526875 - "ABORT: Added amount should be a parsed value" with svg:animate

Status: RESOLVED FIXED

(Core :: SVG, defect)

Description

[Jesse Ruderman]

Attachment: testcase (triggers a fatal assertion when loaded)

###!!! ABORT: Added amount should be a parsed value: 'valueToAddWrapper->mPropID != eCSSProperty_UNKNOWN && !valueToAddWrapper->mCSSValue.IsNull()', file /Users/jruderman/central/content/smil/nsSMILCSSValueType.cpp, line 201

Comment 1

[Daniel Holbert [:dholbert]]

Confirmed here. Looking into it.

Comment 2

[Daniel Holbert [:dholbert]]

Attachment: fix

Comment 3

[Daniel Holbert [:dholbert]]

Comment on attachment 411591 [details] [diff] [review]
fix

So, this fix effectively reverts a code-removal patch -- "patch 5" from bug 520485, which was landed as http://hg.mozilla.org/mozilla-central/rev/bd0cf8eea1ca

Jesse found a case where that removed code is still needed. :)

I had removed the code on the assumption that nsSMILCSSValueType::Add() would never receive a just-barely-initialized "zero" value for |aValueToAdd|.  This seemed safe, because in Add() calls, the |aValueToAdd| argument will generally be the "by" value or an interpolated portion of it.  (i.e. it's generally a parsed value, or an interpolated derivative)

In the testcase Jesse posted, though, we've got a by-animation with an indefinite duration.  In this case, we're effectively frozen at the base value -- i.e., the interpolated portion that we add should always be 0.  So, as a sort of optimization, we can skip the interpolation step, and we use a just-barely-initialized "zero" amount as our added value.  And this ends up getting passed to nsSMILCSSValueType::Add() as |aValueToAdd|.

So, the bottom line is that nsSMILCSSValueType::Add() needs to support just-barely-initialized |aValueToAdd| arguments after all.

Comment 4

[Daniel Holbert [:dholbert]]

The patch also tweaks some assertions in various places in nsSMILCSSValueType.  These assertions just double-check the invariant that a ValueWrapper should either have all of its member data set, or none of its member data set.  (This variant is enforced in the ValueWrapper constructor and in nsSMILCSSValueType::ValueFromString)

Comment 5

[Daniel Holbert [:dholbert]]

landed: http://hg.mozilla.org/mozilla-central/rev/7e1dffcc09a0