Attachment 357147 Details for Bug 192630 – Patch

[patch] Patch

bug-192630-20181212095538.patch (text/plain), 3.81 KB, created by Brent Fulgham on 2018-12-12 09:55:39 PST

(hide)

Description:

Filename:

MIME Type:

Creator: Brent Fulgham

Created: 2018-12-12 09:55:39 PST

Size: 3.81 KB

patch

obsolete

>Subversion Revision: 239107
>diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
>index c0ae4ec3cd36a93400445791c559a829babf673d..2fa0b2a3975e00805ef9c9987d82ea157eee4e6c 100644
>--- a/Source/WebCore/ChangeLog
>+++ b/Source/WebCore/ChangeLog
>@@ -1,3 +1,24 @@
>+2018-12-12  Brent Fulgham  <bfulgham@apple.com>
>+
>+        Don't attempt to animate invalid CSS properties
>+        https://bugs.webkit.org/show_bug.cgi?id=192630
>+        <rdar://problem/46664433>
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        Inherited animation properties can cause child elements to think they need to animate CSS properties
>+        that they do not support, leading to nullptr crashes.
>+
>+        Recognize that CSSPropertyInvalid is a potential requested animation property, and handle it
>+        cleanly.
>+
>+        Tests: animations/invalid-property-animation.html
>+
>+        * page/animation/CompositeAnimation.cpp:
>+        (WebCore::CompositeAnimation::updateTransitions):
>+        * svg/SVGAnimateElementBase.cpp:
>+        (WebCore::SVGAnimateElementBase::calculateAnimatedValue):
>+
> 2018-12-12  Wenson Hsieh  <wenson_hsieh@apple.com>
> 
>         [iOS] A few API tests are failing after r239086
>diff --git a/Source/WebCore/page/animation/CompositeAnimation.cpp b/Source/WebCore/page/animation/CompositeAnimation.cpp
>index b77a6c2fb3a3aa031f240646f7cf2913d44e050e..dcebf08eb5b4532b6cc25100a5af871161d694d7 100644
>--- a/Source/WebCore/page/animation/CompositeAnimation.cpp
>+++ b/Source/WebCore/page/animation/CompositeAnimation.cpp
>@@ -115,6 +115,12 @@ void CompositeAnimation::updateTransitions(Element& element, const RenderStyle*
>                         continue;
>                 }
> 
>+                if (prop == CSSPropertyInvalid) {
>+                    if (!all)
>+                        break;
>+                    continue;
>+                }
>+                
>                 // ImplicitAnimations are always hashed by actual properties, never animateAll.
>                 ASSERT(prop >= firstCSSProperty && prop < (firstCSSProperty + numCSSProperties));
> 
>diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
>index a94e75424981ce47b7be852787125b00e227a4ce..b9e632483fa0ec1455111f9a20b763078770ad33 100644
>--- a/LayoutTests/ChangeLog
>+++ b/LayoutTests/ChangeLog
>@@ -1,3 +1,14 @@
>+2018-12-12  Brent Fulgham  <bfulgham@apple.com>
>+
>+        Don't attempt to animate invalid CSS properties
>+        https://bugs.webkit.org/show_bug.cgi?id=192630
>+        <rdar://problem/46664433>
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        * animations/invalid-property-animation-expected.txt: Added.
>+        * animations/invalid-property-animation.html: Added.
>+
> 2018-12-12  Carlos Garcia Campos  <cgarcia@igalia.com>
> 
>         [FreeType] Remove HarfBuzzFace
>diff --git a/LayoutTests/animations/invalid-property-animation-expected.txt b/LayoutTests/animations/invalid-property-animation-expected.txt
>new file mode 100644
>index 0000000000000000000000000000000000000000..4fdde57ac92e9eaad0b5ede26073ba6388b25452
>--- /dev/null
>+++ b/LayoutTests/animations/invalid-property-animation-expected.txt
>@@ -0,0 +1,3 @@
>+The test passes if it does not crash.
>+
>+
>diff --git a/LayoutTests/animations/invalid-property-animation.html b/LayoutTests/animations/invalid-property-animation.html
>new file mode 100644
>index 0000000000000000000000000000000000000000..20d4bd3ac955cbe1b186a265a519dbb50ba57261
>--- /dev/null
>+++ b/LayoutTests/animations/invalid-property-animation.html
>@@ -0,0 +1,19 @@
>+<!DOCTYPE html> 
>+<html>
>+<head>
>+<script>
>+function runTest() {
>+    if (window.testRunner)
>+        testRunner.dumpAsText(true);
>+
>+    document.designMode = "off";
>+}
>+</script>
>+</head>
>+<body onload="runTest()">
>+    <p>The test passes if it does not crash.</p>
>+    <button style="transition: width">
>+        <embed style="transition-delay: inherit" src="x"></embed>
>+    </button>
>+</body>
>+</html>

Actions: View | Formatted Diff | Diff

Attachments on bug 192630: 357146 | 357147 | 357156