525099 - Crash (null deref) when attempting pure "by" SMIL animation of non-interpolatable properties

Status: RESOLVED FIXED

(Core :: SVG, defect)

Description

[Daniel Holbert [:dholbert]]

Attachment: testcase (crashes Firefox when loaded)

Invalid animations of the form
  <animate attributeName="display" by="inline" ...>
currently crash mozilla-central -- e.g.
http://crash-stats.mozilla.com/report/index/bp-16e6e11d-549a-41f2-bb3d-056ea2091028

This happens because nsSMILCSSValueType calls GetZeroTypeForProperty, and assumes that it returns something useable.  In the case of an enumerated-value property, though, there's no "zero" value, so it returns null.

Patch coming up.

Comment 1

[Daniel Holbert [:dholbert]]

Attachment: fix, with crashtest

Comment 2

[Daniel Holbert [:dholbert]]

The fix corrects this by making Add / Interpolate / ComputeValue all handle null return values from GetZeroValueForUnit.

Note that in the case where neither of our inputs is "implicitly zero" (and we don't call GetZeroValueForUnit), the nsStyleAnimation method-call will correctly recognize that we can't interpolate/add/compute-distance, and we'll still end up returning NS_ERROR_FAILURE.

The problem here was that we were failing when *setting up* a zero argument to use for the nsStyleAnimation method-call.

Comment 3

[Daniel Holbert [:dholbert]]

http://hg.mozilla.org/mozilla-central/rev/a9d140540b4b