Title: [123508] branches/chromium/1180
- Revision
- 123508
- Author
- fmal...@chromium.org
- Date
- 2012-07-24 12:40:53 -0700 (Tue, 24 Jul 2012)
Log Message
Merge 122755 - SVGAnimationElement::currentValuesForValuesAnimation crash
https://bugs.webkit.org/show_bug.cgi?id=91326
Reviewed by Simon Fraser.
SVGSMILElement::progress() assumes that seekToIntervalCorrespondingToTime() always
lands inside a defined interval, but one can force arbitrary time offsets using
setCurrentTime(). This patch adds logic for handling non-interval time offsets
gracefully.
Source/WebCore:
Test: svg/animations/smil-setcurrenttime-crash.svg
* svg/animation/SVGSMILElement.cpp:
(WebCore::SVGSMILElement::progress):
LayoutTests:
* svg/animations/smil-setcurrenttime-crash-expected.txt: Added.
* svg/animations/smil-setcurrenttime-crash.svg: Added.
TBR=fmal...@chromium.org
Review URL: https://chromiumcodereview.appspot.com/10802091
Modified Paths
Added Paths
Diff
Copied: branches/chromium/1180/LayoutTests/svg/animations/smil-setcurrenttime-crash-expected.txt (from rev 122755, trunk/LayoutTests/svg/animations/smil-setcurrenttime-crash-expected.txt) (0 => 123508)
--- branches/chromium/1180/LayoutTests/svg/animations/smil-setcurrenttime-crash-expected.txt (rev 0)
+++ branches/chromium/1180/LayoutTests/svg/animations/smil-setcurrenttime-crash-expected.txt 2012-07-24 19:40:53 UTC (rev 123508)
@@ -0,0 +1 @@
+PASS: not crashing.
Copied: branches/chromium/1180/LayoutTests/svg/animations/smil-setcurrenttime-crash.svg (from rev 122755, trunk/LayoutTests/svg/animations/smil-setcurrenttime-crash.svg) (0 => 123508)
--- branches/chromium/1180/LayoutTests/svg/animations/smil-setcurrenttime-crash.svg (rev 0)
+++ branches/chromium/1180/LayoutTests/svg/animations/smil-setcurrenttime-crash.svg 2012-07-24 19:40:53 UTC (rev 123508)
@@ -0,0 +1,16 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<svg version="1.1" xmlns="http://www.w3.org/2000/svg">
+ <!-- Test for https://bugs.webkit.org/show_bug.cgi?id=91326 -->
+ <rect>
+ <animate attributeName="fill" begin="1s; 10s" dur="3s" fill="freeze" values="#000;#fff"/>
+ </rect>
+ <text>PASS: not crashing.</text>
+
+ <script>
+ if (window.testRunner)
+ testRunner.dumpAsText();
+
+ document.documentElement.setCurrentTime(5);
+ </script>
+</svg>
+
Modified: branches/chromium/1180/Source/WebCore/svg/animation/SVGSMILElement.cpp (123507 => 123508)
--- branches/chromium/1180/Source/WebCore/svg/animation/SVGSMILElement.cpp 2012-07-24 19:40:26 UTC (rev 123507)
+++ branches/chromium/1180/Source/WebCore/svg/animation/SVGSMILElement.cpp 2012-07-24 19:40:53 UTC (rev 123508)
@@ -1045,7 +1045,11 @@
// This call may obtain a new interval -- never call calculateAnimationPercentAndRepeat() before!
if (seekToTime) {
seekToIntervalCorrespondingToTime(elapsed);
- ASSERT(elapsed >= m_intervalBegin);
+ if (elapsed < m_intervalBegin) {
+ // elapsed is not within an interval.
+ m_nextProgressTime = m_intervalBegin;
+ return false;
+ }
}
unsigned repeat = 0;
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
http://lists.webkit.org/mailman/listinfo/webkit-changes
