<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
<!DOCTYPE bugzilla SYSTEM "https://bugs.webkit.org/page.cgi?id=bugzilla.dtd">

<bugzilla version="5.0.4.1"
          urlbase="https://bugs.webkit.org/"
          
          maintainer="admin@webkit.org"
>

    <bug>
          <bug_id>60062</bug_id>
          <alias>CVE-2011-2336</alias>
          <creation_ts>2011-05-03 14:07:06 -0700</creation_ts>
          <short_desc>Interrupted transitions are not correctly removed</short_desc>
          <delta_ts>2011-06-03 11:17:38 -0700</delta_ts>
          <reporter_accessible>1</reporter_accessible>
          <cclist_accessible>1</cclist_accessible>
          <classification_id>1</classification_id>
          <classification>Unclassified</classification>
          <product>WebKit</product>
          <component>CSS</component>
          <version>528+ (Nightly build)</version>
          <rep_platform>All</rep_platform>
          <op_sys>OS X 10.5</op_sys>
          <bug_status>RESOLVED</bug_status>
          <resolution>FIXED</resolution>
          
          
          <bug_file_loc></bug_file_loc>
          <status_whiteboard></status_whiteboard>
          <keywords>InRadar</keywords>
          <priority>P2</priority>
          <bug_severity>Normal</bug_severity>
          <target_milestone>---</target_milestone>
          
          
          <everconfirmed>1</everconfirmed>
          <reporter name="Dean Jackson">dino</reporter>
          <assigned_to name="Dean Jackson">dino</assigned_to>
          <cc>cevans</cc>
    
    <cc>cmarrin</cc>
    
    <cc>simon.fraser</cc>
          

      

      

      

          <comment_sort_order>oldest_to_newest</comment_sort_order>  
          <long_desc isprivate="0" >
    <commentid>397372</commentid>
    <comment_count>0</comment_count>
    <who name="Dean Jackson">dino</who>
    <bug_when>2011-05-03 14:07:06 -0700</bug_when>
    <thetext>When a CompositeAnimation creates a new transition for a property, it removes an existing transition if one exists. At the moment it simply deletes it from its list, but since it could potentially be in the list of animations waiting for start time, it isn&apos;t being cleared. 

&lt;rdar://problem/9326422&gt;</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>397417</commentid>
    <comment_count>1</comment_count>
      <attachid>92139</attachid>
    <who name="Dean Jackson">dino</who>
    <bug_when>2011-05-03 14:56:28 -0700</bug_when>
    <thetext>Created attachment 92139
Sample test

Incomplete test</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>397498</commentid>
    <comment_count>2</comment_count>
      <attachid>92156</attachid>
    <who name="Dean Jackson">dino</who>
    <bug_when>2011-05-03 16:15:34 -0700</bug_when>
    <thetext>Created attachment 92156
Patch</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>397577</commentid>
    <comment_count>3</comment_count>
    <who name="Dean Jackson">dino</who>
    <bug_when>2011-05-03 17:32:23 -0700</bug_when>
    <thetext>http://trac.webkit.org/changeset/85693</thetext>
  </long_desc>
      
          <attachment
              isobsolete="0"
              ispatch="0"
              isprivate="0"
          >
            <attachid>92139</attachid>
            <date>2011-05-03 14:56:28 -0700</date>
            <delta_ts>2011-05-03 14:56:28 -0700</delta_ts>
            <desc>Sample test</desc>
            <filename>interrupted-transition.html</filename>
            <type>text/html</type>
            <size>1392</size>
            <attacher name="Dean Jackson">dino</attacher>
            
