wine/gecko
0
0
Fork 0
mirror of https://gitlab.winehq.org/wine/wine-gecko.git synced 2024-09-13 09:24:08 -07:00
Code Issues Packages Projects Releases Wiki Activity

Bug 1156581 - Add null check to nsSVGEffects::InvalidateRenderingObservers to prevent crashes r=dholbert

Browse Source
This commit is contained in:
Robert Longson 2015-12-30 20:19:33 +00:00
parent 6e3b3ad7d8
commit 6ae02084b0
3 changed files with 19 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
layout/svg/crashtests/1156581-1.svg Normal file
View File

@ -0,0 +1,12 @@
<svg xmlns="http://www.w3.org/2000/svg" style="filter: url(#a); clip: rect(0px, 4rem, 2px, 2px);">
<script>
function boom()
{
document.getElementById("a").style.overflow = "hidden";
document.documentElement.style.fontSize = "10px";
}
window.addEventListener("load", boom, false);
</script>
<set id="a"/>
</svg>
Side by Side

After

Width:  |  Height:  |  Size: 380 B

1
layout/svg/crashtests/crashtests.list
View File

@ -192,6 +192,7 @@ load 1016145.svg
load 1028512.svg
load 1140080-1.svg
load 1149542-1.svg
load 1156581-1.svg
load 1182496-1.html
load 1209525-1.svg
load 1223281-1.svg

10
layout/svg/nsSVGEffects.cpp
View File

@ -770,14 +770,15 @@ nsSVGEffects::InvalidateRenderingObservers(nsIFrame *aFrame)
{
NS_ASSERTION(!aFrame->GetPrevContinuation(), "aFrame must be first continuation");
if (!aFrame->GetContent()->IsElement())
nsIContent* content = aFrame->GetContent();
if (!content || !content->IsElement())
return;
// If the rendering has changed, the bounds may well have changed too:
aFrame->Properties().Delete(nsSVGUtils::ObjectBoundingBoxProperty());
nsSVGRenderingObserverList *observerList =
GetObserverList(aFrame->GetContent()->AsElement());
GetObserverList(content->AsElement());
if (observerList) {
observerList->InvalidateAll();
return;
@ -821,7 +822,8 @@ nsSVGEffects::InvalidateDirectRenderingObservers(Element *aElement, uint32_t aFl
void
nsSVGEffects::InvalidateDirectRenderingObservers(nsIFrame *aFrame, uint32_t aFlags /* = 0 */)
{
if (aFrame->GetContent() && aFrame->GetContent()->IsElement()) {
InvalidateDirectRenderingObservers(aFrame->GetContent()->AsElement(), aFlags);
nsIContent* content = aFrame->GetContent();
if (content && content->IsElement()) {
InvalidateDirectRenderingObservers(content->AsElement(), aFlags);
}
}