Bug 709907: Skip SMIL negative-value relaxation logic for the list-valued 'stroke-dasharray' property. r=dbaron

content/smil/crashtests/709907-1.svg

@@ -0,0 +1,3 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+  <animate attributeName="stroke-dasharray" from="-3" />
+</svg>

content/smil/crashtests/crashtests.list

@@ -47,3 +47,4 @@ load 691337-1.svg
 load 691337-2.svg
 load 697640-1.svg
 load 699325-1.svg
+load 709907-1.svg

content/smil/nsSMILCSSValueType.cpp

@@ -380,10 +380,16 @@ ValueFromStringHelper(nsCSSProperty aPropID,
   // CSS values. Bug 501188 will provide a more complete fix.)
   bool isNegative = false;
   PRUint32 subStringBegin = 0;
-  PRInt32 absValuePos = nsSMILParserUtils::CheckForNegativeNumber(aString);
-  if (absValuePos > 0) {
-    isNegative = true;
-    subStringBegin = (PRUint32)absValuePos; // Start parsing after '-' sign
+
+  // NOTE: We need to opt-out 'stroke-dasharray' from the negative-number
+  // check.  Its values might look negative (e.g. by starting with "-1"), but
+  // they're more complicated than our simple negation logic here can handle.
+  if (aPropID != eCSSProperty_stroke_dasharray) {
+    PRInt32 absValuePos = nsSMILParserUtils::CheckForNegativeNumber(aString);
+    if (absValuePos > 0) {
+      isNegative = true;
+      subStringBegin = (PRUint32)absValuePos; // Start parsing after '-' sign
+    }
   }
   nsDependentSubstring subString(aString, subStringBegin);
   if (!nsStyleAnimation::ComputeValue(aPropID, aTargetElement, subString,