              <data encoding="base64">PGh0bWw+CjxoZWFkPgo8c3R5bGU+CiNib3ggewoJcG9zaXRpb246IHJlbGF0aXZlOwoJd2lkdGg6
IDEwcHg7CgloZWlnaHQ6IDEwcHg7CgliYWNrZ3JvdW5kLWNvbG9yOiBncmVlbjsKCS13ZWJraXQt
dHJhbnNmb3JtOiB0cmFuc2xhdGUzZCgwLCAwLCAwKTsKCS13ZWJraXQtdHJhbnNpdGlvbjogLXdl
YmtpdC10cmFuc2Zvcm0gMC41czsKfQo8L3N0eWxlPgo8c2NyaXB0PgppZiAod2luZG93LmxheW91
dFRlc3RDb250cm9sbGVyKSB7Cgl3aW5kb3cubGF5b3V0VGVzdENvbnRyb2xsZXIuZHVtcEFzVGV4
dCgpOwoJd2luZG93LmxheW91dFRlc3RDb250cm9sbGVyLndhaXRVbnRpbERvbmUoKTsKfQoKdmFy
IE5VTUJFUl9PRl9JTlRFUlJVUFRJT05TID0gMTA7CnZhciBpbnRlcnJ1cHRpb25Db3VudCA9IDA7
CnZhciBib3g7CgpmdW5jdGlvbiBpbnRlcnJ1cHRUcmFuc2l0aW9uKCkgewoJaWYgKGludGVycnVw
dGlvbkNvdW50IDw9IE5VTUJFUl9PRl9JTlRFUlJVUFRJT05TKSB7CgkJaW50ZXJydXB0aW9uQ291
bnQrKzsKCQlib3guc3R5bGUud2Via2l0VHJhbnNmb3JtID0gJ3RyYW5zbGF0ZTNkKCcgKyAoaW50
ZXJydXB0aW9uQ291bnQgKiAzMCkgKyAicHgsIDAsIDApIjsKCQkvLyBjYWxsIHRoZSBmdW5jdGlv
biBhZ2FpbiwgYmVmb3JlIHRoZSB0cmFuc2l0aW9uIGNhbiBjb21wbGV0ZQoJCXNldFRpbWVvdXQo
aW50ZXJydXB0VHJhbnNpdGlvbiwgMTApOwoJCWNvbnNvbGUubG9nKCJpbnRlcnJ1cHRpbmcgIiAr
IGludGVycnVwdGlvbkNvdW50KTsKCX0KfQoKZnVuY3Rpb24gZmluaXNoVGVzdCgpIHsKCWNvbnNv
bGUubG9nKCJmaW5pc2hpbmcgIiArIGludGVycnVwdGlvbkNvdW50KTsKCXZhciByZXN1bHRzID0g
ZG9jdW1lbnQuZ2V0RWxlbWVudEJ5SWQoInJlc3VsdHMiKTsKCXJlc3VsdHMuaW5uZXJUZXh0ID0g
IlRoZSB0cmFuc2l0aW9uIGNvbXBsZXRlZCBzdWNjZXNzZnVsbHkuIjsKCQoJaWYgKHdpbmRvdy5s
YXlvdXRUZXN0Q29udHJvbGxlcikKCQl3aW5kb3cubGF5b3V0VGVzdENvbnRyb2xsZXIubm90aWZ5
RG9uZSgpOwp9Cgp3aW5kb3cuYWRkRXZlbnRMaXN0ZW5lcigibG9hZCIsIGZ1bmN0aW9uICgpIHsK
CWJveCA9IGRvY3VtZW50LmdldEVsZW1lbnRCeUlkKCJib3giKTsKCWJveC5hZGRFdmVudExpc3Rl
bmVyKCJ3ZWJraXRUcmFuc2l0aW9uRW5kIiwgZmluaXNoVGVzdCwgZmFsc2UpOwoJLy8gc3RhcnQg
dGhlIHJ1c2ggb2YgaW50ZXJydXB0aW9ucwoJc2V0VGltZW91dChpbnRlcnJ1cHRUcmFuc2l0aW9u
LCAxMCk7Cn0sIGZhbHNlKTsKCjwvc2NyaXB0Pgo8L2hlYWQ+Cjxib2R5PgogPGRpdiBpZD0iYm94
Ij48L2Rpdj4KIDxwPlRoaXMgdGVzdCBzaG91bGQgbm90IGNyYXNoPC9wPgogPHAgaWQ9InJlc3Vs
dHMiPjwvcD4KPC9ib2R5Pgo8L2h0bWw+
</data>

          </attachment>
          <attachment
              isobsolete="0"
              ispatch="1"
              isprivate="0"
          >
            <attachid>92156</attachid>
            <date>2011-05-03 16:15:34 -0700</date>
            <delta_ts>2011-05-03 16:31:26 -0700</delta_ts>
            <desc>Patch</desc>
            <filename>anim.patch</filename>
            <type>text/plain</type>
            <size>4358</size>
            <attacher name="Dean Jackson">dino</attacher>
            
