Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2025-03-07 01:01:43 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 1477853: Don't assume that SVGAnimationElement has a parent on bind. r=heycam

Browse Source 
We were passing aParent instead of this to the ID tracker.

This was unnecessary, since the document is definitely setup by this time, but
it was also assuming we had a parent which is not true.

Also it was claiming stuff about it only being used to get the composed doc,
which is false since bug 1163105.

Differential Revision: https://phabricator.services.mozilla.com/D2308

MozReview-Commit-ID: L6Vpl44QjGG
This commit is contained in:
Emilio Cobos Álvarez 2018-07-24 02:03:49 +02:00
parent 5c37d5f314
commit 65c23592eb
4 changed files with 17 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
dom/svg/SVGAnimationElement.cpp
View File

@ -185,10 +185,7 @@ SVGAnimationElement::BindToTree(nsIDocument* aDocument,
nsAutoString hrefStr;
href->ToString(hrefStr);
// Pass in |aParent| instead of |this| -- first argument is only used
// for a call to GetComposedDoc(), and |this| might not have a current
// document yet.
UpdateHrefTarget(aParent, hrefStr);
UpdateHrefTarget(hrefStr);
}
mTimedElement.BindToTree(aParent);
@ -301,7 +298,7 @@ SVGAnimationElement::AfterSetAttr(int32_t aNamespaceID, nsAtom* aName,
const nsAttrValue* xlinkHref =
mAttrsAndChildren.GetAttr(nsGkAtoms::href, kNameSpaceID_XLink);
if (xlinkHref) {
UpdateHrefTarget(this, xlinkHref->GetStringValue());
UpdateHrefTarget(xlinkHref->GetStringValue());
}
} else if (!HasAttr(kNameSpaceID_None, nsGkAtoms::href)) {
mHrefTarget.Unlink();
@ -315,7 +312,7 @@ SVGAnimationElement::AfterSetAttr(int32_t aNamespaceID, nsAtom* aName,
// set here, we only let that update our target if "href" is *unset*.
MOZ_ASSERT(aValue->Type() == nsAttrValue::eString,
"Expected href attribute to be string type");
UpdateHrefTarget(this, aValue->GetStringValue());
UpdateHrefTarget(aValue->GetStringValue());
} // else: we're not yet in a document -- we'll update the target on
// next BindToTree call.
@ -411,14 +408,13 @@ SVGAnimationElement::IsEventAttributeNameInternal(nsAtom* aName)
}
void
SVGAnimationElement::UpdateHrefTarget(nsIContent* aNodeForContext,
const nsAString& aHrefStr)
SVGAnimationElement::UpdateHrefTarget(const nsAString& aHrefStr)
{
nsCOMPtr<nsIURI> targetURI;
nsCOMPtr<nsIURI> baseURI = GetBaseURI();
nsContentUtils::NewURIWithDocumentCharset(getter_AddRefs(targetURI),
aHrefStr, OwnerDoc(), baseURI);
mHrefTarget.Reset(aNodeForContext, targetURI);
mHrefTarget.Reset(this, targetURI);
AnimationTargetChanged();
}

3
dom/svg/SVGAnimationElement.h
View File

@ -90,8 +90,7 @@ public:
protected:
// nsSVGElement overrides
void UpdateHrefTarget(nsIContent* aNodeForContext,
const nsAString& aHrefStr);
void UpdateHrefTarget(const nsAString& aHrefStr);
void AnimationTargetChanged();
/**

10
dom/svg/crashtests/1477853.html Normal file
View File

@ -0,0 +1,10 @@
<html id="a">
<script>
window.onload=function(){
c.getRootNode({composed: true}).replaceChild(b, a);
}
</script>
<body>
<svg>
<animate id="b" href="" />
<animateTransform id="c" />

1
dom/svg/crashtests/crashtests.list
View File

@ -87,3 +87,4 @@ load 1347617-3.svg
load 1402798.html
load 1419250-1.html
load 1420492.html
load 1477853.html