Bug 531550 - SVG SMIL: Fix assertion with indefinite duration by-animateTransform; r=dholbert; a=blocking-final
authorBrian Birtles <birtles@gmail.com>
Wed, 24 Nov 2010 08:31:17 +0900
changeset 58114 b578485c389e
parent 58113 bc688a29feed
child 58116 c893a1158ae4
push id17161
push userbbirtles@mozilla.com
push dateTue, 23 Nov 2010 23:32:05 +0000
treeherdermozilla-central@b578485c389e [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersdholbert, blocking-final
bugs531550
milestone2.0b8pre
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 531550 - SVG SMIL: Fix assertion with indefinite duration by-animateTransform; r=dholbert; a=blocking-final
content/smil/crashtests/531550-1.svg
content/smil/crashtests/crashtests.list
content/svg/content/src/nsSVGTransformSMILType.cpp
new file mode 100644
--- /dev/null
+++ b/content/smil/crashtests/531550-1.svg
@@ -0,0 +1,3 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+  <g><animateTransform attributeName="transform" by="1"/></g>
+</svg>
--- a/content/smil/crashtests/crashtests.list
+++ b/content/smil/crashtests/crashtests.list
@@ -1,16 +1,17 @@
 load 483584-1.svg
 load 483584-2.svg
 load 523188-1.svg
 load 525099-1.svg
 load 526536-1.svg
 load 526875-1.svg
 load 526875-2.svg
 load 529387-1.xhtml
+load 531550-1.svg
 load 537157-1.svg
 load 541297-1.svg
 load 547333-1.svg
 load 548899-1.svg
 load 551620-1.svg
 load 554202-1.svg
 load 554202-2.svg
 load 554141-1.svg
--- a/content/svg/content/src/nsSVGTransformSMILType.cpp
+++ b/content/svg/content/src/nsSVGTransformSMILType.cpp
@@ -177,20 +177,30 @@ nsSVGTransformSMILType::SandwichAdd(nsSM
 
   // For <animateTransform> a sandwich add means a matrix post-multiplication
   // which just means to put the additional transform on the end of the array
 
   TransformArray& dstTransforms(*static_cast<TransformArray*>(aDest.mU.mPtr));
   const TransformArray& srcTransforms
     (*static_cast<const TransformArray*>(aValueToAdd.mU.mPtr));
 
-  // We're only expecting to be adding 1 src transform on to the list
-  NS_ASSERTION(srcTransforms.Length() == 1,
+  // We should have 0 or 1 transforms in the src list.
+  NS_ASSERTION(srcTransforms.Length() < 2,
     "Trying to do sandwich add of more than one value");
 
+  // The empty src transform list case only occurs in some limited circumstances
+  // where we create an empty 'from' value to interpolate from (e.g.
+  // by-animation) but then skip the interpolation step for some reason (e.g.
+  // because we have an indefinite duration which means we'll never get past the
+  // first value) and instead attempt to add that empty value to the underlying
+  // value.
+  // In any case, the expected result is that nothing is added.
+  if (srcTransforms.IsEmpty())
+    return NS_OK;
+
   // Stick the src on the end of the array
   const nsSVGSMILTransform& srcTransform = srcTransforms[0];
   nsSVGSMILTransform* result = dstTransforms.AppendElement(srcTransform);
   NS_ENSURE_TRUE(result,NS_ERROR_OUT_OF_MEMORY);
 
   return NS_OK;
 }