From 17c992a3f596d7deac6c082eb01ae3534ba64bf3 Mon Sep 17 00:00:00 2001
From: "jwalden@mit.edu" <jwalden@mit.edu>
Date: Wed, 5 Mar 2008 18:10:43 -0800
Subject: [PATCH] Bug 420243 - Fix an arithmetic mistake in
 SVGTextContentElement.getSubStringLength.  r+sr=roc, a=beltzner

---
 content/svg/content/Makefile.in               |   4 +
 content/svg/content/test/Makefile.in          |  53 +++++++++
 .../test/getSubStringLength-helper.svg        |   7 ++
 .../test/test_getSubStringLength.xhtml        | 105 ++++++++++++++++++
 .../svg/base/src/nsSVGTextContainerFrame.cpp  |  11 +-
 5 files changed, 175 insertions(+), 5 deletions(-)
 create mode 100644 content/svg/content/test/Makefile.in
 create mode 100644 content/svg/content/test/getSubStringLength-helper.svg
 create mode 100644 content/svg/content/test/test_getSubStringLength.xhtml

diff --git a/content/svg/content/Makefile.in b/content/svg/content/Makefile.in
index 92b87bc00a03..d90c200d5938 100644
--- a/content/svg/content/Makefile.in
+++ b/content/svg/content/Makefile.in
@@ -45,5 +45,9 @@ include $(DEPTH)/config/autoconf.mk
 
 DIRS		= src
 
+ifdef MOZ_MOCHITEST
+DIRS += test
+endif
+
 include $(topsrcdir)/config/rules.mk
 
