Commit 8196c9b6 authored by Nate Chapin's avatar Nate Chapin Committed by Commit Bot

Early exit in Animatable::animate if the ScriptState is invalid

Bug: 1084431, 1083740
Test: fast/animation/animate-detached-element.html
Change-Id: I382a8db0977deeff1588b900621858977cc33d1a
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2207741
Commit-Queue: Kentaro Hara <haraken@chromium.org>
Auto-Submit: Nate Chapin <japhet@chromium.org>
Reviewed-by: default avatarKentaro Hara <haraken@chromium.org>
Cr-Commit-Position: refs/heads/master@{#770401}
parent ff1a880d
...@@ -61,6 +61,8 @@ Animation* Animatable::animate( ...@@ -61,6 +61,8 @@ Animation* Animatable::animate(
const ScriptValue& keyframes, const ScriptValue& keyframes,
const UnrestrictedDoubleOrKeyframeAnimationOptions& options, const UnrestrictedDoubleOrKeyframeAnimationOptions& options,
ExceptionState& exception_state) { ExceptionState& exception_state) {
if (!script_state->ContextIsValid())
return nullptr;
Element* element = GetAnimationTarget(); Element* element = GetAnimationTarget();
KeyframeEffect* effect = KeyframeEffect* effect =
KeyframeEffect::Create(script_state, element, keyframes, KeyframeEffect::Create(script_state, element, keyframes,
...@@ -79,6 +81,8 @@ Animation* Animatable::animate( ...@@ -79,6 +81,8 @@ Animation* Animatable::animate(
Animation* Animatable::animate(ScriptState* script_state, Animation* Animatable::animate(ScriptState* script_state,
const ScriptValue& keyframes, const ScriptValue& keyframes,
ExceptionState& exception_state) { ExceptionState& exception_state) {
if (!script_state->ContextIsValid())
return nullptr;
Element* element = GetAnimationTarget(); Element* element = GetAnimationTarget();
KeyframeEffect* effect = KeyframeEffect* effect =
KeyframeEffect::Create(script_state, element, keyframes, exception_state); KeyframeEffect::Create(script_state, element, keyframes, exception_state);
......
<body>
PASS if no crash.
<iframe id="i"></iframe>
<script>
if (window.testRunner)
testRunner.dumpAsText();
var scrollingElement = i.contentDocument.scrollingElement;
i.remove();
scrollingElement.animate({"bottom": [0]});
</script>
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment