From 7edd693570ca45d3b233b0419060e91b23fddfc8 Mon Sep 17 00:00:00 2001 From: Hiroyuki Ikezoe Date: Tue, 12 Sep 2017 08:42:54 +0900 Subject: [PATCH] Bug 1334582 - Check whether overall progress exceeds UINT64_MAX. r=boris The overall progress is factored in iteration start, so even if TimingParams.mIterations is less than UINT64_MAX, it will exceed UINT64_MAX. MozReview-Commit-ID: CEOYAGsCoIE --- dom/animation/AnimationEffectReadOnly.cpp | 5 +++-- dom/animation/test/crashtests/1334582-2.html | 11 +++++++++++ dom/animation/test/crashtests/crashtests.list | 1 + 3 files changed, 15 insertions(+), 2 deletions(-) create mode 100644 dom/animation/test/crashtests/1334582-2.html diff --git a/dom/animation/AnimationEffectReadOnly.cpp b/dom/animation/AnimationEffectReadOnly.cpp index 6a06a7e45902..4ed86d171438 100644 --- a/dom/animation/AnimationEffectReadOnly.cpp +++ b/dom/animation/AnimationEffectReadOnly.cpp @@ -186,8 +186,9 @@ AnimationEffectReadOnly::GetComputedTimingAt( // Determine the 0-based index of the current iteration. // https://w3c.github.io/web-animations/#current-iteration result.mCurrentIteration = - result.mIterations >= UINT64_MAX && - result.mPhase == ComputedTiming::AnimationPhase::After + (result.mIterations >= UINT64_MAX + && result.mPhase == ComputedTiming::AnimationPhase::After) + || overallProgress >= UINT64_MAX ? UINT64_MAX // In GetComputedTimingDictionary(), // we will convert this into Infinity : static_cast(overallProgress); diff --git a/dom/animation/test/crashtests/1334582-2.html b/dom/animation/test/crashtests/1334582-2.html new file mode 100644 index 000000000000..d3b223650dae --- /dev/null +++ b/dom/animation/test/crashtests/1334582-2.html @@ -0,0 +1,11 @@ + + + + + + + diff --git a/dom/animation/test/crashtests/crashtests.list b/dom/animation/test/crashtests/crashtests.list index 75cdbb941986..5162da2a50b2 100644 --- a/dom/animation/test/crashtests/crashtests.list +++ b/dom/animation/test/crashtests/crashtests.list @@ -24,6 +24,7 @@ pref(dom.animations-api.core.enabled,true) load 1330513-1.html pref(dom.animations-api.core.enabled,true) load 1333539-1.html pref(dom.animations-api.core.enabled,true) load 1333539-2.html pref(dom.animations-api.core.enabled,true) load 1334582-1.html +pref(dom.animations-api.core.enabled,true) load 1334582-2.html pref(dom.animations-api.core.enabled,true) load 1334583-1.html pref(dom.animations-api.core.enabled,true) load 1335998-1.html pref(dom.animations-api.core.enabled,true) load 1343589-1.html