wine/gecko
0
0
Fork 0
mirror of https://gitlab.winehq.org/wine/wine-gecko.git synced 2024-09-13 09:24:08 -07:00
Code Issues Packages Projects Releases Wiki Activity

Bug 595608: Check for non-atom value for "type" attribute in nsSVGTransformSMILAttr::ValueFromString. r=dholbert a=blocking-final+

Browse Source
This commit is contained in:
Robert Longson 2010-10-07 12:19:33 -07:00
parent 5f29256b79
commit a9e1988758
3 changed files with 11 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
content/svg/content/src/crashtests/595608-1.svg Normal file
View File

@ -0,0 +1 @@
<svg xmlns="http://www.w3.org/2000/svg"><rect><set to="k" type="s" attributeName="transform"/></rect></svg>
Side by Side

After

Width:  |  Height:  |  Size: 108 B

1
content/svg/content/src/crashtests/crashtests.list
View File

@ -50,3 +50,4 @@ load 539167-1.svg
load 573316-1.svg
load 579356-1.svg
load 579356-2.svg
load 595608-1.svg

12
content/svg/content/src/nsSVGTransformSMILAttr.cpp
View File

@ -62,9 +62,15 @@ nsSVGTransformSMILAttr::ValueFromString(const nsAString& aStr,
"aValue should have been cleared before calling ValueFromString");
const nsAttrValue* typeAttr = aSrcElement->GetAnimAttr(nsGkAtoms::type);
const nsIAtom* transformType = typeAttr
? typeAttr->GetAtomValue()
: nsGkAtoms::translate;
const nsIAtom* transformType = nsGkAtoms::translate;
if (typeAttr) {
if (typeAttr->Type() != nsAttrValue::eAtom) {
// Recognized values of |type| are parsed as an atom -- so if we have
// something other than an atom, then it means our |type| was invalid.
return NS_ERROR_FAILURE;
}
transformType = typeAttr->GetAtomValue();
}
ParseValue(aStr, transformType, aValue);
aPreventCachingOfSandwich = PR_FALSE;