Bug 678822: Skip call to nsSMILAnimationFunction::GetAccumulate() if we've had parse errors. r=birtles
authorDaniel Holbert <dholbert@cs.stanford.edu>
Mon, 15 Aug 2011 17:58:52 -0700
changeset 75347 d06c39b4945328a2e75a35e268a12d45e32a39c9
parent 75346 26114d0e96091d3b142be393f98a53ec10ad7be9
child 75348 f19cab5d3f778122fbced9edef9156cbe89ff9c0
push id2
push userbsmedberg@mozilla.com
push dateFri, 19 Aug 2011 14:38:13 +0000
reviewersbirtles
bugs678822
milestone8.0a1
Bug 678822: Skip call to nsSMILAnimationFunction::GetAccumulate() if we've had parse errors. r=birtles
content/smil/crashtests/678822-1.svg
content/smil/crashtests/crashtests.list
content/smil/nsSMILAnimationFunction.cpp
new file mode 100644
--- /dev/null
+++ b/content/smil/crashtests/678822-1.svg
@@ -0,0 +1,3 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+  <animate repeatCount="2" dur="1s" accumulate="1" />
+</svg>
--- a/content/smil/crashtests/crashtests.list
+++ b/content/smil/crashtests/crashtests.list
@@ -33,8 +33,9 @@ load 608549-1.svg
 load 608295-1.html
 load 611927-1.svg
 load 615002-1.svg
 load 615872-1.svg
 load 665334-1.svg
 load 669225-1.svg
 load 670313-1.svg
 load 669225-2.svg
+load 678822-1.svg
--- a/content/smil/nsSMILAnimationFunction.cpp
+++ b/content/smil/nsSMILAnimationFunction.cpp
@@ -182,17 +182,19 @@ nsSMILAnimationFunction::SampleAt(nsSMIL
   mHasChanged |= mLastValue;
 
   // Are we sampling at a new point in simple duration? And does that matter?
   mHasChanged |=
     (mSampleTime != aSampleTime || mSimpleDuration != aSimpleDuration) &&
     !IsValueFixedForSimpleDuration();
 
   // Are we on a new repeat and accumulating across repeats?
-  mHasChanged |= (mRepeatIteration != aRepeatIteration) && GetAccumulate();
+  if (!mErrorFlags) { // (can't call GetAccumulate() if we've had parse errors)
+    mHasChanged |= (mRepeatIteration != aRepeatIteration) && GetAccumulate();
+  }
 
   mSampleTime       = aSampleTime;
   mSimpleDuration   = aSimpleDuration;
   mRepeatIteration  = aRepeatIteration;
   mLastValue        = PR_FALSE;
 }
 
 void