Title: [282508] releases/WebKitGTK/webkit-2.32/Source/WebCore
- Revision
- 282508
- Author
- [email protected]
- Date
- 2021-09-16 01:31:58 -0700 (Thu, 16 Sep 2021)
Log Message
Merge r276110 - Assertion failure in SVGAnimationElement::currentValuesForValuesAnimation
https://bugs.webkit.org/show_bug.cgi?id=222715
Reviewed by Ryosuke Niwa.
Replaced ASSERT_WITH_SECURITY_IMPLICATION by ASSERT. It was added by mistake as part of
r157341 long time ago. There is no security implication because just after the assert
there would be a division by 0 followed by a crash.
* svg/SVGAnimationElement.cpp:
(WebCore::SVGAnimationElement::currentValuesForValuesAnimation):
Modified Paths
Diff
Modified: releases/WebKitGTK/webkit-2.32/Source/WebCore/ChangeLog (282507 => 282508)
--- releases/WebKitGTK/webkit-2.32/Source/WebCore/ChangeLog 2021-09-16 08:31:53 UTC (rev 282507)
+++ releases/WebKitGTK/webkit-2.32/Source/WebCore/ChangeLog 2021-09-16 08:31:58 UTC (rev 282508)
@@ -1,3 +1,17 @@
+2021-04-15 Sergio Villar Senin <[email protected]>
+
+ Assertion failure in SVGAnimationElement::currentValuesForValuesAnimation
+ https://bugs.webkit.org/show_bug.cgi?id=222715
+
+ Reviewed by Ryosuke Niwa.
+
+ Replaced ASSERT_WITH_SECURITY_IMPLICATION by ASSERT. It was added by mistake as part of
+ r157341 long time ago. There is no security implication because just after the assert
+ there would be a division by 0 followed by a crash.
+
+ * svg/SVGAnimationElement.cpp:
+ (WebCore::SVGAnimationElement::currentValuesForValuesAnimation):
+
2021-04-09 Sergio Villar Senin <[email protected]>
Empty value is added in codePointsFromString in CSSFontFaceSet::matchingFacesExcludingPreinstalledFonts
Modified: releases/WebKitGTK/webkit-2.32/Source/WebCore/svg/SVGAnimationElement.cpp (282507 => 282508)
--- releases/WebKitGTK/webkit-2.32/Source/WebCore/svg/SVGAnimationElement.cpp 2021-09-16 08:31:53 UTC (rev 282507)
+++ releases/WebKitGTK/webkit-2.32/Source/WebCore/svg/SVGAnimationElement.cpp 2021-09-16 08:31:58 UTC (rev 282508)
@@ -496,7 +496,7 @@
--index;
from = m_values[index];
to = m_values[index + 1];
- ASSERT_WITH_SECURITY_IMPLICATION(toPercent > fromPercent);
+ ASSERT(toPercent > fromPercent);
effectivePercent = (percent - fromPercent) / (toPercent - fromPercent);
if (calcMode == CalcMode::Spline) {
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