              <data encoding="base64">ZGlmZiAtLWdpdCBhL0xheW91dFRlc3RzL0NoYW5nZUxvZyBiL0xheW91dFRlc3RzL0NoYW5nZUxv
ZwppbmRleCBkNjc3Y2NmLi43NmNkMTgyIDEwMDY0NAotLS0gYS9MYXlvdXRUZXN0cy9DaGFuZ2VM
b2cKKysrIGIvTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCkBAIC0xLDMgKzEsMTMgQEAKKzIwMTEtMDUt
MDMgIERlYW4gSmFja3NvbiAgPGRpbm9AYXBwbGUuY29tPgorCisgICAgICAgIFJldmlld2VkIGJ5
IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIEludGVycnVwdGVkIHRyYW5zaXRpb25zIGFyZSBu
b3QgY29ycmVjdGx5IHJlbW92ZWQKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hv
d19idWcuY2dpP2lkPTYwMDYyCisgICAgICAgIAorICAgICAgICAqIHRyYW5zaXRpb25zLzNkL2lu
dGVycnVwdGVkLXRyYW5zaXRpb24tZXhwZWN0ZWQudHh0OiBBZGRlZC4KKyAgICAgICAgKiB0cmFu
c2l0aW9ucy8zZC9pbnRlcnJ1cHRlZC10cmFuc2l0aW9uLmh0bWw6IEFkZGVkLgorCiAyMDExLTA1
LTAyICBBYmhpc2hlayBBcnlhICA8aW5mZXJub0BjaHJvbWl1bS5vcmc+CiAKICAgICAgICAgVW5y
ZXZpZXdlZC4KZGlmZiAtLWdpdCBhL0xheW91dFRlc3RzL3RyYW5zaXRpb25zLzNkL2ludGVycnVw
dGVkLXRyYW5zaXRpb24tZXhwZWN0ZWQudHh0IGIvTGF5b3V0VGVzdHMvdHJhbnNpdGlvbnMvM2Qv
aW50ZXJydXB0ZWQtdHJhbnNpdGlvbi1leHBlY3RlZC50eHQKbmV3IGZpbGUgbW9kZSAxMDA2NDQK
aW5kZXggMDAwMDAwMC4uMmU1M2Q5ZQotLS0gL2Rldi9udWxsCisrKyBiL0xheW91dFRlc3RzL3Ry
YW5zaXRpb25zLzNkL2ludGVycnVwdGVkLXRyYW5zaXRpb24tZXhwZWN0ZWQudHh0CkBAIC0wLDAg
KzEsMyBAQAorVGhpcyB0ZXN0IHNob3VsZCBub3QgY3Jhc2gKKworVGhlIHRyYW5zaXRpb24gY29t
cGxldGVkIHN1Y2Nlc3NmdWxseS4KZGlmZiAtLWdpdCBhL0xheW91dFRlc3RzL3RyYW5zaXRpb25z
LzNkL2ludGVycnVwdGVkLXRyYW5zaXRpb24uaHRtbCBiL0xheW91dFRlc3RzL3RyYW5zaXRpb25z
LzNkL2ludGVycnVwdGVkLXRyYW5zaXRpb24uaHRtbApuZXcgZmlsZSBtb2RlIDEwMDY0NAppbmRl
eCAwMDAwMDAwLi5hOTY1ZjM1Ci0tLSAvZGV2L251bGwKKysrIGIvTGF5b3V0VGVzdHMvdHJhbnNp
dGlvbnMvM2QvaW50ZXJydXB0ZWQtdHJhbnNpdGlvbi5odG1sCkBAIC0wLDAgKzEsNTUgQEAKKzxo
dG1sPgorPGhlYWQ+Cis8c3R5bGU+CisjYm94IHsKKyAgICBwb3NpdGlvbjogcmVsYXRpdmU7Cisg
ICAgd2lkdGg6IDEwcHg7CisgICAgaGVpZ2h0OiAxMHB4OworICAgIGJhY2tncm91bmQtY29sb3I6
IGdyZWVuOworICAgIC13ZWJraXQtdHJhbnNmb3JtOiB0cmFuc2xhdGUzZCgwLCAwLCAwKTsKKyAg
ICAtd2Via2l0LXRyYW5zaXRpb246IC13ZWJraXQtdHJhbnNmb3JtIDIwMG1zIGxpbmVhcjsKK30K
Kzwvc3R5bGU+Cis8c2NyaXB0PgorCitpZiAod2luZG93LmxheW91dFRlc3RDb250cm9sbGVyKSB7
