Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-10-09 03:15:11 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 757718 - Crash with SVG requiredFeatures, adoptNode. r=jwatt

Browse Source
This commit is contained in:
Robert Longson 2012-05-23 10:54:19 +01:00
parent ee7ff5f484
commit f42e89af46
3 changed files with 20 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
content/svg/content/src/DOMSVGStringList.cpp
View File

@ -186,7 +186,7 @@ DOMSVGStringList::InternalList()
{
if (mIsConditionalProcessingAttribute) {
nsCOMPtr<DOMSVGTests> tests = do_QueryInterface(mElement);
return *tests->GetStringListAttribute(mAttrEnum);
return *tests->GetOrCreateStringListAttribute(mAttrEnum);
}
return mElement->GetStringListInfo().mStringLists[mAttrEnum];
}

18
layout/svg/crashtests/757718-1.svg Normal file
View File

@ -0,0 +1,18 @@
<!DOCTYPE html>
<html>
<head>
<script>
function boom()
{
var svgDoc = (new DOMParser).parseFromString("<svg xmlns='http://www.w3.org/2000/svg'></svg>", "image/svg+xml");
var svgRoot = svgDoc.documentElement;
var rf = svgRoot.requiredFeatures;
document.adoptNode(svgRoot);
Object.getOwnPropertyNames(rf);
}
</script>
</head>
<body onload="boom();"></body>
</html>

1
layout/svg/crashtests/crashtests.list
View File

@ -128,3 +128,4 @@ load 732836-1.svg
load 740627-1.svg
load 740627-2.svg
load 757704-1.svg
load 757718-1.svg