Bug 1507961 - Check that an SVG DOM item wasn't removed from its list before scheduling its animation update r=longsonr

Differential Revision: https://phabricator.services.mozilla.com/D12361

--HG--
extra : moz-landing-system : lando

dom/svg/DOMSVGLength.cpp

@@ -81,7 +81,9 @@ public:
   {
     mLength->Element()->DidChangeLengthList(mLength->mAttrEnum,
                                             mEmptyOrOldValue);
-    if (mLength->mList->IsAnimating()) {
+    // Null check mLength->mList, since DidChangeLengthList can run script,
+    // potentially removing mLength from its list.
+    if (mLength->mList && mLength->mList->IsAnimating()) {
       mLength->Element()->AnimationNeedsResample();
     }
   }

dom/svg/DOMSVGNumber.cpp

@@ -70,7 +70,9 @@ public:
   {
     mNumber->Element()->DidChangeNumberList(mNumber->mAttrEnum,
                                             mEmptyOrOldValue);
-    if (mNumber->mList->IsAnimating()) {
+    // Null check mNumber->mList, since DidChangeNumberList can run script,
+    // potentially removing mNumber from its list.
+    if (mNumber->mList && mNumber->mList->IsAnimating()) {
       mNumber->Element()->AnimationNeedsResample();
     }
   }

dom/svg/DOMSVGPathSeg.cpp

@@ -63,7 +63,9 @@ public:
   ~AutoChangePathSegNotifier()
   {
     mPathSeg->Element()->DidChangePathSegList(mEmptyOrOldValue);
-    if (mPathSeg->mList->AttrIsAnimating()) {
+    // Null check mPathSeg->mList, since DidChangePathSegList can run script,
+    // potentially removing mPathSeg from its list.
+    if (mPathSeg->mList && mPathSeg->mList->AttrIsAnimating()) {
       mPathSeg->Element()->AnimationNeedsResample();
     }
   }

dom/svg/DOMSVGPoint.cpp

@@ -40,7 +40,9 @@ public:
   ~AutoChangePointNotifier()
   {
     mPoint->Element()->DidChangePointList(mEmptyOrOldValue);
-    if (mPoint->mList->AttrIsAnimating()) {
+    // Null check mPoint->mList, since DidChangePointList can run script,
+    // potentially removing mPoint from its list.
+    if (mPoint->mList && mPoint->mList->AttrIsAnimating()) {
       mPoint->Element()->AnimationNeedsResample();
     }
   }

dom/svg/SVGTransform.cpp

@@ -90,7 +90,9 @@ public:
   {
     if (mTransform->HasOwner()) {
       mTransform->Element()->DidChangeTransformList(mEmptyOrOldValue);
-      if (mTransform->mList->IsAnimating()) {
+      // Null check mTransform->mList, since DidChangeTransformList can run
+      // script, potentially removing mTransform from its list.
+      if (mTransform->mList && mTransform->mList->IsAnimating()) {
         mTransform->Element()->AnimationNeedsResample();
       }
     }

dom/svg/crashtests/crashtests.list

@@ -90,3 +90,4 @@ load 1420492.html
 load 1477853.html
 load 1486488.html
 load 1493447.html
+skip-if(Android) load 1507961-1.html  # times out on Android due to the test size