Sanitize m_keyTimes for paced value animations
https://bugs.webkit.org/show_bug.cgi?id=108828

Reviewed by Dirk Schulze.

Source/WebCore:

SVG animations with calcMode=paced calculate new m_keyTimes in
SVGAnimationElement::calculateKeyTimesForCalcModePaced() because paced animations do not
specify keyTimes. If an error occurs while calculating m_keyTimes, and there exists
user-specified values, a crash could occur because the user-specified values were not
sanitized.

This change clears user-specified keyTimes before calculating new ones.

Test: svg/animations/animate-keytimes-crash.html

* svg/SVGAnimationElement.cpp:
(WebCore::SVGAnimationElement::calculateKeyTimesForCalcModePaced):

LayoutTests:

* svg/animations/animate-keytimes-crash-expected.html: Added.
* svg/animations/animate-keytimes-crash.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@142365 268f45cc-cd09-0410-ab3c-d52691b4dbfc