Changeset 256427 in webkit

Timestamp:

Feb 12, 2020 12:39:51 AM (4 years ago)

Author:

commit-queue@webkit.org

Message:

Fix crash due to uninitialized currentStyle in CSSTransition
​https://bugs.webkit.org/show_bug.cgi?id=205959
<rdar://57073673>

Patch by Sunny He <​sunny_he@apple.com> on 2020-02-12
Reviewed by Antoine Quint.

Source/WebCore:

Test: legacy-animation-engine/transitions/svg-bad-scale-crash.html

• animation/CSSTransition.cpp:

(WebCore::CSSTransition::create):
(WebCore::CSSTransition::CSSTransition):

• animation/CSSTransition.h:

LayoutTests:

Fix crash due to uninitialized currentStyle in CSSTransition

• legacy-animation-engine/transitions/svg-bad-scale-crash-expected.txt: Added.
• legacy-animation-engine/transitions/svg-bad-scale-crash.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/legacy-animation-engine/transitions/svg-bad-scale-crash-expected.txt (added)
• LayoutTests/legacy-animation-engine/transitions/svg-bad-scale-crash.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/animation/CSSTransition.cpp (modified) (2 diffs)
• Source/WebCore/animation/CSSTransition.h (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2020-02-12  Sunny He  <sunny_he@apple.com>
+
+        Fix crash due to uninitialized currentStyle in CSSTransition
+        https://bugs.webkit.org/show_bug.cgi?id=205959
+        <rdar://57073673>
+
+        Reviewed by Antoine Quint.
+
+        Fix crash due to uninitialized currentStyle in CSSTransition
+
+        * legacy-animation-engine/transitions/svg-bad-scale-crash-expected.txt: Added.
+        * legacy-animation-engine/transitions/svg-bad-scale-crash.html: Added.
+
 2020-02-11  Tomoki Imai  <Tomoki.Imai@sony.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2020-02-12  Sunny He  <sunny_he@apple.com>
+
+        Fix crash due to uninitialized currentStyle in CSSTransition
+        https://bugs.webkit.org/show_bug.cgi?id=205959
+        <rdar://57073673>
+
+        Reviewed by Antoine Quint.
+
+        Test: legacy-animation-engine/transitions/svg-bad-scale-crash.html
+
+        * animation/CSSTransition.cpp:
+        (WebCore::CSSTransition::create):
+        (WebCore::CSSTransition::CSSTransition):
+        * animation/CSSTransition.h:
+
 2020-02-11  Peng Liu  <peng.liu6@apple.com>
 

trunk/Source/WebCore/animation/CSSTransition.cpp

@@ -39 +39 @@
 Ref<CSSTransition> CSSTransition::create(Element& owningElement, CSSPropertyID property, MonotonicTime generationTime, const Animation& backingAnimation, const RenderStyle* oldStyle, const RenderStyle& newStyle, Seconds delay, Seconds duration, const RenderStyle& reversingAdjustedStartStyle, double reversingShorteningFactor)
 {
-    auto result = adoptRef(*new CSSTransition(owningElement, property, generationTime, backingAnimation, newStyle, reversingAdjustedStartStyle, reversingShorteningFactor));
+    ASSERT(oldStyle);
+    auto result = adoptRef(*new CSSTransition(owningElement, property, generationTime, backingAnimation, *oldStyle, newStyle, reversingAdjustedStartStyle, reversingShorteningFactor));
     result->initialize(oldStyle, newStyle);
     result->setTimingProperties(delay, duration);
@@ -48 +49 @@
 }
 
-CSSTransition::CSSTransition(Element& element, CSSPropertyID property, MonotonicTime generationTime, const Animation& backingAnimation, const RenderStyle& targetStyle, const RenderStyle& reversingAdjustedStartStyle, double reversingShorteningFactor)
+CSSTransition::CSSTransition(Element& element, CSSPropertyID property, MonotonicTime generationTime, const Animation& backingAnimation, const RenderStyle& oldStyle, const RenderStyle& targetStyle, const RenderStyle& reversingAdjustedStartStyle, double reversingShorteningFactor)
     : DeclarativeAnimation(element, backingAnimation)
     , m_property(property)
     , m_generationTime(generationTime)
     , m_targetStyle(RenderStyle::clonePtr(targetStyle))
+    , m_currentStyle(RenderStyle::clonePtr(oldStyle))
     , m_reversingAdjustedStartStyle(RenderStyle::clonePtr(reversingAdjustedStartStyle))
     , m_reversingShorteningFactor(reversingShorteningFactor)

trunk/Source/WebCore/animation/CSSTransition.h

@@ -54 +54 @@
 
 private:
-    CSSTransition(Element&, CSSPropertyID, MonotonicTime generationTime, const Animation&, const RenderStyle& targetStyle, const RenderStyle& reversingAdjustedStartStyle, double);
+    CSSTransition(Element&, CSSPropertyID, MonotonicTime generationTime, const Animation&, const RenderStyle& oldStyle, const RenderStyle& targetStyle, const RenderStyle& reversingAdjustedStartStyle, double);
     void setTimingProperties(Seconds delay, Seconds duration);