Bug 531550 - SVG SMIL: Fix assertion with indefinite duration by-animateTransform; r=dholbert; a=blocking-final

content/smil/crashtests/531550-1.svg

@@ -0,0 +1,3 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+  <g><animateTransform attributeName="transform" by="1"/></g>
+</svg>

content/smil/crashtests/crashtests.list

@@ -6,6 +6,7 @@ load 526536-1.svg
 load 526875-1.svg
 load 526875-2.svg
 load 529387-1.xhtml
+load 531550-1.svg
 load 537157-1.svg
 load 541297-1.svg
 load 547333-1.svg

content/svg/content/src/nsSVGTransformSMILType.cpp

@@ -182,10 +182,20 @@ nsSVGTransformSMILType::SandwichAdd(nsSMILValue& aDest,
   const TransformArray& srcTransforms
     (*static_cast<const TransformArray*>(aValueToAdd.mU.mPtr));
 
-  // We're only expecting to be adding 1 src transform on to the list
-  NS_ASSERTION(srcTransforms.Length() == 1,
+  // We should have 0 or 1 transforms in the src list.
+  NS_ASSERTION(srcTransforms.Length() < 2,
     "Trying to do sandwich add of more than one value");
 
+  // The empty src transform list case only occurs in some limited circumstances
+  // where we create an empty 'from' value to interpolate from (e.g.
+  // by-animation) but then skip the interpolation step for some reason (e.g.
+  // because we have an indefinite duration which means we'll never get past the
+  // first value) and instead attempt to add that empty value to the underlying
+  // value.
+  // In any case, the expected result is that nothing is added.
+  if (srcTransforms.IsEmpty())
+    return NS_OK;
+
   // Stick the src on the end of the array
   const nsSVGSMILTransform& srcTransform = srcTransforms[0];
   nsSVGSMILTransform* result = dstTransforms.AppendElement(srcTransform);