Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-10-08 19:04:45 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 1502936 - Fix SVGUseElement::GetFrame to not get confused. r=heycam

Browse Source 
Should've noticed in bug 1502658 that GetFrame() was dead, to verify its
assumptions... Oh well.

Differential Revision: https://phabricator.services.mozilla.com/D10109
This commit is contained in:
Emilio Cobos Álvarez 2018-10-29 20:30:22 +01:00
parent cc4a717c32
commit 622bf3097d
3 changed files with 18 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
dom/svg/SVGUseElement.cpp
View File

@ -563,7 +563,12 @@ nsSVGUseFrame*
SVGUseElement::GetFrame() const
{
nsIFrame* frame = GetPrimaryFrame();
MOZ_ASSERT_IF(frame, frame->IsSVGUseFrame());
// We might be a plain nsSVGContainerFrame if we didn't pass the conditional
// processing checks.
if (!frame || !frame->IsSVGUseFrame()) {
MOZ_ASSERT_IF(frame, frame->Type() == LayoutFrameType::None);
return nullptr;
}
return static_cast<nsSVGUseFrame*>(frame);
}

11
layout/svg/crashtests/1502936.html Normal file
View File

@ -0,0 +1,11 @@
<script>
function go() {
a.setAttribute("requiredExtensions", "x");
b.getBoundingClientRect();
a.setAttribute("y", "-1px");
}
</script>
<body onload=go()>
<svg>
<use id="a">
<feGaussianBlur id="b">

1
layout/svg/crashtests/crashtests.list
View File

@ -217,3 +217,4 @@ load empty-blob-merging.html
load grouping-empty-bounds.html
load 1480275.html
load 1480224.html
load 1502936.html