Author: meade
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src/+/3da351bc3124254baf2c705989e35d51b07fad96
Time: Wed Aug 24 04:37:15 2016
Lines 22-38, 61-72 of file StyleValueFactory.cpp which potentially caused crash are changed in this cl (frame #3, "blink::"; frame #4, "blink::StyleValueFactory::cssValueToStyleValueVector").

File InlineStylePropertyMap.cpp is changed in this cl (and is part of stack frame #5, "blink::InlineStylePropertyMap::getIterationEntries")
Minimum distance from crash line to modified line: 0. (file: StyleValueFactory.cpp, crashed on: 22, modified: 22).

Suspected Project: chromium
Suspected Component: Blink>CSS

 Issue 642039  has been merged into this issue.

This issue is a security regression. If you are not able to fix this quickly, please revert the change that introduced it.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

I ended up looking into the bug a bit -_-. Looks like CSSTransformValue::fromCSSValue is returning null for an unimplemented case, so StyleValueFactory::cssValueToStyleValueVector falls back to the list-handling case. So fromCSSValue is called with a CSSFunctionValue this time (which subclasses CSSValueList) and then we get 50px where we expect a function.

<div id=test style=transform:translateY(50px);></div>
<script>test.styleMap.entries();</script

Friendly ping, this is currently a Beta-blocker and needs to get fixed and merged as soon as feasible, as M54 is going to beta this Thursday 9/8

Moving to ReleaseBlock-Stable to keep track of this for M54

Fix is on the queue, requesting merge approval once it lands: https://codereview.chromium.org/2313523002

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/5c7a196f1f2a29d7e71b5dcf2051dbe0625d6519

commit 5c7a196f1f2a29d7e71b5dcf2051dbe0625d6519
Author: meade <meade@chromium.org>
Date: Fri Sep 09 08:19:10 2016

Add check that the CSSValue is a valid type in CSSTransformComponent before casting.

BUG= 641995 

Review-Url: https://codereview.chromium.org/2313523002
Cr-Commit-Position: refs/heads/master@{#417535}

[modify] https://crrev.com/5c7a196f1f2a29d7e71b5dcf2051dbe0625d6519/third_party/WebKit/LayoutTests/typedcssom/inlinestyle/transform.html
[modify] https://crrev.com/5c7a196f1f2a29d7e71b5dcf2051dbe0625d6519/third_party/WebKit/Source/core/css/cssom/CSSTransformComponent.cpp

Please mark security bugs as fixed as soon as the fix lands, and before requesting merges. This update is based on the merge- labels applied to this issue. Please reopen if this update was incorrect.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Your change meets the bar and is auto-approved for M54 (branch: 2840)

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/0d3411e8e492f0b0c067d519ada714986e58994f

commit 0d3411e8e492f0b0c067d519ada714986e58994f
Author: Eddy Mead <meade@chromium.org>
Date: Mon Sep 12 01:39:19 2016

Add check that the CSSValue is a valid type in CSSTransformComponent before casting.

BUG= 641995 

Review-Url: https://codereview.chromium.org/2313523002
Cr-Commit-Position: refs/heads/master@{#417535}
(cherry picked from commit 5c7a196f1f2a29d7e71b5dcf2051dbe0625d6519)

Review URL: https://codereview.chromium.org/2326423002 .

Cr-Commit-Position: refs/branch-heads/2840@{#294}
Cr-Branched-From: 1ae106dbab4bddd85132d5b75c670794311f4c57-refs/heads/master@{#414607}

[modify] https://crrev.com/0d3411e8e492f0b0c067d519ada714986e58994f/third_party/WebKit/LayoutTests/typedcssom/inlinestyle/transform.html
[modify] https://crrev.com/0d3411e8e492f0b0c067d519ada714986e58994f/third_party/WebKit/Source/core/css/cssom/CSSTransformComponent.cpp

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/0d3411e8e492f0b0c067d519ada714986e58994f

commit 0d3411e8e492f0b0c067d519ada714986e58994f
Author: Eddy Mead <meade@chromium.org>
Date: Mon Sep 12 01:39:19 2016

Add check that the CSSValue is a valid type in CSSTransformComponent before casting.

BUG= 641995 

Review-Url: https://codereview.chromium.org/2313523002
Cr-Commit-Position: refs/heads/master@{#417535}
(cherry picked from commit 5c7a196f1f2a29d7e71b5dcf2051dbe0625d6519)

Review URL: https://codereview.chromium.org/2326423002 .

Cr-Commit-Position: refs/branch-heads/2840@{#294}
Cr-Branched-From: 1ae106dbab4bddd85132d5b75c670794311f4c57-refs/heads/master@{#414607}

[modify] https://crrev.com/0d3411e8e492f0b0c067d519ada714986e58994f/third_party/WebKit/LayoutTests/typedcssom/inlinestyle/transform.html
[modify] https://crrev.com/0d3411e8e492f0b0c067d519ada714986e58994f/third_party/WebKit/Source/core/css/cssom/CSSTransformComponent.cpp

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot