Created attachment 180125 [details] repro.html Detailed report: https://cluster-fuzz.appspot.com/testcase?key=149785711 Crash address 0x000000000000 Crash state - crash stack - WebCore::RefCountedPropertyWrapper<WebCore::ClipPathOperation>::blend WebCore::CSSPropertyAnimation::blendProperties WebCore::KeyframeAnimation::getAnimatedStyle
CSSPropertyAnimation.cpp: static inline PassRefPtr<ClipPathOperation> blendFunc(const AnimationBase*, ClipPathOperation* from, ClipPathOperation* to, double progress) { // Other clip-path operations than BasicShapes can not be animated. if (from->getOperationType() != ClipPathOperation::SHAPE || to->getOperationType() != ClipPathOperation::SHAPE) return to; ... Looking at repro.html, 0% { // no -webkit-clip-path ... } 100% { ... -webkit-clip-path: ... } Since 0% has no -webkit-clip-path, from would be NULL and from->getOperationType() crashes.
Created attachment 210547 [details] Patch
Comment on attachment 210547 [details] Patch Clearing flags on attachment: 210547 Committed r155105: <http://trac.webkit.org/changeset/155105>
All reviewed patches have been landed. Closing bug.
*** Bug 119579 has been marked as a duplicate of this bug. ***