Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-12-04 02:57:38 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 841812 - Avoid crashing when changing attributes on an invalidly parented <textPath>. r=roc

Browse Source
This commit is contained in:
Cameron McCormack 2013-02-16 20:16:11 +11:00
parent 3d6315d338
commit a3ae42ea56
3 changed files with 16 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
layout/svg/crashtests/841812-1.svg Normal file
View File

@ -0,0 +1,11 @@
<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
<text>
<circle>
<textPath id="t" xlink:href="data:text/html,1" />
</circle>
</text>
<script>
window.addEventListener("load", function() { document.getElementById("t").removeAttribute('xlink:href'); }, false);
</script>
</svg>
Side by Side

After

Width:  |  Height:  |  Size: 363 B

1
layout/svg/crashtests/crashtests.list
View File

@ -152,3 +152,4 @@ load 789390-1.html
load 808318-1.svg
load 813420-1.svg
load 841163-1.svg
load 841812-1.svg

6
layout/svg/nsSVGTextFrame2.cpp
View File

@ -2956,8 +2956,10 @@ nsSVGTextFrame2::MutationObserver::AttributeChanged(
aAttribute == nsGkAtoms::href) {
// Blow away our reference, if any
nsIFrame* childElementFrame = aElement->GetPrimaryFrame();
childElementFrame->Properties().Delete(nsSVGEffects::HrefProperty());
mFrame->NotifyGlyphMetricsChange();
if (childElementFrame) {
childElementFrame->Properties().Delete(nsSVGEffects::HrefProperty());
mFrame->NotifyGlyphMetricsChange();
}
}
} else {
if (aNameSpaceID == kNameSpaceID_None &&