Bug 113217 – ASSERT(m_type == toSVGTransform.type())

• Status: RESOLVED
• Resolution: FIXED
• Component: SVG

[Renata Hodovan]

Assertion fauilre happens in WebCore::SVGTransformDistance::SVGTransformDistance with the following test:

<svg xmlns="http://www.w3.org/2000/svg">
	<g transform="translate(5,0)">
		<animateTransform attributeName="transform" additive="sum" type="scale" to="2"></animateTransform> 
	</g>
</svg>


BACKTRACE:

Program received signal SIGSEGV, Segmentation fault.
0x00007ffff4ceb7e1 in WebCore::SVGTransformDistance::SVGTransformDistance (this=0x7fffffffcc30, fromSVGTransform=..., toSVGTransform=...)
    at /home/reni/WebKit-git/Source/WebCore/svg/SVGTransformDistance.cpp:56
56	    ASSERT(m_type == toSVGTransform.type());
(gdb) bt 15
#0  0x00007ffff4ceb7e1 in WebCore::SVGTransformDistance::SVGTransformDistance (this=0x7fffffffcc30, fromSVGTransform=..., toSVGTransform=...)
    at /home/reni/WebKit-git/Source/WebCore/svg/SVGTransformDistance.cpp:56
#1  0x00007ffff4c1e60e in WebCore::SVGAnimatedTransformListAnimator::calculateAnimatedValue (this=0x94b170, percentage=0, repeatCount=0, from=0x96ec40, to=0x7083a0, 
    toAtEndOfDuration=0x7083a0, animated=0x969be0) at /home/reni/WebKit-git/Source/WebCore/svg/SVGAnimatedTransformList.cpp:120
#2  0x00007ffff4c26558 in WebCore::SVGAnimateElement::calculateAnimatedValue (this=0x9736e0, percentage=0, repeatCount=0, resultElement=0x9736e0)
    at /home/reni/WebKit-git/Source/WebCore/svg/SVGAnimateElement.cpp:141
#3  0x00007ffff4c2f8a7 in WebCore::SVGAnimationElement::updateAnimation (this=0x9736e0, percent=0, repeatCount=0, resultElement=0x9736e0)
    at /home/reni/WebKit-git/Source/WebCore/svg/SVGAnimationElement.cpp:632
#4  0x00007ffff4bd4ac1 in WebCore::SVGSMILElement::progress (this=0x9736e0, elapsed=..., resultElement=0x9736e0, seekToTime=false)
    at /home/reni/WebKit-git/Source/WebCore/svg/animation/SVGSMILElement.cpp:1108
#5  0x00007ffff4bca9d8 in WebCore::SMILTimeContainer::updateAnimations (this=0x948400, elapsed=..., seekToTime=false)
    at /home/reni/WebKit-git/Source/WebCore/svg/animation/SMILTimeContainer.cpp:296
#6  0x00007ffff4bc9e8d in WebCore::SMILTimeContainer::begin (this=0x948400) at /home/reni/WebKit-git/Source/WebCore/svg/animation/SMILTimeContainer.cpp:142
#7  0x00007ffff4beef58 in WebCore::SVGDocumentExtensions::startAnimations (this=0x94a700) at /home/reni/WebKit-git/Source/WebCore/svg/SVGDocumentExtensions.cpp:102
#8  0x00007ffff40c5bb5 in WebCore::Document::implicitClose (this=0x942800) at /home/reni/WebKit-git/Source/WebCore/dom/Document.cpp:2532
#9  0x00007ffff453ea6d in WebCore::FrameLoader::checkCallImplicitClose (this=0x7012e8) at /home/reni/WebKit-git/Source/WebCore/loader/FrameLoader.cpp:837
#10 0x00007ffff453e801 in WebCore::FrameLoader::checkCompleted (this=0x7012e8) at /home/reni/WebKit-git/Source/WebCore/loader/FrameLoader.cpp:780
#11 0x00007ffff453e566 in WebCore::FrameLoader::finishedParsing (this=0x7012e8) at /home/reni/WebKit-git/Source/WebCore/loader/FrameLoader.cpp:713
#12 0x00007ffff40ccd1f in WebCore::Document::finishedParsing (this=0x942800) at /home/reni/WebKit-git/Source/WebCore/dom/Document.cpp:4493
#13 0x00007ffff4a1f34f in WebCore::XMLDocumentParser::end (this=0x707610) at /home/reni/WebKit-git/Source/WebCore/xml/parser/XMLDocumentParser.cpp:217
#14 0x00007ffff4a1f38c in WebCore::XMLDocumentParser::finish (this=0x707610) at /home/reni/WebKit-git/Source/WebCore/xml/parser/XMLDocumentParser.cpp:229

[Rob Buis]

Created attachment 208377 [details]
Patch

[Darin Adler]

Comment on attachment 208377 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=208377&action=review

> Source/WebCore/ChangeLog:3
> +        ASSERT(m_type == toSVGTransform.type())

Not a great bug title.

> Source/WebCore/ChangeLog:9
> +        This matches FireFox and Opera 12 behavior.

Firefox is misspelled here.

[Rob Buis]

Committed r153887: <http://trac.webkit.org/changeset/153887>