blink: prevent bitarray overflow

Source/core/animation/css/CSSAnimations.cpp

Index: Source/core/animation/css/CSSAnimations.cpp
diff --git a/Source/core/animation/css/CSSAnimations.cpp b/Source/core/animation/css/CSSAnimations.cpp
index 493ae473deb86d8f27baadb9b1bd3d2361ffcc19..4227168ac314ba50446175d073945ce170211694 100644
--- a/Source/core/animation/css/CSSAnimations.cpp
+++ b/Source/core/animation/css/CSSAnimations.cpp
@@ -554,10 +554,11 @@ void CSSAnimations::calculateTransitionUpdate(CSSAnimationUpdate* update, const
             // If not a shorthand we only execute one iteration of this loop, and refer to the property directly.
             for (unsigned j = 0; !j || j < propertyList.length(); ++j) {
                 CSSPropertyID id = propertyList.length() ? propertyList.properties()[j] : property;
+                ASSERT(id >= firstCSSProperty);
 
                 if (!animateAll) {
                     if (CSSPropertyMetadata::isInterpolableProperty(id))
-                        listedProperties.set(id);
+                        listedProperties.set(id - firstCSSProperty);

[alancutter (OOO until 2018), 2015/08/24 00:34:06]

No need to subtract firstCSSProperty when you have the assert. I think it's
simpler if we stick with storing and reading regular CSSPropertyIDs.

                     else
                         continue;
                 }
@@ -576,7 +577,7 @@ void CSSAnimations::calculateTransitionUpdate(CSSAnimationUpdate* update, const
     if (activeTransitions) {
         for (const auto& entry : *activeTransitions) {
             CSSPropertyID id = entry.key;
-            if (!anyTransitionHadTransitionAll && !animationStyleRecalc && !listedProperties.get(id)) {
+            if (!anyTransitionHadTransitionAll && !animationStyleRecalc && !listedProperties.get(id - firstCSSProperty)) {
                 // TODO: Figure out why this fails on Chrome OS login page. crbug.com/365507
                 // ASSERT(animation.playStateInternal() == Animation::Finished || !(elementAnimations && elementAnimations->isAnimationStyleChange()));
                 update->cancelTransition(id);