Bug 131097 – ASSERTION FAILED: !begin.isIndefinite() in WebCore::SVGSMILElement::resolveFirstInterval

• Component: New Bugs
• Status: RESOLVED FIXED

[Martin Hodovan]

Created attachment 228376 [details]
Test case

The failing test case:

<svg>
    <animatemotion begin="-13 ;indefinite ;" max="0h"> </animatemotion>
</svg>


The backtrace:

#1  0x00007ffff1638939 in WebCore::SVGSMILElement::resolveFirstInterval (this=0x785470) at /home/martin/Data/WebKit/Source/WebCore/svg/animation/SVGSMILElement.cpp:840
#2  0x00007ffff16353c0 in WebCore::SVGSMILElement::insertedInto (this=0x785470, rootParent=...) at /home/martin/Data/WebKit/Source/WebCore/svg/animation/SVGSMILElement.cpp:256
#3  0x00007ffff09e6265 in WebCore::ChildNodeInsertionNotifier::notifyNodeInsertedIntoDocument (this=0x7fffffffd140, node=...)
    at /home/martin/Data/WebKit/Source/WebCore/dom/ContainerNodeAlgorithms.h:200
#4  0x00007ffff09e641d in WebCore::ChildNodeInsertionNotifier::notify (this=0x7fffffffd140, node=...) at /home/martin/Data/WebKit/Source/WebCore/dom/ContainerNodeAlgorithms.h:228
#5  0x00007ffff09e3e9a in WebCore::ContainerNode::parserAppendChild (this=0x6d2ab0, newChild=...) at /home/martin/Data/WebKit/Source/WebCore/dom/ContainerNode.cpp:744
#6  0x00007ffff0d12c94 in WebCore::insert (task=...) at /home/martin/Data/WebKit/Source/WebCore/html/parser/HTMLConstructionSite.cpp:96
#7  0x00007ffff0d12ced in WebCore::executeInsertTask (task=...) at /home/martin/Data/WebKit/Source/WebCore/html/parser/HTMLConstructionSite.cpp:103
#8  0x00007ffff0d12ef3 in WebCore::executeTask (task=...) at /home/martin/Data/WebKit/Source/WebCore/html/parser/HTMLConstructionSite.cpp:141
#9  0x00007ffff0d13218 in WebCore::HTMLConstructionSite::executeQueuedTasks (this=0x6e8e68) at /home/martin/Data/WebKit/Source/WebCore/html/parser/HTMLConstructionSite.cpp:191
#10 0x00007ffff0d40564 in WebCore::HTMLTreeBuilder::constructTree (this=0x6e8e50, token=0x7fffffffd2c0)
    at /home/martin/Data/WebKit/Source/WebCore/html/parser/HTMLTreeBuilder.cpp:366
#11 0x00007ffff0d1b6a8 in WebCore::HTMLDocumentParser::constructTreeFromHTMLToken (this=0x6f3c10, rawToken=...)
    at /home/martin/Data/WebKit/Source/WebCore/html/parser/HTMLDocumentParser.cpp:352
#12 0x00007ffff0d1b32f in WebCore::HTMLDocumentParser::pumpTokenizer (this=0x6f3c10, mode=WebCore::HTMLDocumentParser::AllowYield)
    at /home/martin/Data/WebKit/Source/WebCore/html/parser/HTMLDocumentParser.cpp:309
#13 0x00007ffff0d1ab35 in WebCore::HTMLDocumentParser::pumpTokenizerIfPossible (this=0x6f3c10, mode=WebCore::HTMLDocumentParser::AllowYield)
    at /home/martin/Data/WebKit/Source/WebCore/html/parser/HTMLDocumentParser.cpp:189
#14 0x00007ffff0d1bbef in WebCore::HTMLDocumentParser::append (this=0x6f3c10, inputSource=...) at /home/martin/Data/WebKit/Source/WebCore/html/parser/HTMLDocumentParser.cpp:428
#15 0x00007ffff09f8f01 in WebCore::DecodedDataDocumentParser::flush (this=0x6f3c10, writer=...) at /home/martin/Data/WebKit/Source/WebCore/dom/DecodedDataDocumentParser.cpp:60
#16 0x00007ffff0e7f1a3 in WebCore::DocumentWriter::end (this=0x735490) at /home/martin/Data/WebKit/Source/WebCore/loader/DocumentWriter.cpp:245
#17 0x00007ffff0e69b69 in WebCore::DocumentLoader::finishedLoading (this=0x7353f0, finishTime=0) at /home/martin/Data/WebKit/Source/WebCore/loader/DocumentLoader.cpp:440
