Title: [146083] trunk
- Revision
- 146083
- Author
- r...@webkit.org
- Date
- 2013-03-18 10:38:16 -0700 (Mon, 18 Mar 2013)
Log Message
Source/WebCore: Assertion faulire in SVGAnimatedPath.
https://bugs.webkit.org/show_bug.cgi?id=106428
Reviewed by Allan Sandfeld Jensen.
The asserts are too restricted. The size must be greater or equal to 1.
Test: svg/animations/animated-path-via-use-debug-crash.svg
* svg/SVGAnimatedPath.cpp:
(WebCore::SVGAnimatedPathAnimator::startAnimValAnimation):
(WebCore::SVGAnimatedPathAnimator::resetAnimValToBaseVal):
LayoutTests: Assertion faulire in SVGAnimatedPath
https://bugs.webkit.org/show_bug.cgi?id=106428
Reviewed by Allan Sandfeld Jensen.
* svg/animations/animated-path-via-use-debug-crash.svg: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (146082 => 146083)
--- trunk/LayoutTests/ChangeLog 2013-03-18 17:34:37 UTC (rev 146082)
+++ trunk/LayoutTests/ChangeLog 2013-03-18 17:38:16 UTC (rev 146083)
@@ -1,3 +1,12 @@
+2013-03-18 Renata Hodovan <r...@webkit.org>
+
+ Assertion faulire in SVGAnimatedPath
+ https://bugs.webkit.org/show_bug.cgi?id=106428
+
+ Reviewed by Allan Sandfeld Jensen.
+
+ * svg/animations/animated-path-via-use-debug-crash.svg: Added.
+
2013-03-18 Simon Fraser <simon.fra...@apple.com>
[Mac] Some tests intermittently asserts in SharedBuffer::releasePurgeableBuffer()
Added: trunk/LayoutTests/svg/animations/animated-path-via-use-debug-crash-expected.txt (0 => 146083)
--- trunk/LayoutTests/svg/animations/animated-path-via-use-debug-crash-expected.txt (rev 0)
+++ trunk/LayoutTests/svg/animations/animated-path-via-use-debug-crash-expected.txt 2013-03-18 17:38:16 UTC (rev 146083)
@@ -0,0 +1 @@
+This test passes if it does not crash. See bug https://bugs.webkit.org/show_bug.cgi?id=106428
Added: trunk/LayoutTests/svg/animations/animated-path-via-use-debug-crash.svg (0 => 146083)
--- trunk/LayoutTests/svg/animations/animated-path-via-use-debug-crash.svg (rev 0)
+++ trunk/LayoutTests/svg/animations/animated-path-via-use-debug-crash.svg 2013-03-18 17:38:16 UTC (rev 146083)
@@ -0,0 +1,14 @@
+<svg xmlns:xlink="http://www.w3.org/1999/xlink" xmlns="http://www.w3.org/2000/svg">
+ <path id="test" d="M 10 10">
+ <animate attributeName="d"></animate>
+ </path>
+
+ <use xlink:href=""
+ <text x="10" y="20">This test passes if it does not crash. See bug https://bugs.webkit.org/show_bug.cgi?id=106428</text>
+
+ <script>
+ if (window.testRunner)
+ testRunner.dumpAsText();
+ </script>
+</svg>
+
Modified: trunk/Source/WebCore/ChangeLog (146082 => 146083)
--- trunk/Source/WebCore/ChangeLog 2013-03-18 17:34:37 UTC (rev 146082)
+++ trunk/Source/WebCore/ChangeLog 2013-03-18 17:38:16 UTC (rev 146083)
@@ -1,3 +1,18 @@
+2013-03-18 Renata Hodovan <r...@webkit.org>
+
+ Assertion faulire in SVGAnimatedPath.
+ https://bugs.webkit.org/show_bug.cgi?id=106428
+
+ Reviewed by Allan Sandfeld Jensen.
+
+ The asserts are too restricted. The size must be greater or equal to 1.
+
+ Test: svg/animations/animated-path-via-use-debug-crash.svg
+
+ * svg/SVGAnimatedPath.cpp:
+ (WebCore::SVGAnimatedPathAnimator::startAnimValAnimation):
+ (WebCore::SVGAnimatedPathAnimator::resetAnimValToBaseVal):
+
2013-03-18 Simon Fraser <simon.fra...@apple.com>
[Mac] Some tests intermittently asserts in SharedBuffer::releasePurgeableBuffer()
Modified: trunk/Source/WebCore/svg/SVGAnimatedPath.cpp (146082 => 146083)
--- trunk/Source/WebCore/svg/SVGAnimatedPath.cpp 2013-03-18 17:34:37 UTC (rev 146082)
+++ trunk/Source/WebCore/svg/SVGAnimatedPath.cpp 2013-03-18 17:38:16 UTC (rev 146083)
@@ -42,7 +42,7 @@
PassOwnPtr<SVGAnimatedType> SVGAnimatedPathAnimator::startAnimValAnimation(const SVGElementAnimatedPropertyList& animatedTypes)
{
- ASSERT(animatedTypes.size() == 1);
+ ASSERT(animatedTypes.size() >= 1);
SVGAnimatedPathSegListPropertyTearOff* property = castAnimatedPropertyToActualType<SVGAnimatedPathSegListPropertyTearOff>(animatedTypes[0].properties[0].get());
const SVGPathSegList& baseValue = property->currentBaseValue();
@@ -72,7 +72,7 @@
void SVGAnimatedPathAnimator::resetAnimValToBaseVal(const SVGElementAnimatedPropertyList& animatedTypes, SVGAnimatedType* type)
{
- ASSERT(animatedTypes.size() == 1);
+ ASSERT(animatedTypes.size() >= 1);
ASSERT(type);
ASSERT(type->type() == m_type);
const SVGPathSegList& baseValue = castAnimatedPropertyToActualType<SVGAnimatedPathSegListPropertyTearOff>(animatedTypes[0].properties[0].get())->currentBaseValue();
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes
