Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-10-11 04:15:43 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 601406 - GetBBox crashes when called on an SVG a element r=jwatt a=blocking-final

Browse Source
This commit is contained in:
Robert Longson 2010-10-08 17:49:39 +01:00
parent 8a60164429
commit 2ba0cb27b5
3 changed files with 15 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
content/svg/content/src/crashtests/601406-1.svg Normal file
View File

@ -0,0 +1,12 @@
<svg xmlns="http://www.w3.org/2000/svg">
<script>
<![CDATA[
function boom() { document.getElementById("a").getBBox(); }
window.addEventListener("load", boom, false);
]]>
</script>
<a id="a"/>
</svg>
Side by Side

After

Width:  |  Height:  |  Size: 202 B

1
content/svg/content/src/crashtests/crashtests.list
View File

@ -51,3 +51,4 @@ load 573316-1.svg
load 579356-1.svg
load 579356-2.svg
load 595608-1.svg
load 601406-1.svg

3
layout/svg/base/src/nsSVGUtils.cpp
View File

@ -1324,7 +1324,8 @@ nsSVGUtils::GetBBox(nsIFrame *aFrame)
// filter to text. When one of these facilities is applied to text
// the bounding box is the entire ‘text’ element in all
// cases.
nsSVGTextContainerFrame* metrics = do_QueryFrame(aFrame);
nsSVGTextContainerFrame* metrics = do_QueryFrame(
GetFirstNonAAncestorFrame(aFrame));
if (metrics) {
while (aFrame->GetType() != nsGkAtoms::svgTextFrame) {
aFrame = aFrame->GetParent();