From f2d7637c45978d47f86cb8d922fcd9e52052ebf0 Mon Sep 17 00:00:00 2001
From: Brian Birtles <birtles@gmail.com>
Date: Tue, 25 May 2010 09:38:25 +0900
Subject: [PATCH] Bug 541297 - SVG SMIL: Fix abort on sampling re-attached
 animation node, r=roc

--HG--
extra : rebase_source : 1f228522d818b31d336558f6a238660c2972b770
---
 content/smil/crashtests/541297-1.svg    | 22 ++++++++++++++++++++++
 content/smil/crashtests/crashtests.list |  1 +
 content/smil/nsSMILTimedElement.cpp     |  4 ++++
 3 files changed, 27 insertions(+)
 create mode 100644 content/smil/crashtests/541297-1.svg

diff --git a/content/smil/crashtests/541297-1.svg b/content/smil/crashtests/541297-1.svg
new file mode 100644
index 000000000000..4268232ba1be
--- /dev/null
+++ b/content/smil/crashtests/541297-1.svg
@@ -0,0 +1,22 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<svg xmlns="http://www.w3.org/2000/svg"><svg id="w"><animate/></svg><script type="text/javascript">
+<![CDATA[
+
+function boom()
+{
+  anim = document.createElementNS("http://www.w3.org/2000/svg", "animate");
+  document.documentElement.appendChild(anim);
+  document.documentElement.removeChild(anim);
+  
+  setTimeout(t, 0);
+  
+  function t()
+  {
+    document.getElementById("w").appendChild(anim);
+  }
+}
+
+window.addEventListener("load", boom, false);
+
+]]>
+</script></svg>
diff --git a/content/smil/crashtests/crashtests.list b/content/smil/crashtests/crashtests.list
index 5642647bd0ac..6d1f24401f02 100644
--- a/content/smil/crashtests/crashtests.list
+++ b/content/smil/crashtests/crashtests.list
@@ -7,6 +7,7 @@ load 526875-1.svg
 load 526875-2.svg
 load 529387-1.xhtml
 load 537157-1.svg
+load 541297-1.svg
 load 547333-1.svg
 load 548899-1.svg
 load 554141-1.svg
diff --git a/content/smil/nsSMILTimedElement.cpp b/content/smil/nsSMILTimedElement.cpp
index 5098fbe6e54a..1c6f7ad2473b 100644
--- a/content/smil/nsSMILTimedElement.cpp
+++ b/content/smil/nsSMILTimedElement.cpp
@@ -972,6 +972,10 @@ nsSMILTimedElement::BindToTree(nsIContent* aContextNode)
     endSpec->ResolveReferences(aContextNode);
   }
 
+  // Clear any previous milestone since it might be been processed whilst we
+  // were not bound to the tree.
+  mPrevRegisteredMilestone = sMaxMilestone;
+
   RegisterMilestone();
 }