CisgICAgd2luZG93LmxheW91dFRlc3RDb250cm9sbGVyLmR1bXBBc1RleHQoKTsKKyAgICB3aW5k
b3cubGF5b3V0VGVzdENvbnRyb2xsZXIud2FpdFVudGlsRG9uZSgpOworfQorCit2YXIgTlVNQkVS
X09GX0lOVEVSUlVQVElPTlMgPSAzMDsKK3ZhciBpbnRlcnJ1cHRpb25Db3VudCA9IDA7Cit2YXIg
Ym94OworCitmdW5jdGlvbiBpbnRlcnJ1cHRUcmFuc2l0aW9uKCkgeworICAgIGlmIChpbnRlcnJ1
cHRpb25Db3VudCA8PSBOVU1CRVJfT0ZfSU5URVJSVVBUSU9OUykgeworICAgICAgICBpbnRlcnJ1
cHRpb25Db3VudCsrOworICAgICAgICBib3guc3R5bGUud2Via2l0VHJhbnNmb3JtID0gJ3RyYW5z
bGF0ZTNkKCcgKyAoaW50ZXJydXB0aW9uQ291bnQgKiA1KSArICJweCwgMCwgMCkiOworICAgICAg
ICAvLyBjYWxsIHRoZSBmdW5jdGlvbiBhZ2FpbiwgYmVmb3JlIHRoZSB0cmFuc2l0aW9uIGNhbiBj
b21wbGV0ZQorICAgICAgICBzZXRUaW1lb3V0KGludGVycnVwdFRyYW5zaXRpb24sIDApOworICAg
IH0KK30KKworZnVuY3Rpb24gZmluaXNoVGVzdCgpIHsKKyAgICB2YXIgcmVzdWx0cyA9IGRvY3Vt
ZW50LmdldEVsZW1lbnRCeUlkKCJyZXN1bHRzIik7CisgICAgcmVzdWx0cy5pbm5lclRleHQgPSAi
VGhlIHRyYW5zaXRpb24gY29tcGxldGVkIHN1Y2Nlc3NmdWxseS4iOworICAgIAorICAgIGlmICh3
aW5kb3cubGF5b3V0VGVzdENvbnRyb2xsZXIpCisgICAgICAgIHdpbmRvdy5sYXlvdXRUZXN0Q29u
dHJvbGxlci5ub3RpZnlEb25lKCk7Cit9CisKK3dpbmRvdy5hZGRFdmVudExpc3RlbmVyKCJsb2Fk
IiwgZnVuY3Rpb24gKCkgeworICAgIGJveCA9IGRvY3VtZW50LmdldEVsZW1lbnRCeUlkKCJib3gi
KTsKKyAgICBib3guYWRkRXZlbnRMaXN0ZW5lcigid2Via2l0VHJhbnNpdGlvbkVuZCIsIGZpbmlz
aFRlc3QsIGZhbHNlKTsKKyAgICAvLyBzdGFydCB0aGUgcnVzaCBvZiBpbnRlcnJ1cHRpb25zCisg
ICAgc2V0VGltZW91dChpbnRlcnJ1cHRUcmFuc2l0aW9uLCAxMCk7Cit9LCBmYWxzZSk7CisKKzwv
c2NyaXB0PgorPC9oZWFkPgorPGJvZHk+CisgPGRpdiBpZD0iYm94Ij48L2Rpdj4KKyA8cD5UaGlz
IHRlc3Qgc2hvdWxkIG5vdCBjcmFzaDwvcD4KKyA8cCBpZD0icmVzdWx0cyI+PC9wPgorPC9ib2R5
PgorPC9odG1sPgpcIE5vIG5ld2xpbmUgYXQgZW5kIG9mIGZpbGUKZGlmZiAtLWdpdCBhL1NvdXJj
ZS9XZWJDb3JlL0NoYW5nZUxvZyBiL1NvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZwppbmRleCBkNDNl
ZTM1Li44MWNkYTkyIDEwMDY0NAotLS0gYS9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKKysrIGIv
U291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCkBAIC0xLDMgKzEsMjIgQEAKKzIwMTEtMDUtMDMgIERl
YW4gSmFja3NvbiAgPGRpbm9AYXBwbGUuY29tPgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9E
WSAoT09QUyEpLgorCisgICAgICAgIEludGVycnVwdGVkIHRyYW5zaXRpb25zIGFyZSBub3QgY29y
