diff --git a/layout/svg/base/src/nsSVGFilterFrame.cpp b/layout/svg/base/src/nsSVGFilterFrame.cpp index 9b301f1d193..e11d2c6dc15 100644 --- a/layout/svg/base/src/nsSVGFilterFrame.cpp +++ b/layout/svg/base/src/nsSVGFilterFrame.cpp @@ -133,6 +133,10 @@ nsAutoFilterInstance::nsAutoFilterInstance(nsIFrame *aTarget, &filter->mLengthAttributes[nsSVGFilterElement::X], bbox, aTarget); filterArea.RoundOut(); + // 0 disables rendering, < 0 is error + if (filterArea.Width() <= 0 || filterArea.Height() <= 0) + return; + PRBool resultOverflows; gfxIntSize filterRes; diff --git a/layout/svg/crashtests/474700-1.svg b/layout/svg/crashtests/474700-1.svg new file mode 100644 index 00000000000..7841103533a --- /dev/null +++ b/layout/svg/crashtests/474700-1.svg @@ -0,0 +1 @@ + diff --git a/layout/svg/crashtests/crashtests.list b/layout/svg/crashtests/crashtests.list index ea70bd54b5e..7c3df1b8de9 100644 --- a/layout/svg/crashtests/crashtests.list +++ b/layout/svg/crashtests/crashtests.list @@ -60,6 +60,7 @@ load 458453.html load 464374-1.svg load 466585-1.svg load 470124-1.svg +load 474700-1.svg load 475181-1.svg load 475193-1.html load extref-test-1.xhtml