[webkit-changes] [132838] branches/chromium/1271

Mon, 29 Oct 2012 12:27:48 -0700

Title: [132838] branches/chromium/1271

Diff

Copied: branches/chromium/1271/LayoutTests/svg/custom/elementTimeControl-nan-crash-expected.txt (from rev 132724, trunk/LayoutTests/svg/custom/elementTimeControl-nan-crash-expected.txt) (0 => 132838)


--- branches/chromium/1271/LayoutTests/svg/custom/elementTimeControl-nan-crash-expected.txt	                        (rev 0)
+++ branches/chromium/1271/LayoutTests/svg/custom/elementTimeControl-nan-crash-expected.txt	2012-10-29 19:29:12 UTC (rev 132838)
@@ -0,0 +1 @@
+Test for WK100322: ElementTimeControl should check for invalid values. This test passes if it does not crash.

Copied: branches/chromium/1271/LayoutTests/svg/custom/elementTimeControl-nan-crash.html (from rev 132724, trunk/LayoutTests/svg/custom/elementTimeControl-nan-crash.html) (0 => 132838)


--- branches/chromium/1271/LayoutTests/svg/custom/elementTimeControl-nan-crash.html	                        (rev 0)
+++ branches/chromium/1271/LayoutTests/svg/custom/elementTimeControl-nan-crash.html	2012-10-29 19:29:12 UTC (rev 132838)
@@ -0,0 +1,25 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+    function crash() {
+        var animate = document.getElementById('animate');
+        var svg = document.getElementById('svg');
+        animate.endElementAt(NaN);
+        animate.beginElementAt(NaN);
+        svg.setCurrentTime(2);
+        if (window.testRunner)
+            testRunner.dumpAsText();
+    }
+</script>
+</head>
+<body _onload_="crash()">
+Test for WK100322: ElementTimeControl should check for invalid values. This test passes if it does not crash.
+
+<svg id="svg" width="200" height="200">
+    <rect x="0" y="0" width="100" height="100" fill="green">
+        <animate id="animate" attributeName="x" to="200" begin="3s"/>
+    </rect>
+</svg>
+</body>
+</html>

Modified: branches/chromium/1271/Source/WebCore/svg/SVGAnimationElement.cpp (132837 => 132838)


--- branches/chromium/1271/Source/WebCore/svg/SVGAnimationElement.cpp	2012-10-29 19:22:49 UTC (rev 132837)
+++ branches/chromium/1271/Source/WebCore/svg/SVGAnimationElement.cpp	2012-10-29 19:29:12 UTC (rev 132838)
@@ -39,6 +39,7 @@
 #include "SVGNames.h"
 #include "SVGParserUtilities.h"
 #include "SVGStyledElement.h"
+#include <wtf/MathExtras.h>
 
 namespace WebCore {
 
@@ -240,6 +241,8 @@
 
 void SVGAnimationElement::beginElementAt(float offset)
 {
+    if (isnan(offset))
+        return;
     SMILTime elapsed = this->elapsed();
     addBeginTime(elapsed, elapsed + offset, SMILTimeWithOrigin::ScriptOrigin);
 }
@@ -251,6 +254,8 @@
 
 void SVGAnimationElement::endElementAt(float offset)
 {
+    if (isnan(offset))
+        return;
     SMILTime elapsed = this->elapsed();
     addEndTime(elapsed, elapsed + offset, SMILTimeWithOrigin::ScriptOrigin);
 }

Modified: branches/chromium/1271/Source/WebCore/svg/animation/SMILTime.h (132837 => 132838)


--- branches/chromium/1271/Source/WebCore/svg/animation/SMILTime.h	2012-10-29 19:22:49 UTC (rev 132837)
+++ branches/chromium/1271/Source/WebCore/svg/animation/SMILTime.h	2012-10-29 19:29:12 UTC (rev 132838)
@@ -29,13 +29,14 @@
 #if ENABLE(SVG)
 
 #include <algorithm>
+#include <wtf/MathExtras.h>
 
 namespace WebCore {
 
 class SMILTime {
 public:
     SMILTime() : m_time(0) { }
-    SMILTime(double time) : m_time(time) { }
+    SMILTime(double time) : m_time(time) { ASSERT(!isnan(time)); }
     SMILTime(const SMILTime& o) : m_time(o.m_time) { }
     
     static SMILTime unresolved() { return unresolvedValue; }

Modified: branches/chromium/1271/Source/WebCore/svg/animation/SVGSMILElement.cpp (132837 => 132838)


--- branches/chromium/1271/Source/WebCore/svg/animation/SVGSMILElement.cpp	2012-10-29 19:22:49 UTC (rev 132837)
+++ branches/chromium/1271/Source/WebCore/svg/animation/SVGSMILElement.cpp	2012-10-29 19:29:12 UTC (rev 132838)
@@ -713,6 +713,7 @@
 
 void SVGSMILElement::addBeginTime(SMILTime eventTime, SMILTime beginTime, SMILTimeWithOrigin::Origin origin)
 {
+    ASSERT(!isnan(beginTime.value()));
     m_beginTimes.append(SMILTimeWithOrigin(beginTime, origin));
     sortTimeList(m_beginTimes);
     beginListChanged(eventTime);
@@ -720,6 +721,7 @@
 
 void SVGSMILElement::addEndTime(SMILTime eventTime, SMILTime endTime, SMILTimeWithOrigin::Origin origin)
 {
+    ASSERT(!isnan(endTime.value()));
     m_endTimes.append(SMILTimeWithOrigin(endTime, origin));
     sortTimeList(m_endTimes);
     endListChanged(eventTime);

_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo/webkit-changes

Reply via email to