Web Animations CSS: Fix crash when transitioning background or mask properties

Source/core/rendering/style/FillLayer.cpp

 /*
  * Copyright (C) 1999 Antti Koivisto (koivisto@kde.org)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
  *
  * This library is distributed in the hope that it will be useful,
@@ skipping 22 matching lines @@
     Length m_yPosition;
 
     LengthSize m_sizeLength;
 
     unsigned m_bitfields: 32;
     unsigned m_bitfields2: 1;
 };
 
 COMPILE_ASSERT(sizeof(FillLayer) == sizeof(SameSizeAsFillLayer), FillLayer_should_stay_small);
 
-FillLayer::FillLayer(EFillLayerType type)
+FillLayer::FillLayer(EFillLayerType type, bool useInitialValues)
     : m_next(0)
     , m_image(FillLayer::initialFillImage(type))
     , m_xPosition(FillLayer::initialFillXPosition(type))
     , m_yPosition(FillLayer::initialFillYPosition(type))
     , m_sizeLength(FillLayer::initialFillSizeLength(type))
     , m_attachment(FillLayer::initialFillAttachment(type))
     , m_clip(FillLayer::initialFillClip(type))
     , m_origin(FillLayer::initialFillOrigin(type))
     , m_repeatX(FillLayer::initialFillRepeatX(type))
     , m_repeatY(FillLayer::initialFillRepeatY(type))
     , m_composite(FillLayer::initialFillComposite(type))
-    , m_sizeType(SizeNone) // SizeNone indicates size is unset.
+    , m_sizeType(useInitialValues ? FillLayer::initialFillSizeType(type) : SizeNone)
     , m_blendMode(FillLayer::initialFillBlendMode(type))
     , m_maskSourceType(FillLayer::initialFillMaskSourceType(type))
     , m_backgroundXOrigin(LeftEdge)
     , m_backgroundYOrigin(TopEdge)
-    , m_imageSet(false)
-    , m_attachmentSet(false)
-    , m_clipSet(false)
-    , m_originSet(false)
-    , m_repeatXSet(false)
-    , m_repeatYSet(false)
-    , m_xPosSet(false)
-    , m_yPosSet(false)
-    , m_backgroundXOriginSet(false)
-    , m_backgroundYOriginSet(false)
-    , m_compositeSet(type == MaskFillLayer)
-    , m_blendModeSet(false)
-    , m_maskSourceTypeSet(false)
+    , m_imageSet(useInitialValues)
+    , m_attachmentSet(useInitialValues)
+    , m_clipSet(useInitialValues)
+    , m_originSet(useInitialValues)
+    , m_repeatXSet(useInitialValues)
+    , m_repeatYSet(useInitialValues)
+    , m_xPosSet(useInitialValues)
+    , m_yPosSet(useInitialValues)
+    , m_backgroundXOriginSet(useInitialValues)
+    , m_backgroundYOriginSet(useInitialValues)
+    , m_compositeSet(useInitialValues || type == MaskFillLayer)
+    , m_blendModeSet(useInitialValues)
+    , m_maskSourceTypeSet(useInitialValues)
     , m_type(type)
 {
 }
 
 FillLayer::FillLayer(const FillLayer& o)
     : m_next(o.m_next ? new FillLayer(*o.m_next) : 0)
     , m_image(o.m_image)
     , m_xPosition(o.m_xPosition)
     , m_yPosition(o.m_yPosition)
     , m_sizeLength(o.m_sizeLength)
@@ skipping 286 matching lines @@
 
     return false;
 }
 
 bool FillLayer::hasRepeatXY() const
 {
     return m_repeatX == RepeatFill && m_repeatY == RepeatFill;
 }
 
 } // namespace WebCore