556808 - ASSERTION: unknown nsISVGValue: 'Not Reached', when appending segment to SVG path

Status: RESOLVED FIXED

(Core :: SVG, defect)

Description

[Daniel Holbert [:dholbert]]

See attached minimal testcase, which produces this output in my Linux debug build:
> ###!!! ASSERTION: unknown nsISVGValue: 'Not Reached', file ../../../../../mozilla/content/svg/content/src/nsSVGElement.cpp, line 1003

Comment 1

[Daniel Holbert [:dholbert]]

Attachment: backtrace when we hit the NOTREACHED

Here's the backtrace when we hit the NOTREACHED.  We hit it because i == count -- but in this case, they're both 0, actually.

Comment 2

[Daniel Holbert [:dholbert]]

Here's the code around the failure, to provide context for comment 1:

978 nsSVGElement::GetModificationDataForObservable(nsISVGValue* aObservable,
[...]
992   PRUint32 i, count = mMappedAttributes.AttrCount();
993   const nsAttrValue* attrValue = nsnull;
994   for (i = 0; i < count; ++i) {
995     attrValue = mMappedAttributes.AttrAt(i);
996     if (attrValue->GetSVGValue() == aObservable) {
997       break;
998     }
999   }
1000 
1001   if (i == count) {
1002     NS_NOTREACHED("unknown nsISVGValue");
1003 
1004     return ObservableModificationData(nsnull, 1);
1005   }

Comment 3

[Robert Longson [:longsonr]]

And the testcase?

Comment 4

[Daniel Holbert [:dholbert]]

Attachment: testcase 1

oops, sorry! meant to attach when filing bug.  Here's the testcase.

Comment 5

[Robert Longson [:longsonr]]

Attachment: patch

mSegments is not mapped.

Comment 6

[Robert Longson [:longsonr]]

pushed http://hg.mozilla.org/mozilla-central/rev/47cee476df16