The default bug view has changed. See this FAQ.

"ASSERTION: Trying to do sandwich add of more than one value" with svg:animateTransform

RESOLVED FIXED in mozilla2.0b8

Status

()

Core
SVG
RESOLVED FIXED
7 years ago
6 years ago

People

(Reporter: Jesse Ruderman, Assigned: birtles)

Tracking

(Blocks: 1 bug, {assertion, testcase})

Trunk
mozilla2.0b8
assertion, testcase
Points:
---
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(blocking2.0 final+)

Details

Attachments

(2 attachments, 1 obsolete attachment)

(Reporter)

Description

7 years ago
Created attachment 414924 [details]
testcase

###!!! ASSERTION: Trying to do sandwich add of more than one value.: 'srcTransforms.Length() == 1', file /Users/jruderman/central/content/svg/content/src/nsSVGTransformSMILType.cpp, line 169

###!!! ASSERTION: invalid array index: 'i < Length()', file ../../../../dist/include/nsTArray.h, line 326

The first assertion is misleading: srcTransforms.Length() is actually 0.
(Reporter)

Comment 1

6 years ago
This prevents me from finding other "ASSERTION: invalid array index" bugs, which are often security holes :(
(Assignee)

Updated

6 years ago
Assignee: nobody → birtles
Status: NEW → ASSIGNED
blocking2.0: --- → ?
(Assignee)

Comment 2

6 years ago
Created attachment 491746 [details] [diff] [review]
Patch v1a

Proposed patch.
Attachment #491746 - Flags: review?(dholbert)
Comment on attachment 491746 [details] [diff] [review]
Patch v1a

>+  // [...] but since the duration is indefinite we'll actually try
>+  // to add it.

I'm confused about what this means -- why does an indefinite duration mean we'll actually try to add, when we wouldn't otherwise?
(Assignee)

Comment 4

6 years ago
(In reply to comment #3)
> I'm confused about what this means -- why does an indefinite duration mean
> we'll actually try to add, when we wouldn't otherwise?

Yeah, good point this comment needs to be tweaked. For by-animation, normally the interpolation step would ensure that we don't end up with an empty transform animation value. However, when there's an indefinite duration we skip interpolation altogether and just set the first value (the empty 'from' value we'd normally interpolate from).

However, I think there are other cases where this can arise too such as when we have values="1". So I'll tweak the comment to make this clearer.
blocking2.0: ? → final+
(Assignee)

Comment 5

6 years ago
Created attachment 492618 [details] [diff] [review]
Patch v1b

Fix up comment as per comment 3.
Attachment #491746 - Attachment is obsolete: true
Attachment #492618 - Flags: review?(dholbert)
Attachment #491746 - Flags: review?(dholbert)
Comment on attachment 492618 [details] [diff] [review]
Patch v1b

Makes much more sense now -- thanks for clarifying that! r=dholbert
Attachment #492618 - Flags: review?(dholbert) → review+
(Assignee)

Comment 7

6 years ago
Pushed: http://hg.mozilla.org/mozilla-central/rev/b578485c389e
Status: ASSIGNED → RESOLVED
Last Resolved: 6 years ago
Flags: in-testsuite+
OS: Mac OS X → All
Hardware: x86 → All
Resolution: --- → FIXED
Target Milestone: --- → mozilla2.0b8
You need to log in before you can comment on or make changes to this bug.