Bug 611927 - SVG SMIL: Fix assertion when attempting to add to NULL base value; r=dholbert; a=roc
authorBrian Birtles <birtles@gmail.com>
Wed, 24 Nov 2010 08:31:17 +0900
changeset 58113 bc688a29feed7e45ba8160d0e5dd9ab67312401a
parent 58112 cf61e6916004b57f47ad001034757fe3a7df6d53
child 58114 b578485c389e67a274f823f0a3d269ea5e6810ae
push id1
push usershaver@mozilla.com
push dateTue, 04 Jan 2011 17:58:04 +0000
reviewersdholbert, roc
bugs611927
milestone2.0b8pre
Bug 611927 - SVG SMIL: Fix assertion when attempting to add to NULL base value; r=dholbert; a=roc
content/smil/crashtests/611927-1.svg
content/smil/crashtests/crashtests.list
content/smil/nsSMILAnimationFunction.cpp
new file mode 100644
--- /dev/null
+++ b/content/smil/crashtests/611927-1.svg
@@ -0,0 +1,4 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+  <animate attributeName="stroke-width"/>
+  <animate attributeName="stroke-width" by="10em"/>
+</svg>
--- a/content/smil/crashtests/crashtests.list
+++ b/content/smil/crashtests/crashtests.list
@@ -25,8 +25,9 @@ load 588287-2.svg
 load 590425-1.html
 load 592477-1.xhtml
 load 594653-1.svg
 load 596796-1.svg
 load 605345-1.svg
 load 606101-1.svg
 load 608549-1.svg
 load 608295-1.html
+load 611927-1.svg
--- a/content/smil/nsSMILAnimationFunction.cpp
+++ b/content/smil/nsSMILAnimationFunction.cpp
@@ -241,16 +241,24 @@ nsSMILAnimationFunction::ComposeResult(c
 
   // If this interval is active, we must have a non-negative mSampleTime
   NS_ABORT_IF_FALSE(mSampleTime >= 0 || !mIsActive,
       "Negative sample time for active animation");
   NS_ABORT_IF_FALSE(mSimpleDuration.IsResolved() ||
       mSimpleDuration.IsIndefinite() || mLastValue,
       "Unresolved simple duration for active or frozen animation");
 
+  // If we want to add but don't have a base value then just fail outright.
+  // This can happen when we skipped getting the base value because there's an
+  // animation function in the sandwich that should replace it but that function
+  // failed unexpectedly.
+  PRBool isAdditive = IsAdditive();
+  if (isAdditive && aResult.IsNull())
+    return;
+
   nsSMILValue result;
 
   if (mSimpleDuration.IsIndefinite() ||
       (values.Length() == 1 && TreatSingleValueAsStatic())) {
     // Indefinite duration or only one value set: Always set the first value
     result = values[0];
 
   } else if (mLastValue) {
@@ -281,17 +289,17 @@ nsSMILAnimationFunction::ComposeResult(c
       return;
 
     if (IsToAnimation() && mIsFrozen) {
       mFrozenValue = result;
     }
   }
 
   // If additive animation isn't required or isn't supported, set the value.
-  if (!IsAdditive() || NS_FAILED(aResult.SandwichAdd(result))) {
+  if (!isAdditive || NS_FAILED(aResult.SandwichAdd(result))) {
     aResult.Swap(result);
     // Note: The old value of aResult is now in |result|, and it will get
     // cleaned up when |result| goes out of scope, when this function returns.
   }
 }
 
 PRInt8
 nsSMILAnimationFunction::CompareTo(const nsSMILAnimationFunction* aOther) const