Code:  WebTransformationMatrix WebTransformOperations::blend(const WebTransformOperations& from, double progress) const
 {
     WebTransformationMatrix toReturn;
    bool fromIdentity = from.isIdentity();
    bool toIdentity = isIdentity();
    if (fromIdentity && toIdentity)
        return toReturn;
    if (matchesTypes(from)) {
        size_t numOperations = max(fromIdentity ? 0 : from.m_private->operations.size(),
                                   toIdentity ? 0 : m_private->operations.size());
        for (size_t i = 0; i < numOperations; ++i) {
            WebTransformationMatrix blended = blendTransformOperations(
                fromIdentity ? 0 : &from.m_private->operations[i],
                toIdentity ? 0 : &m_private->operations[i],
                progress);
            toReturn.multiply(blended);
        }
    } else {
        toReturn = apply();
        WebTransformationMatrix fromTransform = from.apply();
        toReturn.blend(fromTransform, progress);
    }
     return toReturn;
 }

Vulnerability Type: DoS Overflow 
CWE ID: CWE-119
Summary: The PDF functionality in Google Chrome before 19.0.1084.52 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger out-of-bounds write operations.
Commit Message: [chromium] We should accelerate all transformations, except when we must blend matrices that cannot be decomposed.
https://bugs.webkit.org/show_bug.cgi?id=95855

Reviewed by James Robinson.

Source/Platform:

WebTransformOperations are now able to report if they can successfully blend.
WebTransformationMatrix::blend now returns a bool if blending would fail.

* chromium/public/WebTransformOperations.h:
(WebTransformOperations):
* chromium/public/WebTransformationMatrix.h:
(WebTransformationMatrix):

Source/WebCore:

WebTransformOperations are now able to report if they can successfully blend.
WebTransformationMatrix::blend now returns a bool if blending would fail.

Unit tests:
  AnimationTranslationUtilTest.createTransformAnimationWithNonDecomposableMatrix
  AnimationTranslationUtilTest.createTransformAnimationWithNonInvertibleTransform

* platform/chromium/support/WebTransformOperations.cpp:
(WebKit::blendTransformOperations):
(WebKit::WebTransformOperations::blend):
(WebKit::WebTransformOperations::canBlendWith):
(WebKit):
(WebKit::WebTransformOperations::blendInternal):
* platform/chromium/support/WebTransformationMatrix.cpp:
(WebKit::WebTransformationMatrix::blend):
* platform/graphics/chromium/AnimationTranslationUtil.cpp:
(WebCore::WebTransformAnimationCurve):

Source/WebKit/chromium:

Added the following unit tests:
  AnimationTranslationUtilTest.createTransformAnimationWithNonDecomposableMatrix
  AnimationTranslationUtilTest.createTransformAnimationWithNonInvertibleTransform

* tests/AnimationTranslationUtilTest.cpp:
(WebKit::TEST):
(WebKit):


git-svn-id: svn://svn.chromium.org/blink/trunk@127868 bbb929c8-8fbe-4397-9dbb-9b2b20218538