Bug 591141. Protect against null pattern. r=roc
authorMarkus Stange <mstange@themasta.com>
Mon, 06 Sep 2010 15:12:46 +1200
changeset 52058 597d35c578c34ef110d129fef1e7678852a5042b
parent 52057 1f08cbe27e324ceb6b329523011d6c8e15b66f39
child 52059 d4e3befbd494043852e11f13c3584b5b4d352edc
push idunknown
push userunknown
push dateunknown
reviewersroc
bugs591141
milestone2.0b6pre
Bug 591141. Protect against null pattern. r=roc
layout/generic/crashtests/591141.html
layout/generic/crashtests/crashtests.list
layout/svg/base/src/nsSVGIntegrationUtils.cpp
new file mode 100644
--- /dev/null
+++ b/layout/generic/crashtests/591141.html
@@ -0,0 +1,7 @@
+<!DOCTYPE html>
+<html>
+<body>
+<svg><pattern id="p"/></svg>
+<div style="width: 100px; height: 100px; background: -moz-element(#p);"></div>
+</body>
+</html>
--- a/layout/generic/crashtests/crashtests.list
+++ b/layout/generic/crashtests/crashtests.list
@@ -328,8 +328,9 @@ load 564968.xhtml
 load 570160.html
 load 571618-1.svg
 load 574958.xhtml
 load 585598-1.xhtml
 load 586806-1.html
 load 586806-2.html
 load 586806-3.html
 load 586973-1.html
+load 591141.html
--- a/layout/svg/base/src/nsSVGIntegrationUtils.cpp
+++ b/layout/svg/base/src/nsSVGIntegrationUtils.cpp
@@ -499,16 +499,19 @@ DrawableFromPaintServer(nsIFrame*       
       static_cast<nsSVGPaintServerFrame*>(aFrame);
 
     gfxRect overrideBounds(0, 0,
                            aPaintServerSize.width, aPaintServerSize.height);
     overrideBounds.ScaleInverse(aFrame->PresContext()->AppUnitsPerDevPixel());
     nsRefPtr<gfxPattern> pattern =
       server->GetPaintServerPattern(aTarget, 1.0, &overrideBounds);
 
+    if (!pattern)
+      return nsnull;
+
     // pattern is now set up to fill aPaintServerSize. But we want it to
     // fill aRenderSize, so we need to add a scaling transform.
     // We couldn't just have set overrideBounds to aRenderSize - it would have
     // worked for gradients, but for patterns it would result in a different
     // pattern size.
     gfxFloat scaleX = overrideBounds.Width() / aRenderSize.width;
     gfxFloat scaleY = overrideBounds.Height() / aRenderSize.height;
     gfxMatrix scaleMatrix = gfxMatrix().Scale(scaleX, scaleY);
@@ -542,11 +545,13 @@ nsSVGIntegrationUtils::DrawPaintServer(n
 
   PRInt32 appUnitsPerDevPixel = aTarget->PresContext()->AppUnitsPerDevPixel();
   nsRect destSize = aDest - aDest.TopLeft();
   nsIntSize roundedOut = destSize.ToOutsidePixels(appUnitsPerDevPixel).Size();
   gfxIntSize imageSize(roundedOut.width, roundedOut.height);
   nsRefPtr<gfxDrawable> drawable =
     DrawableFromPaintServer(aPaintServer, aTarget, aPaintServerSize, imageSize);
 
-  nsLayoutUtils::DrawPixelSnapped(aRenderingContext, drawable, aFilter,
-                                  aDest, aFill, aAnchor, aDirty);
+  if (drawable) {
+    nsLayoutUtils::DrawPixelSnapped(aRenderingContext, drawable, aFilter,
+                                    aDest, aFill, aAnchor, aDirty);
+  }
 }