diff --git a/content/svg/content/test/Makefile.in b/content/svg/content/test/Makefile.in
new file mode 100644
index 000000000000..181b3a1b639f
--- /dev/null
+++ b/content/svg/content/test/Makefile.in
@@ -0,0 +1,53 @@
+#
+# ***** BEGIN LICENSE BLOCK *****
+# Version: MPL 1.1/GPL 2.0/LGPL 2.1
+#
+# The contents of this file are subject to the Mozilla Public License Version
+# 1.1 (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+# http://www.mozilla.org/MPL/
+#
+# Software distributed under the License is distributed on an "AS IS" basis,
+# WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+# for the specific language governing rights and limitations under the
+# License.
+#
+# The Original Code is mozilla.org code.
+#
+# The Initial Developer of the Original Code is
+# Jeff Walden <jwalden+code@mit.edu>.
+# Portions created by the Initial Developer are Copyright (C) 2008
+# the Initial Developer. All Rights Reserved.
+#
+# Contributor(s):
+#
+# Alternatively, the contents of this file may be used under the terms of
+# either of the GNU General Public License Version 2 or later (the "GPL"),
+# or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+# in which case the provisions of the GPL or the LGPL are applicable instead
+# of those above. If you wish to allow use of your version of this file only
+# under the terms of either the GPL or the LGPL, and not to allow others to
+# use your version of this file under the terms of the MPL, indicate your
+# decision by deleting the provisions above and replace them with the notice
+# and other provisions required by the GPL or the LGPL. If you do not delete
+# the provisions above, a recipient may use your version of this file under
+# the terms of any one of the MPL, the GPL or the LGPL.
+#
+# ***** END LICENSE BLOCK *****
+
+DEPTH		= ../../../..
+topsrcdir	= @top_srcdir@
+srcdir		= @srcdir@
+VPATH		= @srcdir@
+relativesrcdir  = content/svg/content/test
+
+include $(DEPTH)/config/autoconf.mk
+include $(topsrcdir)/config/rules.mk
+
+_TEST_FILES = \
+		test_getSubStringLength.xhtml \
+		getSubStringLength-helper.svg \
+		$(NULL)
+
+libs:: $(_TEST_FILES)
+	$(INSTALL) $(foreach f,$^,"$f") $(DEPTH)/_tests/testing/mochitest/tests/$(relativesrcdir)
diff --git a/content/svg/content/test/getSubStringLength-helper.svg b/content/svg/content/test/getSubStringLength-helper.svg
new file mode 100644
index 000000000000..6c80d9d46bd4
--- /dev/null
+++ b/content/svg/content/test/getSubStringLength-helper.svg
@@ -0,0 +1,7 @@
+<?xml version="1.0"?>
+<svg xmlns="http://www.w3.org/2000/svg" width="750">
+  <style type="text/css">
+.t { font: 20px monospace; }
+  </style>
+  <text id="text" x="5" class="t" y="25">abc</text>
+</svg>
diff --git a/content/svg/content/test/test_getSubStringLength.xhtml b/content/svg/content/test/test_getSubStringLength.xhtml
new file mode 100644
index 000000000000..aedf018624f6
--- /dev/null
+++ b/content/svg/content/test/test_getSubStringLength.xhtml
@@ -0,0 +1,105 @@
+<!DOCTYPE html>
+<html xmlns="http://www.w3.org/1999/xhtml">
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=420243
+-->
+<head>
+  <title>Test for Bug 420243</title>
+  <script type="application/javascript" src="/MochiKit/packed.js"></script>
+  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=420243">Mozilla Bug 420243</a>
+<p id="display"></p>
+<div id="content" style="display: none"></div>
+
+<iframe id="svg" src="getSubStringLength-helper.svg"></iframe>
+
+<pre id="test">
+<script class="testbody" type="application/javascript">
+SimpleTest.waitForExplicitFinish();
+
+function runTests(text, charWidth)
+{
+  function chars(n) { return charWidth * n; }
+
+  function expectThrow(charnum, nchars)
+  {
+    try
+    {
+      text.getSubStringLength(charnum, nchars);
+      ok(false,
+         "text.getSubStringLength(" + charnum + "," + nchars + ") " +
+         "should have thrown");
+    }
+    catch (e)
+    {
+      is(e.code, DOMException.INDEX_SIZE_ERR,
+         "expected an index error for " +
+         "text.getSubStringLength(" + charnum + "," + nchars + ")");
+    }
+  }
+  
+  function expectValue(charnum, nchars, expected)
+  {
+    try
+    {
+      is(text.getSubStringLength(charnum, nchars), expected,
+         "text.getSubStringLength(" + charnum + "," + nchars + ") " +
+         "returned wrong value");
+    }
+    catch (e)
+    {
+      ok(false,
+         "unexpected exception for " +
+         "text.getSubStringLength(" + charnum + "," + nchars + ")");
+    }
+  }
+
+  expectThrow(-1, 2);
+  expectThrow(-1, 0);
+  expectThrow(1, 3);
+  expectThrow(0, 4);
+  expectThrow(3, 0);
+
+  expectValue(0, 0, chars(0));
+  expectValue(1, 0, chars(0));
+  expectValue(2, 0, chars(0));
+  expectValue(0, 1, chars(1));
+  expectValue(1, 1, chars(1));
+  expectValue(2, 1, chars(1));
+  expectValue(0, 2, chars(2));
+  expectValue(1, 2, chars(2));
+  expectValue(0, 3, chars(3));
+
+  expectThrow(1, -1);
+  expectThrow(2, -1);
+  expectThrow(3, -1);
+  expectThrow(3, -3);
+  expectThrow(-1, -1);
+}
+
+
+function run()
+{
+  try
+  {
+    var document = $("svg").contentWindow.document;
+    var text = document.getElementById("text");
+
+    runTests(text, text.getSubStringLength(0, 1));
+  }
+  catch (e)
+  {
+    ok(false, "threw error: " + e);
+  }
+
+  SimpleTest.finish();
+}
+
+window.addEventListener("load", run, false);
+</script>
+</pre>
+</body>
+</html>
diff --git a/layout/svg/base/src/nsSVGTextContainerFrame.cpp b/layout/svg/base/src/nsSVGTextContainerFrame.cpp
index 8e1a00afae72..e4c147bc564a 100755
--- a/layout/svg/base/src/nsSVGTextContainerFrame.cpp
+++ b/layout/svg/base/src/nsSVGTextContainerFrame.cpp
@@ -182,16 +182,17 @@ nsSVGTextContainerFrame::GetSubStringLength(PRUint32 charnum,
                                             PRUint32 nchars,
                                             float *_retval)
 {
+  PRUint32 charcount = GetNumberOfChars();
+  if (charcount <= charnum || nchars > charcount - charnum) {
+    *_retval = 0.0f;
+    return NS_ERROR_DOM_INDEX_SIZE_ERR;
+  }
+
   if (nchars == 0) {
     *_retval = 0.0f;
     return NS_OK;
   }
 
-  if (charnum + nchars > GetNumberOfChars()) {
-    *_retval = 0.0f;
-    return NS_ERROR_DOM_INDEX_SIZE_ERR;
-  }
-
   *_retval = GetSubStringLengthNoValidation(charnum, nchars);
 
   return NS_OK;