WebKitCSSMatrix: Avoid crash resolving relative lengths.

Source/core/css/CSSMatrix.cpp

 /*
  * Copyright (C) 2008 Apple Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 39 matching lines @@
 CSSMatrix::CSSMatrix(const TransformationMatrix& m)
     : m_matrix(m)
 {
 }
 
 CSSMatrix::CSSMatrix(const String& s, ExceptionState& exceptionState)
 {
     setMatrixValue(s, exceptionState);
 }
 
+static inline PassRefPtr<LayoutStyle> createInitialStyle()
+{
+    RefPtr<LayoutStyle> initialStyle = LayoutStyle::create();
+    initialStyle->font().update(nullptr);
+    return initialStyle;
+}
+
 void CSSMatrix::setMatrixValue(const String& string, ExceptionState& exceptionState)
 {
     if (string.isEmpty())
         return;
 
     // FIXME: crbug.com/154772 - should this continue to use legacy style parsing?
     if (RefPtrWillBeRawPtr<CSSValue> value = CSSParser::parseSingleValue(CSSPropertyWebkitTransform, string)) {
         // Check for a "none" transform. In these cases we can use the default identity matrix.
         if (value->isPrimitiveValue() && (toCSSPrimitiveValue(value.get()))->getValueID() == CSSValueNone)
             return;
 
-        // FIXME: This has a null pointer crash if we use ex units (crbug.com/414145)
-        DEFINE_STATIC_REF(LayoutStyle, initialStyle, LayoutStyle::create());
+        DEFINE_STATIC_REF(LayoutStyle, initialStyle, createInitialStyle());
         TransformOperations operations;
         if (!TransformBuilder::createTransformOperations(value.get(), CSSToLengthConversionData(initialStyle, initialStyle, nullptr, 1.0f), operations)) {
             exceptionState.throwDOMException(SyntaxError, "Failed to interpret '" + string + "' as a transformation operation.");
             return;
         }
 
         // Convert transform operations to a TransformationMatrix. This can fail
         // if a param has a percentage ('%')
         if (operations.dependsOnBoxSize())
             exceptionState.throwDOMException(SyntaxError, "The transformation depends on the box size, which is not supported.");
@@ skipping 101 matching lines @@
     if (m_matrix.isAffine())
         return String::format("matrix(%f, %f, %f, %f, %f, %f)", m_matrix.a(), m_matrix.b(), m_matrix.c(), m_matrix.d(), m_matrix.e(), m_matrix.f());
     return String::format("matrix3d(%f, %f, %f, %f, %f, %f, %f, %f, %f, %f, %f, %f, %f, %f, %f, %f)",
     m_matrix.m11(), m_matrix.m12(), m_matrix.m13(), m_matrix.m14(),
     m_matrix.m21(), m_matrix.m22(), m_matrix.m23(), m_matrix.m24(),
     m_matrix.m31(), m_matrix.m32(), m_matrix.m33(), m_matrix.m34(),
     m_matrix.m41(), m_matrix.m42(), m_matrix.m43(), m_matrix.m44());
 }
 
 } // namespace blink