Created attachment 410610 [details] testcase (triggers a fatal assertion when loaded) ###!!! ABORT: Added amount should be a parsed value: 'valueToAddWrapper->mPropID != eCSSProperty_UNKNOWN && !valueToAddWrapper->mCSSValue.IsNull()', file /Users/jruderman/central/content/smil/nsSMILCSSValueType.cpp, line 201
Confirmed here. Looking into it.
Assignee: nobody → dholbert
Status: NEW → ASSIGNED
OS: Mac OS X → All
Comment on attachment 411591 [details] [diff] [review] fix So, this fix effectively reverts a code-removal patch -- "patch 5" from bug 520485, which was landed as http://hg.mozilla.org/mozilla-central/rev/bd0cf8eea1ca Jesse found a case where that removed code is still needed. :) I had removed the code on the assumption that nsSMILCSSValueType::Add() would never receive a just-barely-initialized "zero" value for |aValueToAdd|. This seemed safe, because in Add() calls, the |aValueToAdd| argument will generally be the "by" value or an interpolated portion of it. (i.e. it's generally a parsed value, or an interpolated derivative) In the testcase Jesse posted, though, we've got a by-animation with an indefinite duration. In this case, we're effectively frozen at the base value -- i.e., the interpolated portion that we add should always be 0. So, as a sort of optimization, we can skip the interpolation step, and we use a just-barely-initialized "zero" amount as our added value. And this ends up getting passed to nsSMILCSSValueType::Add() as |aValueToAdd|. So, the bottom line is that nsSMILCSSValueType::Add() needs to support just-barely-initialized |aValueToAdd| arguments after all.
Attachment #411591 - Flags: review?(roc)
The patch also tweaks some assertions in various places in nsSMILCSSValueType. These assertions just double-check the invariant that a ValueWrapper should either have all of its member data set, or none of its member data set. (This variant is enforced in the ValueWrapper constructor and in nsSMILCSSValueType::ValueFromString)
Attachment #411591 - Flags: review?(roc) → review+
Status: ASSIGNED → RESOLVED
Last Resolved: 8 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.