blink: prevent bitarray overflow

Source/core/animation/css/CSSAnimations.cpp

 /*
  * Copyright (C) 2013 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 536 matching lines @@
                 continue;
 
             bool animateAll = mode == CSSTransitionData::TransitionAll;
             ASSERT(animateAll || mode == CSSTransitionData::TransitionSingleProperty);
             if (animateAll)
                 anyTransitionHadTransitionAll = true;
             const StylePropertyShorthand& propertyList = animateAll ? CSSAnimations::propertiesForTransitionAll() : shorthandForProperty(property);
             // If not a shorthand we only execute one iteration of this loop, and refer to the property directly.
             for (unsigned j = 0; !j || j < propertyList.length(); ++j) {
                 CSSPropertyID id = propertyList.length() ? propertyList.properties()[j] : property;
+                ASSERT(id >= firstCSSProperty);
 
                 if (!animateAll) {
                     if (CSSPropertyMetadata::isInterpolableProperty(id))
-                        listedProperties.set(id);
+                        listedProperties.set(id - firstCSSProperty);

[alancutter (OOO until 2018), 2015/08/24 00:34:06]

No need to subtract firstCSSProperty when you have the assert. I think it's
simpler if we stick with storing and reading regular CSSPropertyIDs.

                     else
                         continue;
                 }
 
                 // FIXME: We should transition if an !important property changes even when an animation is running,
                 // but this is a bit hard to do with the current applyMatchedProperties system.
                 PropertyHandle property = PropertyHandle(id);
                 if (!update->activeInterpolationsForAnimations().contains(property)
                     && (!elementAnimations || !elementAnimations->cssAnimations().m_previousActiveInterpolationsForAnimations.contains(property))) {
                     calculateTransitionUpdateForProperty(id, *transitionData, i, oldStyle, style, activeTransitions, update, animatingElement);
                 }
             }
         }
     }
 
     if (activeTransitions) {
         for (const auto& entry : *activeTransitions) {
             CSSPropertyID id = entry.key;
-            if (!anyTransitionHadTransitionAll && !animationStyleRecalc && !listedProperties.get(id)) {
+            if (!anyTransitionHadTransitionAll && !animationStyleRecalc && !listedProperties.get(id - firstCSSProperty)) {
                 // TODO: Figure out why this fails on Chrome OS login page. crbug.com/365507
                 // ASSERT(animation.playStateInternal() == Animation::Finished || !(elementAnimations && elementAnimations->isAnimationStyleChange()));
                 update->cancelTransition(id);
             } else if (entry.value.animation->finishedInternal()) {
                 update->finishTransition(id);
             }
         }
     }
 }
 
@@ skipping 217 matching lines @@
     visitor->trace(m_activeInterpolationsForAnimations);
     visitor->trace(m_activeInterpolationsForTransitions);
     visitor->trace(m_newAnimations);
     visitor->trace(m_suppressedAnimations);
     visitor->trace(m_animationsWithUpdates);
     visitor->trace(m_animationsWithStyleUpdates);
 #endif
 }
 
 } // namespace blink