Bug 541297 - SVG SMIL: Fix abort on sampling re-attached animation node, r=roc

--HG--
extra : rebase_source : 1f228522d818b31d336558f6a238660c2972b770

content/smil/crashtests/541297-1.svg

@@ -0,0 +1,22 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<svg xmlns="http://www.w3.org/2000/svg"><svg id="w"><animate/></svg><script type="text/javascript">
+<![CDATA[
+
+function boom()
+{
+  anim = document.createElementNS("http://www.w3.org/2000/svg", "animate");
+  document.documentElement.appendChild(anim);
+  document.documentElement.removeChild(anim);
+  
+  setTimeout(t, 0);
+  
+  function t()
+  {
+    document.getElementById("w").appendChild(anim);
+  }
+}
+
+window.addEventListener("load", boom, false);
+
+]]>
+</script></svg>

content/smil/crashtests/crashtests.list

@@ -7,6 +7,7 @@ load 526875-1.svg
 load 526875-2.svg
 load 529387-1.xhtml
 load 537157-1.svg
+load 541297-1.svg
 load 547333-1.svg
 load 548899-1.svg
 load 554141-1.svg

content/smil/nsSMILTimedElement.cpp

@@ -972,6 +972,10 @@ nsSMILTimedElement::BindToTree(nsIContent* aContextNode)
     endSpec->ResolveReferences(aContextNode);
   }
 
+  // Clear any previous milestone since it might be been processed whilst we
+  // were not bound to the tree.
+  mPrevRegisteredMilestone = sMaxMilestone;
+
   RegisterMilestone();
 }