Prevent use of stale list length for to-animations of transform lists

Prevent use of stale list length for to-animations of transform lists

When animating a transform list with a "To animation", the from value
will be the currently animated value, and hence the clear() in
SVGTransformList::calculateAnimatedValue will modify the fromList, and
clobber the |fromListSize| local variable - leading to an out-of-bounds
access.
To avoid this, acquire the reference to the effectiveFrom value earlier -
before the clear(). Also fold the single use of |fromListSize|.

BUG=368481
Committed: https://src.chromium.org/viewvc/blink?view=rev&revision=173192

[pdr., 2014-05-02 02:49:17]

LGTM

It's a shame we can't share more logic between our animated list types.

[pdr., 2014-05-02 02:49:31]

The CQ bit was checked by pdr@chromium.org

[commit-bot: I haz the power, 2014-05-02 02:49:42]

CQ is trying da patch. Follow status at
https://chromium-status.appspot.com/cq/fs@opera.com/261603002/1

[commit-bot: I haz the power, 2014-05-02 03:00:17]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2014-05-02 03:00:17]

Try jobs failed on following builders:
  blink_presubmit on tryserver.blink

[fs, 2014-05-02 08:26:42]

The CQ bit was checked by fs@opera.com

[commit-bot: I haz the power, 2014-05-02 08:26:53]

CQ is trying da patch. Follow status at
https://chromium-status.appspot.com/cq/fs@opera.com/261603002/1

[commit-bot: I haz the power, 2014-05-02 09:31:06]

Change committed as 173192