Bug 105408 – NULL ptr in WebCore::RefCountedPropertyWrapper<WebCore::ClipPathOperation>::blend

• Status: RESOLVED
• Resolution: FIXED
• Component: CSS

[Takashi Sakamoto]

Created attachment 180125 [details]
repro.html

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=149785711

Crash address	0x000000000000
Crash state	- crash stack -
WebCore::RefCountedPropertyWrapper<WebCore::ClipPathOperation>::blend
WebCore::CSSPropertyAnimation::blendProperties
WebCore::KeyframeAnimation::getAnimatedStyle

[Takashi Sakamoto]

CSSPropertyAnimation.cpp:

static inline PassRefPtr<ClipPathOperation> blendFunc(const AnimationBase*, ClipPathOperation* from, ClipPathOperation* to, double progress)
{
    // Other clip-path operations than BasicShapes can not be animated.         
    if (from->getOperationType() != ClipPathOperation::SHAPE || to->getOperationType() != ClipPathOperation::SHAPE)
        return to;
...

Looking at repro.html,

0% {
   // no -webkit-clip-path
   ...
}

100% {
   ...
   -webkit-clip-path: ...
}

Since 0% has no -webkit-clip-path, from would be NULL and from->getOperationType() crashes.

[Dirk Schulze]

Created attachment 210547 [details]
Patch

[WebKit Commit Bot]

Comment on attachment 210547 [details]
Patch

Clearing flags on attachment: 210547

Committed r155105: <http://trac.webkit.org/changeset/155105>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.

[Dirk Schulze]

*** Bug 119579 has been marked as a duplicate of this bug. ***