diff --git a/layout/svg/crashtests/1156581-1.svg b/layout/svg/crashtests/1156581-1.svg new file mode 100644 index 00000000000..97e5fb1ca91 --- /dev/null +++ b/layout/svg/crashtests/1156581-1.svg @@ -0,0 +1,12 @@ + + + + + diff --git a/layout/svg/crashtests/crashtests.list b/layout/svg/crashtests/crashtests.list index 115315abbcb..ba3820dc1ea 100644 --- a/layout/svg/crashtests/crashtests.list +++ b/layout/svg/crashtests/crashtests.list @@ -192,6 +192,7 @@ load 1016145.svg load 1028512.svg load 1140080-1.svg load 1149542-1.svg +load 1156581-1.svg load 1182496-1.html load 1209525-1.svg load 1223281-1.svg diff --git a/layout/svg/nsSVGEffects.cpp b/layout/svg/nsSVGEffects.cpp index 1e9418d603a..5e29229b4f0 100644 --- a/layout/svg/nsSVGEffects.cpp +++ b/layout/svg/nsSVGEffects.cpp @@ -770,14 +770,15 @@ nsSVGEffects::InvalidateRenderingObservers(nsIFrame *aFrame) { NS_ASSERTION(!aFrame->GetPrevContinuation(), "aFrame must be first continuation"); - if (!aFrame->GetContent()->IsElement()) + nsIContent* content = aFrame->GetContent(); + if (!content || !content->IsElement()) return; // If the rendering has changed, the bounds may well have changed too: aFrame->Properties().Delete(nsSVGUtils::ObjectBoundingBoxProperty()); nsSVGRenderingObserverList *observerList = - GetObserverList(aFrame->GetContent()->AsElement()); + GetObserverList(content->AsElement()); if (observerList) { observerList->InvalidateAll(); return; @@ -821,7 +822,8 @@ nsSVGEffects::InvalidateDirectRenderingObservers(Element *aElement, uint32_t aFl void nsSVGEffects::InvalidateDirectRenderingObservers(nsIFrame *aFrame, uint32_t aFlags /* = 0 */) { - if (aFrame->GetContent() && aFrame->GetContent()->IsElement()) { - InvalidateDirectRenderingObservers(aFrame->GetContent()->AsElement(), aFlags); + nsIContent* content = aFrame->GetContent(); + if (content && content->IsElement()) { + InvalidateDirectRenderingObservers(content->AsElement(), aFlags); } }