Source/WebCore: Assertion faulire in SVGAnimatedPath.
authorreni@webkit.org <reni@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Mon, 18 Mar 2013 17:38:16 +0000 (17:38 +0000)
committerreni@webkit.org <reni@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Mon, 18 Mar 2013 17:38:16 +0000 (17:38 +0000)
https://bugs.webkit.org/show_bug.cgi?id=106428

Reviewed by Allan Sandfeld Jensen.

The asserts are too restricted. The size must be greater or equal to 1.

Test: svg/animations/animated-path-via-use-debug-crash.svg

* svg/SVGAnimatedPath.cpp:
(WebCore::SVGAnimatedPathAnimator::startAnimValAnimation):
(WebCore::SVGAnimatedPathAnimator::resetAnimValToBaseVal):

LayoutTests: Assertion faulire in SVGAnimatedPath
https://bugs.webkit.org/show_bug.cgi?id=106428

Reviewed by Allan Sandfeld Jensen.

* svg/animations/animated-path-via-use-debug-crash.svg: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@146083 268f45cc-cd09-0410-ab3c-d52691b4dbfc

LayoutTests/ChangeLog
LayoutTests/svg/animations/animated-path-via-use-debug-crash-expected.txt [new file with mode: 0644]
LayoutTests/svg/animations/animated-path-via-use-debug-crash.svg [new file with mode: 0644]
Source/WebCore/ChangeLog
Source/WebCore/svg/SVGAnimatedPath.cpp

index ab0b962..462b8c9 100644 (file)
@@ -1,3 +1,12 @@
+2013-03-18  Renata Hodovan  <reni@webkit.org>
+
+        Assertion faulire in SVGAnimatedPath
+        https://bugs.webkit.org/show_bug.cgi?id=106428
+
+        Reviewed by Allan Sandfeld Jensen.
+
+        * svg/animations/animated-path-via-use-debug-crash.svg: Added.
+
 2013-03-18  Simon Fraser  <simon.fraser@apple.com>
 
         [Mac] Some tests intermittently asserts in SharedBuffer::releasePurgeableBuffer()
diff --git a/LayoutTests/svg/animations/animated-path-via-use-debug-crash-expected.txt b/LayoutTests/svg/animations/animated-path-via-use-debug-crash-expected.txt
new file mode 100644 (file)
index 0000000..249b990
--- /dev/null
@@ -0,0 +1 @@
+This test passes if it does not crash. See bug https://bugs.webkit.org/show_bug.cgi?id=106428
diff --git a/LayoutTests/svg/animations/animated-path-via-use-debug-crash.svg b/LayoutTests/svg/animations/animated-path-via-use-debug-crash.svg
new file mode 100644 (file)
index 0000000..bbd167e
--- /dev/null
@@ -0,0 +1,14 @@
+<svg xmlns:xlink="http://www.w3.org/1999/xlink" xmlns="http://www.w3.org/2000/svg">
+    <path id="test" d="M 10 10">
+        <animate attributeName="d"></animate>
+    </path>
+
+    <use xlink:href="#test"></use>
+    <text x="10" y="20">This test passes if it does not crash. See bug https://bugs.webkit.org/show_bug.cgi?id=106428</text>
+
+    <script>
+        if (window.testRunner)
+            testRunner.dumpAsText();
+    </script>
+</svg>
+
index 99fac94..da16cd9 100644 (file)
@@ -1,3 +1,18 @@
+2013-03-18  Renata Hodovan  <reni@webkit.org>
+
+        Assertion faulire in SVGAnimatedPath.
+        https://bugs.webkit.org/show_bug.cgi?id=106428
+
+        Reviewed by Allan Sandfeld Jensen.
+
+        The asserts are too restricted. The size must be greater or equal to 1.
+
+        Test: svg/animations/animated-path-via-use-debug-crash.svg
+
+        * svg/SVGAnimatedPath.cpp:
+        (WebCore::SVGAnimatedPathAnimator::startAnimValAnimation):
+        (WebCore::SVGAnimatedPathAnimator::resetAnimValToBaseVal):
+
 2013-03-18  Simon Fraser  <simon.fraser@apple.com>
 
         [Mac] Some tests intermittently asserts in SharedBuffer::releasePurgeableBuffer()
index 029b16a..b8c8da1 100644 (file)
@@ -42,7 +42,7 @@ PassOwnPtr<SVGAnimatedType> SVGAnimatedPathAnimator::constructFromString(const S
 
 PassOwnPtr<SVGAnimatedType> SVGAnimatedPathAnimator::startAnimValAnimation(const SVGElementAnimatedPropertyList& animatedTypes)
 {
-    ASSERT(animatedTypes.size() == 1);
+    ASSERT(animatedTypes.size() >= 1);
     SVGAnimatedPathSegListPropertyTearOff* property = castAnimatedPropertyToActualType<SVGAnimatedPathSegListPropertyTearOff>(animatedTypes[0].properties[0].get());
     const SVGPathSegList& baseValue = property->currentBaseValue();
 
@@ -72,7 +72,7 @@ void SVGAnimatedPathAnimator::stopAnimValAnimation(const SVGElementAnimatedPrope
 
 void SVGAnimatedPathAnimator::resetAnimValToBaseVal(const SVGElementAnimatedPropertyList& animatedTypes, SVGAnimatedType* type)
 {
-    ASSERT(animatedTypes.size() == 1);
+    ASSERT(animatedTypes.size() >= 1);
     ASSERT(type);
     ASSERT(type->type() == m_type);
     const SVGPathSegList& baseValue = castAnimatedPropertyToActualType<SVGAnimatedPathSegListPropertyTearOff>(animatedTypes[0].properties[0].get())->currentBaseValue();