Bug 31559

Summary: Crash when accessing webkitTransition property after setting webkitTransitionProperty with invalid value.
Product: WebKit Reporter: Matt Pennig <pennig>
Component: WebCore Misc.Assignee: Simon Fraser (smfr) <simon.fraser>
Status: RESOLVED FIXED    
Severity: Normal CC: cmarrin, simon.fraser
Priority: P2 Keywords: InRadar
Version: 528+ (Nightly build)   
Hardware: PC   
OS: OS X 10.5   
Attachments:
Description Flags
Reduction (WARNING: Will crash Safari/WebKit)
none
Testcase
none
Patch darin: review+

Description Matt Pennig 2009-11-16 09:41:06 PST 
Scenario:
1) Get an element with CSS property -webkit-transition applied, or set it using JavaScript.
2) Set webkitTransitionProperty to some invalid value
3) Access webkitTransition property.

See attachment for reduction.
Comment 1 Matt Pennig 2009-11-16 09:43:32 PST 
Created attachment 43311 [details]
Reduction (WARNING: Will crash Safari/WebKit)
Comment 2 Simon Fraser (smfr) 2009-12-16 12:42:43 PST 
<rdar://problem/7477760>
Comment 3 Simon Fraser (smfr) 2009-12-16 12:44:10 PST 
Created attachment 45007 [details]
Testcase
Comment 4 Simon Fraser (smfr) 2009-12-18 16:17:52 PST 
Created attachment 45199 [details]
Patch
Comment 5 Simon Fraser (smfr) 2009-12-18 16:23:06 PST 
http://trac.webkit.org/changeset/52354