units together. >> >> Does the test have to use variables to reproduce? It would be nice if we could have a test case that runs on all ports. > > For the test case (found by fuzz testing) without the variable definition you don't get the call to createCSSValue from the parser. There could be other code paths that can make it here too, but if so it's surprising that fuzz testing hasn't hit them yet. To answer my own question: Yes, this requires variables (I checked all the callers). I think we should change createCSSValue to use a switch statement so the compiler can tell us if we forgot something. It'll also make it easier to add values in the future. We use switch statements in a few other places too.
Created attachment 160649 [details] Patch
Comment on attachment 160649 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=160649&action=review > LayoutTests/fast/css/variables/calc-vw-crash.html:2 > +<script> > +if (window.testRunner) { Nit: <!DOCTYPE html> and <html> tag are missing.
Created attachment 160863 [details] Patch for landing
Comment on attachment 160863 [details] Patch for landing Clearing flags on attachment: 160863 Committed r126828: <http://trac.webkit.org/changeset/126828>
All reviewed patches have been landed. Closing bug.