wine/gecko
0
0
Fork 0
mirror of https://gitlab.winehq.org/wine/wine-gecko.git synced 2024-09-13 09:24:08 -07:00
Code Issues Packages Projects Releases Wiki Activity

Bug 841812 - Avoid crashing when changing attributes on an invalidly parented <textPath>. r=roc

Browse Source
This commit is contained in:
Cameron McCormack 2013-02-16 20:16:11 +11:00
parent 8765553d79
commit a5d156f4b3
3 changed files with 16 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
layout/svg/crashtests/841812-1.svg Normal file
View File

@ -0,0 +1,11 @@
<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
<text>
<circle>
<textPath id="t" xlink:href="data:text/html,1" />
</circle>
</text>
<script>
window.addEventListener("load", function() { document.getElementById("t").removeAttribute('xlink:href'); }, false);
</script>
</svg>
Side by Side

After

Width:  |  Height:  |  Size: 363 B

1
layout/svg/crashtests/crashtests.list
View File

@ -152,3 +152,4 @@ load 789390-1.html
load 808318-1.svg load 808318-1.svg
load 813420-1.svg load 813420-1.svg
load 841163-1.svg load 841163-1.svg
load 841812-1.svg

6
layout/svg/nsSVGTextFrame2.cpp
View File

@ -2956,8 +2956,10 @@ nsSVGTextFrame2::MutationObserver::AttributeChanged(
aAttribute == nsGkAtoms::href) { aAttribute == nsGkAtoms::href) {
// Blow away our reference, if any // Blow away our reference, if any
nsIFrame* childElementFrame = aElement->GetPrimaryFrame(); nsIFrame* childElementFrame = aElement->GetPrimaryFrame();
childElementFrame->Properties().Delete(nsSVGEffects::HrefProperty()); if (childElementFrame) {
mFrame->NotifyGlyphMetricsChange(); childElementFrame->Properties().Delete(nsSVGEffects::HrefProperty());
mFrame->NotifyGlyphMetricsChange();
}
} }
} else { } else {
if (aNameSpaceID == kNameSpaceID_None && if (aNameSpaceID == kNameSpaceID_None &&