Code: static WebTransformationMatrix blendTransformOperations(const WebTransformOperation* from, const WebTransformOperation* to, double progress)
 {
    WebTransformationMatrix toReturn;
     if (isIdentity(from) && isIdentity(to))
        return toReturn;
 
     WebTransformOperation::Type interpolationType = WebTransformOperation::WebTransformOperationIdentity;
     if (isIdentity(to))
        interpolationType = from->type;
    else
        interpolationType = to->type;

    switch (interpolationType) {
    case WebTransformOperation::WebTransformOperationTranslate: {
        double fromX = isIdentity(from) ? 0 : from->translate.x;
        double fromY = isIdentity(from) ? 0 : from->translate.y;
        double fromZ = isIdentity(from) ? 0 : from->translate.z;
         double toX = isIdentity(to) ? 0 : to->translate.x;
         double toY = isIdentity(to) ? 0 : to->translate.y;
         double toZ = isIdentity(to) ? 0 : to->translate.z;
        toReturn.translate3d(blendDoubles(fromX, toX, progress),
                             blendDoubles(fromY, toY, progress),
                             blendDoubles(fromZ, toZ, progress));
         break;
     }
     case WebTransformOperation::WebTransformOperationRotate: {
        double axisX = 0;
        double axisY = 0;
        double axisZ = 1;
         double fromAngle = 0;
         double toAngle = isIdentity(to) ? 0 : to->rotate.angle;
         if (shareSameAxis(from, to, axisX, axisY, axisZ, fromAngle))
            toReturn.rotate3d(axisX, axisY, axisZ, blendDoubles(fromAngle, toAngle, progress));
         else {
             WebTransformationMatrix toMatrix;
             if (!isIdentity(to))
                 toMatrix = to->matrix;
             WebTransformationMatrix fromMatrix;
             if (!isIdentity(from))
                 fromMatrix = from->matrix;
            toReturn = toMatrix;
            toReturn.blend(fromMatrix, progress);
         }
         break;
     }
    case WebTransformOperation::WebTransformOperationScale: {
        double fromX = isIdentity(from) ? 1 : from->scale.x;
        double fromY = isIdentity(from) ? 1 : from->scale.y;
        double fromZ = isIdentity(from) ? 1 : from->scale.z;
         double toX = isIdentity(to) ? 1 : to->scale.x;
         double toY = isIdentity(to) ? 1 : to->scale.y;
         double toZ = isIdentity(to) ? 1 : to->scale.z;
        toReturn.scale3d(blendDoubles(fromX, toX, progress),
                         blendDoubles(fromY, toY, progress),
                         blendDoubles(fromZ, toZ, progress));
         break;
     }
     case WebTransformOperation::WebTransformOperationSkew: {
         double fromX = isIdentity(from) ? 0 : from->skew.x;
         double fromY = isIdentity(from) ? 0 : from->skew.y;
         double toX = isIdentity(to) ? 0 : to->skew.x;
         double toY = isIdentity(to) ? 0 : to->skew.y;
        toReturn.skewX(blendDoubles(fromX, toX, progress));
        toReturn.skewY(blendDoubles(fromY, toY, progress));
         break;
     }
     case WebTransformOperation::WebTransformOperationPerspective: {
         double fromPerspectiveDepth = isIdentity(from) ? numeric_limits<double>::max() : from->perspectiveDepth;
         double toPerspectiveDepth = isIdentity(to) ? numeric_limits<double>::max() : to->perspectiveDepth;
        toReturn.applyPerspective(blendDoubles(fromPerspectiveDepth, toPerspectiveDepth, progress));
         break;
     }
     case WebTransformOperation::WebTransformOperationMatrix: {
        WebTransformationMatrix toMatrix;
        if (!isIdentity(to))
            toMatrix = to->matrix;
         WebTransformationMatrix fromMatrix;
         if (!isIdentity(from))
             fromMatrix = from->matrix;
        toReturn = toMatrix;
        toReturn.blend(fromMatrix, progress);
         break;
     }
     case WebTransformOperation::WebTransformOperationIdentity:
         break;
     }
 
    return toReturn;
 }

Vulnerability Type: DoS Overflow 
CWE ID: CWE-119
Summary: The PDF functionality in Google Chrome before 19.0.1084.52 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger out-of-bounds write operations.
Commit Message: [chromium] We should accelerate all transformations, except when we must blend matrices that cannot be decomposed.
https://bugs.webkit.org/show_bug.cgi?id=95855

Reviewed by James Robinson.

Source/Platform:

WebTransformOperations are now able to report if they can successfully blend.
WebTransformationMatrix::blend now returns a bool if blending would fail.

* chromium/public/WebTransformOperations.h:
(WebTransformOperations):
* chromium/public/WebTransformationMatrix.h:
(WebTransformationMatrix):

Source/WebCore:

WebTransformOperations are now able to report if they can successfully blend.
WebTransformationMatrix::blend now returns a bool if blending would fail.

Unit tests:
  AnimationTranslationUtilTest.createTransformAnimationWithNonDecomposableMatrix
  AnimationTranslationUtilTest.createTransformAnimationWithNonInvertibleTransform

* platform/chromium/support/WebTransformOperations.cpp:
(WebKit::blendTransformOperations):
(WebKit::WebTransformOperations::blend):
(WebKit::WebTransformOperations::canBlendWith):
(WebKit):
(WebKit::WebTransformOperations::blendInternal):
* platform/chromium/support/WebTransformationMatrix.cpp:
(WebKit::WebTransformationMatrix::blend):
* platform/graphics/chromium/AnimationTranslationUtil.cpp:
(WebCore::WebTransformAnimationCurve):

Source/WebKit/chromium:

Added the following unit tests:
  AnimationTranslationUtilTest.createTransformAnimationWithNonDecomposableMatrix
  AnimationTranslationUtilTest.createTransformAnimationWithNonInvertibleTransform

* tests/AnimationTranslationUtilTest.cpp:
(WebKit::TEST):
(WebKit):


git-svn-id: svn://svn.chromium.org/blink/trunk@127868 bbb929c8-8fbe-4397-9dbb-9b2b20218538