#18 0x00007ffff0e698d2 in WebCore::DocumentLoader::notifyFinished (this=0x7353f0, resource=0x73e750) at /home/martin/Data/WebKit/Source/WebCore/loader/DocumentLoader.cpp:374
#19 0x00007ffff0f129c8 in WebCore::CachedResource::checkNotify (this=0x73e750) at /home/martin/Data/WebKit/Source/WebCore/loader/cache/CachedResource.cpp:332
#20 0x00007ffff0f12aa6 in WebCore::CachedResource::finishLoading (this=0x73e750) at /home/martin/Data/WebKit/Source/WebCore/loader/cache/CachedResource.cpp:348
#21 0x00007ffff0f0f44e in WebCore::CachedRawResource::finishLoading (this=0x73e750, data=0x74eb10)
    at /home/martin/Data/WebKit/Source/WebCore/loader/cache/CachedRawResource.cpp:97
#22 0x00007ffff0eca590 in WebCore::SubresourceLoader::didFinishLoading (this=0x7406a0, finishTime=0) at /home/martin/Data/WebKit/Source/WebCore/loader/SubresourceLoader.cpp:310
#23 0x00007ffff0ec6847 in WebCore::ResourceLoader::didFinishLoading (this=0x7406a0, finishTime=0) at /home/martin/Data/WebKit/Source/WebCore/loader/ResourceLoader.cpp:508
#24 0x00007ffff17b51ed in WebCore::readCallback (asyncResult=0x77e9e0, data=0x740ac0) at /home/martin/Data/WebKit/Source/WebCore/platform/network/soup/ResourceHandleSoup.cpp:1324
#25 0x00007fffebe85aaa in async_ready_callback_wrapper (source_object=0x66e1b0, res=0x77e9e0, user_data=0x740ac0) at ginputstream.c:519
#26 0x00007fffebea547b in g_task_return_now (task=0x77e9e0) at gtask.c:1108
#27 0x00007fffebea5499 in complete_in_idle_cb (task=0x77e9e0) at gtask.c:1117
#28 0x00007fffeb8f5536 in g_main_dispatch (context=0x6692e0) at gmain.c:3065
#29 g_main_context_dispatch (context=context@entry=0x6692e0) at gmain.c:3641
#30 0x00007fffecbd6708 in _ecore_glib_select__locked (ecore_timeout=<optimized out>, efds=<optimized out>, wfds=0x7fffffffda30, rfds=0x7fffffffd9b0, ecore_fds=8, 
    ctx=<optimized out>) at ecore_glib.c:171
#31 _ecore_glib_select (ecore_fds=8, rfds=0x7fffffffd9b0, wfds=0x7fffffffda30, efds=<optimized out>, ecore_timeout=<optimized out>) at ecore_glib.c:205
#32 0x00007fffecbd0b37 in _ecore_main_select (timeout=<optimized out>) at ecore_main.c:1466
#33 0x00007fffecbd16c5 in _ecore_main_loop_iterate_internal (once_only=once_only@entry=0) at ecore_main.c:1894
#34 0x00007fffecbd19c7 in ecore_main_loop_begin () at ecore_main.c:956
#35 0x00007ffff76a122b in WTF::RunLoop::run () at /home/martin/Data/WebKit/Source/WTF/wtf/efl/RunLoopEfl.cpp:51
#36 0x00007ffff763347d in WebKit::WebProcessMainEfl (argc=2, argv=0x7fffffffdeb8) at /home/martin/Data/WebKit/Source/WebKit2/WebProcess/efl/WebProcessMainEfl.cpp:126
#37 0x0000000000400840 in main (argc=2, argv=0x7fffffffdeb8) at /home/martin/Data/WebKit/Source/WebKit2/efl/MainEfl.cpp:30

[Tamas Gergely]

According to the SVG 1.1 animation reference (http://www.w3.org/TR/SVG11/animate.html#TimingAttributes), max "Value must be greater than 0.".

Seems to be a boundary-value error, as wk works fine for negative values (ignores them).

[Tamas Gergely]

Created attachment 230080 [details]
patch

[WebKit Commit Bot]

Comment on attachment 230080 [details]
patch

Clearing flags on attachment: 230080

Committed r167761: <http://trac.webkit.org/changeset/167761>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.