[Webkit-unassigned] [Bug 108184] New: Assertion faulire in SVGSMILElement::createInstanceTimesFromSyncbase

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=108184

           Summary: Assertion faulire in
                    SVGSMILElement::createInstanceTimesFromSyncbase
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: Unspecified
        OS/Version: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: SVG
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: reni at webkit.org
                CC: zimmermann at kde.org, zmo at google.com, pdr at google.com,
                    fmalita at chromium.org


During SVG fuzzing I've found the following assert:

Program received signal SIGSEGV, Segmentation fault.
0x00007ffff5993f4f in WebCore::SVGSMILElement::createInstanceTimesFromSyncbase (this=0xae07a0, syncbase=0xae07a0)
    at /home/reni/repos/webkit2/Source/WebCore/svg/animation/SVGSMILElement.cpp:1156
1156                ASSERT(time.isFinite());


Test case attached.

The problem occures if the begin parameter depends on the set object itself.

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.