Bug 732836 - stop asserts when width or height attributes are removed from a use element. r=dholbert

content/svg/content/src/nsSVGUseElement.cpp

@@ -428,9 +428,7 @@ nsSVGUseElement::SyncWidthOrHeight(nsIAtom* aName)
       // Our width/height attribute is now no longer explicitly set, so we
       // need to revert the clone's width/height to the width/height of the
       // content that's being cloned.
-      nsSVGSVGElement* svgElement =
-        static_cast<nsSVGSVGElement*>(mSource.get());
-      svgElement->SyncWidthOrHeight(aName, target);
+      TriggerReclone();
       return;
     }
     // Our width/height attribute is now no longer explicitly set, so we

layout/svg/base/src/nsSVGUtils.cpp

@@ -1215,6 +1215,11 @@ nsSVGUtils::HitTestChildren(nsIFrame *aFrame, const nsPoint &aPoint)
        current = current->GetPrevSibling()) {
     nsISVGChildFrame* SVGFrame = do_QueryFrame(current);
     if (SVGFrame) {
+      const nsIContent* content = current->GetContent();
+      if (content->IsSVG() &&
+          !static_cast<const nsSVGElement*>(content)->HasValidDimensions()) {
+        continue;
+      }
       result = SVGFrame->GetFrameForPoint(aPoint);
       if (result)
         break;

layout/svg/crashtests/732836-1.svg

@@ -0,0 +1,17 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" >
+
+  <symbol id="z">
+    <use xlink:href="data:image/svg+xml,&lt;svg xmlns='http://www.w3.org/2000/svg' id='root' /&gt;#root" />
+  </symbol>
+
+  <use id="a" xlink:href="#z" width="20"/>
+
+  <script>
+  window.addEventListener("load", function() {
+    window.scrollByPages(0);
+    document.getElementById("a").removeAttribute("width");
+    document.elementFromPoint(0, 0);
+  }, false);
+  </script>
+
+</svg>

layout/svg/crashtests/crashtests.list

@@ -124,3 +124,4 @@ load 709920-2.svg
 load 713413-1.svg
 load 722003-1.svg
 load 725918-1.svg
+load 732836-1.svg