Prevent use of stale list length for to-animations of transform lists
When animating a transform list with a "To animation", the from value
will be the currently animated value, and hence the clear() in
SVGTransformList::calculateAnimatedValue will modify the fromList, and
clobber the |fromListSize| local variable - leading to an out-of-bounds
access.
To avoid this, acquire the reference to the effectiveFrom value earlier -
before the clear(). Also fold the single use of |fromListSize|.
BUG=368481
Review URL: https://codereview.chromium.org/261603002
git-svn-id: svn://svn.chromium.org/blink/trunk@173192 bbb929c8-8fbe-4397-9dbb-9b2b20218538
3 files changed
