ASSERTION FAILED: resultAnimationElement->m_animatedType
authorcommit-queue@webkit.org <commit-queue@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Wed, 3 Apr 2013 20:44:22 +0000 (20:44 +0000)
committercommit-queue@webkit.org <commit-queue@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Wed, 3 Apr 2013 20:44:22 +0000 (20:44 +0000)
https://bugs.webkit.org/show_bug.cgi?id=93528

Patch by David Vest <davve@opera.com> on 2013-04-03
Reviewed by Philip Rogers.

Source/WebCore:

When the order of animation elements change within an animation
group, we can't assume that the resultElement is the same as it
was when the animation was frozen. Make sure to reset the
animation type for the resultElement before updating the
animation.

Test: svg/animations/animation-dependency-crash.html

* svg/animation/SVGSMILElement.cpp:
(WebCore::SVGSMILElement::progress):

LayoutTests:

* svg/animations/animation-dependency-crash-expected.txt: Added.
* svg/animations/animation-dependency-crash.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@147581 268f45cc-cd09-0410-ab3c-d52691b4dbfc

LayoutTests/ChangeLog
LayoutTests/svg/animations/animation-dependency-crash-expected.txt [new file with mode: 0644]
LayoutTests/svg/animations/animation-dependency-crash.html [new file with mode: 0644]
Source/WebCore/ChangeLog
Source/WebCore/svg/animation/SVGSMILElement.cpp

index 084cd40..5d4ebbf 100644 (file)
@@ -1,3 +1,13 @@
+2013-04-03  David Vest  <davve@opera.com>
+
+        ASSERTION FAILED: resultAnimationElement->m_animatedType
+        https://bugs.webkit.org/show_bug.cgi?id=93528
+
+        Reviewed by Philip Rogers.
+
+        * svg/animations/animation-dependency-crash-expected.txt: Added.
+        * svg/animations/animation-dependency-crash.html: Added.
+
 2013-04-03  Max Vujovic  <mvujovic@adobe.com>
 
         Compositing tests failing after http://trac.webkit.org/changeset/147502
diff --git a/LayoutTests/svg/animations/animation-dependency-crash-expected.txt b/LayoutTests/svg/animations/animation-dependency-crash-expected.txt
new file mode 100644 (file)
index 0000000..60346a1
--- /dev/null
@@ -0,0 +1 @@
+PASS: Test did not crash.
diff --git a/LayoutTests/svg/animations/animation-dependency-crash.html b/LayoutTests/svg/animations/animation-dependency-crash.html
new file mode 100644 (file)
index 0000000..708d05a
--- /dev/null
@@ -0,0 +1,28 @@
+<!DOCTYPE html>
+<html>
+<head>
+  <script type="text/javascript">
+    if (window.testRunner)
+        testRunner.waitUntilDone();
+
+    window.setTimeout(function() {
+        document.body.innerHTML = 'PASS: Test did not crash.';
+        if (window.testRunner) {
+            testRunner.dumpAsText();
+            testRunner.notifyDone();
+        }
+    }, 120);
+  </script>
+</head>
+<body>
+  Test infinite animation loop<br/>
+  This test passes if it does not crash<br/>
+  <svg xmlns="http://www.w3.org/2000/svg">
+    <circle r="10" cx="50" cy="50" fill="green">
+      <animate id="anim1" attributeName="opacity" from="0" to="1" begin="0s; anim3.end" dur="0.01s"/>
+      <animate id="anim2" attributeName="opacity" from="1" to="1" begin="anim1.end" dur="0.03s" fill="freeze"/>
+      <animate id="anim3" attributeName="opacity" from="1" to="0" begin="anim2.end" dur="0.01s" fill="freeze"/>
+    </circle>
+  </svg>
+</body>
+</html>
index 481fd4c..8bc2f66 100644 (file)
@@ -1,3 +1,21 @@
+2013-04-03  David Vest  <davve@opera.com>
+
+        ASSERTION FAILED: resultAnimationElement->m_animatedType
+        https://bugs.webkit.org/show_bug.cgi?id=93528
+
+        Reviewed by Philip Rogers.
+
+        When the order of animation elements change within an animation
+        group, we can't assume that the resultElement is the same as it
+        was when the animation was frozen. Make sure to reset the
+        animation type for the resultElement before updating the
+        animation.
+
+        Test: svg/animations/animation-dependency-crash.html
+
+        * svg/animation/SVGSMILElement.cpp:
+        (WebCore::SVGSMILElement::progress):
+
 2013-04-03  Timothy Hatcher  <timothy@apple.com>
 
         Stop unconditionally enabling JavaScript execution when closing the Web Inspector.
index 95fee88..d2e2639 100644 (file)
@@ -1070,8 +1070,11 @@ bool SVGSMILElement::progress(SMILTime elapsed, SVGSMILElement* resultElement, b
 
     if (elapsed < m_intervalBegin) {
         ASSERT(m_activeState != Active);
-        if (m_activeState == Frozen)
+        if (m_activeState == Frozen) {
+            if (this == resultElement)
+                resetAnimatedType();
             updateAnimation(m_lastPercent, m_lastRepeat, resultElement);
+        }
         m_nextProgressTime = m_intervalBegin;
         return false;
     }