Closed
Bug 822877
Opened 12 years ago
Closed 6 years ago
Animating a huge (infinite) value produces NaN, which asserts
Categories
(Core :: CSS Parsing and Computation, defect)
Tracking
()
RESOLVED
WORKSFORME
People
(Reporter: jruderman, Unassigned)
References
Details
(Keywords: assertion, testcase)
Attachments
(2 files, 1 obsolete file)
Assertion failure: !MOZ_DOUBLE_IS_NaN(mValue.mFloat), at layout/style/nsCSSValue.cpp:325
|
Reporter | |
Comment 1•12 years ago
|
||
|
||
Comment 2•12 years ago
|
||
The assertion was added in bug 798853, not too long ago -- tentatively assuming this has been an issue since then, & marking as blocking that bug.
Blocks: CVE-2012-4216
|
||
Comment 3•12 years ago
|
||
Assignee: nobody → matspal
Attachment #695370 -
Flags: review?(dbaron)
|
||
Comment 4•12 years ago
|
||
Comment on attachment 695370 [details] [diff] [review]
fix+test
Fixing just this one caller doesn't feel right when there are probably others. Furthermore, I think in cases where we're unable to animate, we should fail rather than use a dummy (0) value.
|
|
||
Updated•12 years ago
|
Attachment #695370 -
Attachment is obsolete: true
Attachment #695370 -
Flags: review?(dbaron)
|
|
||
Updated•12 years ago
|
Assignee: matspal → nobody
Pushed by mpalmgren@mozilla.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/607ffd6b8741
Add a crashtest. r=mats
|
|
||
Updated•6 years ago
|
Status: NEW → RESOLVED
Closed: 6 years ago
Flags: in-testsuite+
Resolution: --- → WORKSFORME
|
||
Comment 6•6 years ago
|
||
| bugherder | ||
You need to log in
before you can comment on or make changes to this bug.
Description
•