DescriptionMerge 122755 - SVGAnimationElement::currentValuesForValuesAnimation crash
https://bugs.webkit.org/show_bug.cgi?id=91326
Reviewed by Simon Fraser.
SVGSMILElement::progress() assumes that seekToIntervalCorrespondingToTime() always
lands inside a defined interval, but one can force arbitrary time offsets using
setCurrentTime(). This patch adds logic for handling non-interval time offsets
gracefully.
Source/WebCore:
Test: svg/animations/smil-setcurrenttime-crash.svg
* svg/animation/SVGSMILElement.cpp:
(WebCore::SVGSMILElement::progress):
LayoutTests:
* svg/animations/smil-setcurrenttime-crash-expected.txt: Added.
* svg/animations/smil-setcurrenttime-crash.svg: Added.
TBR=fmalita@chromium.org
Committed: https://src.chromium.org/viewvc/chrome?view=rev&revision=123508
Patch Set 1 #
Messages
Total messages: 1 (0 generated)
|