cmVjdGx5IHJlbW92ZWQKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcu
Y2dpP2lkPTYwMDYyCisKKyAgICAgICAgQ29tcG9zaXRlQW5pbWF0aW9uIHdhcyByZXBsYWNpbmcg
YW55IGV4aXN0aW5nCisgICAgICAgIHRyYW5zaXRpb24gYXMgYSBuZXcgb25lIHdhcyBjcmVhdGVk
LiBIb3dldmVyLCBpdCB3YXNuJ3QKKyAgICAgICAgY2xlYXJpbmcgdGhlIGxpc3RzIGluIEFuaW1h
dGlvbkNvbnRyb2xsZXJQcml2YXRlIHRoYXQKKyAgICAgICAgc2lnbmFsIHdoZW4gYSBoYXJkd2Fy
ZSBhbmltYXRpb24gc3RhcnRzLiBSYXRoZXIgdGhhbgorICAgICAgICBzaW1wbGUgcmVtb3Zpbmcg
dGhlIGV4aXN0aW5nIHRyYW5zaXRpb24sIHdlIG5vdyB0ZWxsCisgICAgICAgIEFuaW1hdGlvbkNv
bnRyb2xsZXJQcml2YXRlIHRoYXQgaXMgaGFzIGdvbmUuCisKKyAgICAgICAgVGVzdDogdHJhbnNp
dGlvbnMvM2QvaW50ZXJydXB0ZWQtdHJhbnNpdGlvbi5odG1sCisKKyAgICAgICAgKiBwYWdlL2Fu
aW1hdGlvbi9Db21wb3NpdGVBbmltYXRpb24uY3BwOgorICAgICAgICAoV2ViQ29yZTo6Q29tcG9z
aXRlQW5pbWF0aW9uOjp1cGRhdGVUcmFuc2l0aW9ucyk6CisKIDIwMTEtMDUtMDIgIFNhbSBXZWlu
aWcgIDxzYW1Ad2Via2l0Lm9yZz4KIAogICAgICAgICBSZXZpZXdlZCBieSBBbmRlcnMgQ2FybHNz
b24uCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9wYWdlL2FuaW1hdGlvbi9Db21wb3NpdGVB
bmltYXRpb24uY3BwIGIvU291cmNlL1dlYkNvcmUvcGFnZS9hbmltYXRpb24vQ29tcG9zaXRlQW5p
bWF0aW9uLmNwcAppbmRleCAyOWIzMmViLi4wN2U1NTg0IDEwMDY0NAotLS0gYS9Tb3VyY2UvV2Vi
Q29yZS9wYWdlL2FuaW1hdGlvbi9Db21wb3NpdGVBbmltYXRpb24uY3BwCisrKyBiL1NvdXJjZS9X
ZWJDb3JlL3BhZ2UvYW5pbWF0aW9uL0NvbXBvc2l0ZUFuaW1hdGlvbi5jcHAKQEAgLTE1MSw2ICsx
NTEsNyBAQCB2b2lkIENvbXBvc2l0ZUFuaW1hdGlvbjo6dXBkYXRlVHJhbnNpdGlvbnMoUmVuZGVy
T2JqZWN0KiByZW5kZXJlciwgUmVuZGVyU3R5bGUqCiAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgaW1wbEFuaW0tPmJsZW5kUHJvcGVydHlWYWx1ZUluU3R5bGUocHJvcCwgbW9kaWZpZWRDdXJy
ZW50U3R5bGUuZ2V0KCkpOwogICAgICAgICAgICAgICAgICAgICAgICAgfQogICAgICNlbmRpZgor
ICAgICAgICAgICAgICAgICAgICAgICAgYW5pbWF0aW9uQ29udHJvbGxlcigpLT5hbmltYXRpb25X
aWxsQmVSZW1vdmVkKGltcGxBbmltKTsKICAgICAgICAgICAgICAgICAgICAgICAgIG1fdHJhbnNp
dGlvbnMucmVtb3ZlKHByb3ApOwogICAgICAgICAgICAgICAgICAgICAgICAgZXF1YWwgPSBmYWxz
ZTsKICAgICAgICAgICAgICAgICAgICAgfQo=
</data>
<flag name="review"
          id="85095"
          type_id="1"
          status="+"
          setter="simon.fraser"
    />
          </attachment>
      

    </bug>

</bugzilla>