mirror of
https://github.com/mozilla/gecko-dev.git
synced 2024-10-08 19:04:45 +00:00
Bug 1502936 - Fix SVGUseElement::GetFrame to not get confused. r=heycam
Should've noticed in bug 1502658 that GetFrame() was dead, to verify its assumptions... Oh well. Differential Revision: https://phabricator.services.mozilla.com/D10109
This commit is contained in:
parent
cc4a717c32
commit
622bf3097d
@ -563,7 +563,12 @@ nsSVGUseFrame*
|
|||||||
SVGUseElement::GetFrame() const
|
SVGUseElement::GetFrame() const
|
||||||
{
|
{
|
||||||
nsIFrame* frame = GetPrimaryFrame();
|
nsIFrame* frame = GetPrimaryFrame();
|
||||||
MOZ_ASSERT_IF(frame, frame->IsSVGUseFrame());
|
// We might be a plain nsSVGContainerFrame if we didn't pass the conditional
|
||||||
|
// processing checks.
|
||||||
|
if (!frame || !frame->IsSVGUseFrame()) {
|
||||||
|
MOZ_ASSERT_IF(frame, frame->Type() == LayoutFrameType::None);
|
||||||
|
return nullptr;
|
||||||
|
}
|
||||||
return static_cast<nsSVGUseFrame*>(frame);
|
return static_cast<nsSVGUseFrame*>(frame);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
11
layout/svg/crashtests/1502936.html
Normal file
11
layout/svg/crashtests/1502936.html
Normal file
@ -0,0 +1,11 @@
|
|||||||
|
<script>
|
||||||
|
function go() {
|
||||||
|
a.setAttribute("requiredExtensions", "x");
|
||||||
|
b.getBoundingClientRect();
|
||||||
|
a.setAttribute("y", "-1px");
|
||||||
|
}
|
||||||
|
</script>
|
||||||
|
<body onload=go()>
|
||||||
|
<svg>
|
||||||
|
<use id="a">
|
||||||
|
<feGaussianBlur id="b">
|
@ -217,3 +217,4 @@ load empty-blob-merging.html
|
|||||||
load grouping-empty-bounds.html
|
load grouping-empty-bounds.html
|
||||||
load 1480275.html
|
load 1480275.html
|
||||||
load 1480224.html
|
load 1480224.html
|
||||||
|
load 1502936.html
|
||||||
|
Loading…
Reference in New Issue
Block a user