Bug 31559 - Crash when accessing webkitTransition property after setting webkitTransitionProperty with invalid value.
Summary: Crash when accessing webkitTransition property after setting webkitTransition...
Alias: None
Product: WebKit
Classification: Unclassified
Component: WebCore Misc. (show other bugs)
Version: 528+ (Nightly build)
Hardware: PC OS X 10.5
: P2 Normal
Assignee: Simon Fraser (smfr)
Keywords: InRadar
Depends on:
Reported: 2009-11-16 09:41 PST by Matt Pennig
Modified: 2009-12-18 16:23 PST (History)
2 users (show)

See Also:

Reduction (WARNING: Will crash Safari/WebKit) (40 bytes, text/plain)
2009-11-16 09:43 PST, Matt Pennig
no flags Details
Testcase (248 bytes, text/html)
2009-12-16 12:44 PST, Simon Fraser (smfr)
no flags Details
Patch (4.37 KB, patch)
2009-12-18 16:17 PST, Simon Fraser (smfr)
darin: review+
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Matt Pennig 2009-11-16 09:41:06 PST
1) Get an element with CSS property -webkit-transition applied, or set it using JavaScript.
2) Set webkitTransitionProperty to some invalid value
3) Access webkitTransition property.

See attachment for reduction.
Comment 1 Matt Pennig 2009-11-16 09:43:32 PST
Created attachment 43311 [details]
Reduction (WARNING: Will crash Safari/WebKit)
Comment 2 Simon Fraser (smfr) 2009-12-16 12:42:43 PST
Comment 3 Simon Fraser (smfr) 2009-12-16 12:44:10 PST
Created attachment 45007 [details]
Comment 4 Simon Fraser (smfr) 2009-12-18 16:17:52 PST
Created attachment 45199 [details]
Comment 5 Simon Fraser (smfr) 2009-12-18 16:23:06 PST