From e749d23a34ff04c492bcf729e01ed1a0292408f1 Mon Sep 17 00:00:00 2001 From: Jonathan Watt Date: Tue, 20 Feb 2018 16:13:05 -0500 Subject: Bug 1430557. r=longsonr, a=lizzard --HG-- extra : rebase_source : 5109c816d9ad1ce1881e3670b8d74ae0dc475223 --- dom/svg/DOMSVGPathSegList.cpp | 21 +++++++++++++++++++-- 1 file changed, 19 insertions(+), 2 deletions(-) diff --git a/dom/svg/DOMSVGPathSegList.cpp b/dom/svg/DOMSVGPathSegList.cpp index edacdfc93..0b811cdb1 100644 --- a/dom/svg/DOMSVGPathSegList.cpp +++ b/dom/svg/DOMSVGPathSegList.cpp @@ -460,6 +460,18 @@ DOMSVGPathSegList::ReplaceItem(DOMSVGPathSeg& aNewItem, float segAsRaw[1 + NS_SVG_PATH_SEG_MAX_ARGS]; domItem->ToSVGPathSegEncodedData(segAsRaw); + if (AnimListMirrorsBaseList()) { + // The anim val list is in sync with the base val list - remove mirroring + // animVal item if necessary. We do this *before* touching InternalList() + // so the removed item can correctly store its internal value. + DOMSVGPathSegList* animVal = + GetDOMWrapperIfExists(InternalAList().GetAnimValKey()); + if (animVal->ItemAt(aIndex)) { + animVal->ItemAt(aIndex)->RemovingFromList(); + animVal->ItemAt(aIndex) = nullptr; + } + } + if (!InternalList().mData.ReplaceElementsAt(internalIndex, 1 + oldArgCount, segAsRaw, 1 + newArgCount, fallible)) { @@ -474,8 +486,13 @@ DOMSVGPathSegList::ReplaceItem(DOMSVGPathSeg& aNewItem, int32_t delta = newArgCount - oldArgCount; if (delta != 0) { - for (uint32_t i = aIndex + 1; i < LengthNoFlush(); ++i) { - mItems[i].mInternalDataIndex += delta; + // Sync up the internal indexes of all ItemProxys that come after aIndex: + UpdateListIndicesFromIndex(aIndex + 1, delta); + if (AnimListMirrorsBaseList()) { + // The anim val list is in sync with the base val list + DOMSVGPathSegList* animVal = + GetDOMWrapperIfExists(InternalAList().GetAnimValKey()); + animVal->UpdateListIndicesFromIndex(aIndex + 1, delta); } } -- cgit v1.2.3