Bug 620034 - "ABORT: DOM wrapper's list length is out of sync" [@ mozilla::DOMSVGNumberList::Length]. r=longsonr, a=blocking.
authorJonathan Watt <jwatt@jwatt.org>
Mon, 03 Jan 2011 09:26:28 +0000
changeset 59785 1c414527a96bdfd2bebe14a8ee6f5048e03d24e1
parent 59784 6a8cca708a48039ffcf110c3f32dbf7707b4aa23
child 59786 d641b5c7774eab21125e48de8604012bebbe03c7
push id1
push usershaver@mozilla.com
push dateTue, 04 Jan 2011 17:58:04 +0000
reviewerslongsonr, blocking
bugs620034
milestone2.0b9pre
Bug 620034 - "ABORT: DOM wrapper's list length is out of sync" [@ mozilla::DOMSVGNumberList::Length]. r=longsonr, a=blocking.
content/svg/content/src/SVGAnimatedLengthList.cpp
content/svg/content/src/SVGAnimatedNumberList.cpp
layout/svg/crashtests/620034-1.html
layout/svg/crashtests/crashtests.list
--- a/content/svg/content/src/SVGAnimatedLengthList.cpp
+++ b/content/svg/content/src/SVGAnimatedLengthList.cpp
@@ -80,17 +80,17 @@ SVGAnimatedLengthList::SetBaseValueStrin
 
 void
 SVGAnimatedLengthList::ClearBaseValue(PRUint32 aAttrEnum)
 {
   DOMSVGAnimatedLengthList *domWrapper =
     DOMSVGAnimatedLengthList::GetDOMWrapperIfExists(this);
   if (domWrapper) {
     // We must send this notification *before* changing mBaseVal! (See above.)
-    domWrapper->InternalAnimValListWillChangeTo(SVGLengthList());
+    domWrapper->InternalBaseValListWillChangeTo(SVGLengthList());
   }
   mBaseVal.Clear();
   // Caller notifies
 }
 
 nsresult
 SVGAnimatedLengthList::SetAnimValue(const SVGLengthList& aNewAnimValue,
                                     nsSVGElement *aElement,
--- a/content/svg/content/src/SVGAnimatedNumberList.cpp
+++ b/content/svg/content/src/SVGAnimatedNumberList.cpp
@@ -80,17 +80,17 @@ SVGAnimatedNumberList::SetBaseValueStrin
 
 void
 SVGAnimatedNumberList::ClearBaseValue(PRUint32 aAttrEnum)
 {
   DOMSVGAnimatedNumberList *domWrapper =
     DOMSVGAnimatedNumberList::GetDOMWrapperIfExists(this);
   if (domWrapper) {
     // We must send this notification *before* changing mBaseVal! (See above.)
-    domWrapper->InternalAnimValListWillChangeTo(SVGNumberList());
+    domWrapper->InternalBaseValListWillChangeTo(SVGNumberList());
   }
   mBaseVal.Clear();
   // Caller notifies
 }
 
 nsresult
 SVGAnimatedNumberList::SetAnimValue(const SVGNumberList& aNewAnimValue,
                                     nsSVGElement *aElement,
new file mode 100644
--- /dev/null
+++ b/layout/svg/crashtests/620034-1.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<script>
+
+function boom()
+{
+  var f = document.createElementNS("http://www.w3.org/2000/svg", "feFuncB");
+  var tvb = f.tableValues.baseVal;
+  f.setAttribute("tableValues", "3 7 5");
+  f.setAttribute("tableValues", "i"); 
+  tvb.numberOfItems;
+}
+
+boom();
+
+</script>
--- a/layout/svg/crashtests/crashtests.list
+++ b/layout/svg/crashtests/crashtests.list
@@ -96,10 +96,11 @@ load 566216-1.svg
 load 587336-1.html
 load 590291-1.svg
 load 601999-1.html
 load 605626-1.svg
 load 610594-1.html
 load 610954-1.html
 load 612662-1.svg
 load 612662-2.svg
+load 620034-1.html
 
 load 621598-1.svg