Bug 523188: Allow for ClearAnimValue() (and SetSMILOverrideStyleRule()) to be called for animation targets that aren't in a document. r=birtles r=roc

content/base/src/nsGenericElement.cpp

@@ -2974,13 +2974,16 @@ nsGenericElement::SetSMILOverrideStyleRule(nsICSSStyleRule* aStyleRule,
 
   if (aNotify) {
     nsIDocument* doc = GetCurrentDoc();
-    NS_ABORT_IF_FALSE(doc, "Shouldn't be able to animate style on a node "
-                      "unless it's in a document...");
-    nsPresShellIterator iter(doc);
-    nsCOMPtr<nsIPresShell> shell;
-    while (shell = iter.GetNextShell()) {
-      nsPresContext* presContext = shell->GetPresContext();
-      presContext->SMILOverrideStyleChanged(this);
+    // Only need to notify PresContexts if we're in a document.  (We might not
+    // be in a document, if we're clearing animation effects on a target node
+    // that's been detached since the previous animation sample.)
+    if (doc) {
+      nsPresShellIterator iter(doc);
+      nsCOMPtr<nsIPresShell> shell;
+      while (shell = iter.GetNextShell()) {
+        nsPresContext* presContext = shell->GetPresContext();
+        presContext->SMILOverrideStyleChanged(this);
+      }
     }
   }
 

content/smil/crashtests/523188-1.svg

@@ -0,0 +1,15 @@
+<?xml version="1.0"?>
+<svg xmlns="http://www.w3.org/2000/svg"
+     class="reftest-wait"
+     onload="setTimeout(removeNode, 0)">
+  <script>
+    function removeNode() {
+      var node = document.getElementById("myRect");
+      node.parentNode.removeChild(node);
+      document.documentElement.removeAttribute("class");
+    }
+  </script>
+  <rect id="myRect" x="20" y="20" height="50" width="50" stroke="blue">
+    <animate attributeName="stroke-width" from="1" to="9" begin="0s" dur="2s"/>
+  </rect>
+</svg>

content/smil/crashtests/crashtests.list

@@ -0,0 +1 @@
+load 523188-1.svg

content/smil/nsISMILAttr.h

@@ -84,6 +84,9 @@ public:
 
   /**
    * Clears the animated value of this attribute.
+   *
+   * NOTE: The animation target is not guaranteed to be in a document when this
+   * method is called. (See bug 523188)
    */
   virtual void ClearAnimValue() = 0;
 

layout/reftests/svg/smil/anim-remove-8css.svg

@@ -0,0 +1,35 @@
+<svg xmlns="http://www.w3.org/2000/svg"
+     xmlns:xlink="http://www.w3.org/1999/xlink"
+     onload="go()"
+     class="reftest-wait">
+  <!-- In this test, we temporarily remove the animation target, detach
+       its <animate> node, and then reinsert the (now former) animation target.
+       We verify that animation effects are removed from the former target. -->
+  <script>
+    var parent;
+    var rect;
+    function go() {
+      // Seek animation before we start tweaking things, to make sure we've
+      // already started sampling it.
+      document.documentElement.setCurrentTime(0.5);
+
+      var anim = document.getElementById("anim");
+      rect = anim.parentNode;
+      parent = rect.parentNode;
+      parent.removeChild(rect);
+      rect.removeChild(anim);
+
+      setTimeout(reinsert, 50); // Allow time for a sample
+    }
+    function reinsert() {
+      parent.appendChild(rect);
+      document.documentElement.removeAttribute("class");
+    }
+  </script>
+  <script xlink:href="smil-util.js" type="text/javascript"/>
+  <rect x="15" y="15" width="200" height="200" fill="blue"
+        stroke="red" stroke-width="0">
+    <animate id="anim" attributeName="stroke-width"
+             begin="0s" dur="2s" from="25" to="50" fill="freeze"/>
+  </rect>
+</svg>

layout/reftests/svg/smil/anim-remove-8xml.svg

@@ -0,0 +1,34 @@
+<svg xmlns="http://www.w3.org/2000/svg"
+     xmlns:xlink="http://www.w3.org/1999/xlink"
+     onload="go()"
+     class="reftest-wait">
+  <!-- In this test, we temporarily remove the animation target, detach
+       its <animate> node, and then reinsert the (now former) animation target.
+       We verify that animation effects are removed from the former target. -->
+  <script>
+    var parent;
+    var rect;
+    function go() {
+      // Seek animation before we start tweaking things, to make sure we've
+      // already started sampling it.
+      document.documentElement.setCurrentTime(0.5);
+
+      var anim = document.getElementById("anim");
+      rect = anim.parentNode;
+      parent = rect.parentNode;
+      parent.removeChild(rect);
+      rect.removeChild(anim);
+
+      setTimeout(reinsert, 50); // Allow time for a sample
+    }
+    function reinsert() {
+      parent.appendChild(rect);
+      document.documentElement.removeAttribute("class");
+    }
+  </script>
+  <script xlink:href="smil-util.js" type="text/javascript"/>
+  <rect x="15" y="15" width="200" height="200" fill="blue">
+    <animate id="anim" attributeName="height"
+             begin="0s" dur="2s" from="25" to="50" fill="freeze"/>
+  </rect>
+</svg>

layout/reftests/svg/smil/reftest.list

@@ -74,6 +74,8 @@ fails == anim-fillopacity-1xml.svg  anim-standard-ref.svg # bug 436276
 == anim-remove-5.svg anim-standard-ref.svg
 == anim-remove-6.svg anim-standard-ref.svg
 == anim-remove-7.svg anim-standard-ref.svg
+== anim-remove-8css.svg anim-standard-ref.svg
+== anim-remove-8xml.svg anim-standard-ref.svg
 == anim-retarget-1.svg anim-standard-ref.svg
 == anim-retarget-2.svg anim-standard-ref.svg
 == anim-retarget-3.svg anim-standard-ref.svg

testing/crashtest/crashtests.list

@@ -8,6 +8,7 @@ include ../../content/canvas/crashtests/crashtests.list
 include ../../content/events/crashtests/crashtests.list
 include ../../content/html/document/crashtests/crashtests.list
 include ../../content/html/content/crashtests/crashtests.list
+include ../../content/smil/crashtests/crashtests.list
 include ../../content/svg/content/src/crashtests/crashtests.list
 include ../../content/xml/content/crashtest/crashtests.list
 include ../../content/xml/document/crashtests/crashtests.list