Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-11-26 22:32:46 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 1930221 - prevent underflow as well as overflow when adding an instance time r=emilio

Browse Source 
Differential Revision: https://phabricator.services.mozilla.com/D228495
This commit is contained in:
longsonr 2024-11-12 13:55:34 +00:00
parent b4f8af22bc
commit 941ac724d1
3 changed files with 19 additions and 25 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

29
dom/smil/SMILTimedElement.cpp
View File

@ -299,7 +299,8 @@ nsresult SMILTimedElement::BeginElementAt(double aOffsetSeconds) {
if (!container) return NS_ERROR_FAILURE;
SMILTime currentTime = container->GetCurrentTimeAsSMILTime();
return AddInstanceTimeFromCurrentTime(currentTime, aOffsetSeconds, true);
AddInstanceTimeFromCurrentTime(currentTime, aOffsetSeconds, true);
return NS_OK;
}
nsresult SMILTimedElement::EndElementAt(double aOffsetSeconds) {
@ -307,7 +308,8 @@ nsresult SMILTimedElement::EndElementAt(double aOffsetSeconds) {
if (!container) return NS_ERROR_FAILURE;
SMILTime currentTime = container->GetCurrentTimeAsSMILTime();
return AddInstanceTimeFromCurrentTime(currentTime, aOffsetSeconds, false);
AddInstanceTimeFromCurrentTime(currentTime, aOffsetSeconds, false);
return NS_OK;
}
//----------------------------------------------------------------------
@ -1732,17 +1734,7 @@ SMILTimeValue SMILTimedElement::ApplyMinAndMax(
return aDuration;
}
SMILTimeValue result;
if (aDuration > mMax) {
result = mMax;
} else if (aDuration < mMin) {
result = mMin;
} else {
result = aDuration;
}
return result;
return std::clamp(aDuration, mMin, mMax);
}
SMILTime SMILTimedElement::ActiveTimeToSimpleTime(SMILTime aActiveTime,
@ -1958,23 +1950,18 @@ void SMILTimedElement::SampleFillValue() {
}
}
nsresult SMILTimedElement::AddInstanceTimeFromCurrentTime(SMILTime aCurrentTime,
void SMILTimedElement::AddInstanceTimeFromCurrentTime(SMILTime aCurrentTime,
double aOffsetSeconds,
bool aIsBegin) {
double offset = NS_round(aOffsetSeconds * PR_MSEC_PER_SEC);
// Check we won't overflow the range of SMILTime
if (aCurrentTime + offset > double(std::numeric_limits<SMILTime>::max()))
return NS_ERROR_ILLEGAL_VALUE;
SMILTimeValue timeVal(aCurrentTime + int64_t(offset));
SMILTimeValue timeVal(std::clamp<SMILTime>(
aCurrentTime + offset, 0, std::numeric_limits<SMILTime>::max()));
RefPtr<SMILInstanceTime> instanceTime =
new SMILInstanceTime(timeVal, SMILInstanceTime::SOURCE_DOM);
AddInstanceTime(instanceTime, aIsBegin);
return NS_OK;
}
void SMILTimedElement::RegisterMilestone() {

2
dom/smil/SMILTimedElement.h
View File

@ -515,7 +515,7 @@ class SMILTimedElement {
void UpdateCurrentInterval(bool aForceChangeNotice = false);
void SampleSimpleTime(SMILTime aActiveTime);
void SampleFillValue();
nsresult AddInstanceTimeFromCurrentTime(SMILTime aCurrentTime,
void AddInstanceTimeFromCurrentTime(SMILTime aCurrentTime,
double aOffsetSeconds, bool aIsBegin);
void RegisterMilestone();
bool GetNextMilestone(SMILMilestone& aNextMilestone) const;

7
testing/web-platform/tests/svg/animations/crashtests/firefox-bug-1930221.html Normal file
View File

@ -0,0 +1,7 @@
<script>
document.addEventListener('DOMContentLoaded', () => {
document.getElementById("x").beginElementAt(-1369430904473181976352858)
})
</script>
<svg>
<animate id="x" begin="a" />