Bug 974746 - Fix rotated zero width or height pattern crash. r=jwatt
authorRobert Longson <longsonr@gmail.com>
Thu, 20 Feb 2014 20:49:14 +0000
changeset 169745 723bd507c9ee50f5ad138cd33fa16c19e86ba0ae
parent 169744 485ec336ffff35e8481d5d93cc55095b8049c0d2
child 169746 ffd9d3ae66fe011bdb80aebe6db01b31ed8aef23
push id40046
push userlongsonr@gmail.com
push dateThu, 20 Feb 2014 20:49:30 +0000
treeherdermozilla-inbound@723bd507c9ee [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersjwatt
bugs974746
milestone30.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 974746 - Fix rotated zero width or height pattern crash. r=jwatt
layout/svg/crashtests/974746-1.svg
layout/svg/crashtests/crashtests.list
layout/svg/nsSVGPatternFrame.cpp
new file mode 100644
--- /dev/null
+++ b/layout/svg/crashtests/974746-1.svg
@@ -0,0 +1,9 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+
+    <pattern id="patternRotated" width="1" patternTransform="rotate(45 50 50)">
+        <rect/>
+    </pattern>
+
+    <rect width="100" height="100" fill="url(#patternRotated)"/>
+
+</svg>
--- a/layout/svg/crashtests/crashtests.list
+++ b/layout/svg/crashtests/crashtests.list
@@ -173,8 +173,9 @@ load 890782-1.svg
 load 890783-1.svg
 load 893510-1.svg
 load 895311-1.svg
 load 897342-1.svg
 load 898909-1.svg
 load 898951-1.svg
 load 919371-1.xhtml
 load 952270-1.svg
+load 974746-1.svg
--- a/layout/svg/nsSVGPatternFrame.cpp
+++ b/layout/svg/nsSVGPatternFrame.cpp
@@ -310,16 +310,19 @@ nsSVGPatternFrame::PaintPattern(gfxASurf
   } else {
     patternFrame->mCTM = new gfxMatrix(ctm);
   }
 
   // Get the bounding box of the pattern.  This will be used to determine
   // the size of the surface, and will also be used to define the bounding
   // box for the pattern tile.
   gfxRect bbox = GetPatternRect(patternUnits, callerBBox, ToMatrix(aContextMatrix), aSource);
+  if (bbox.Width() <= 0.0 || bbox.Height() <= 0.0) {
+    return NS_ERROR_FAILURE;
+  }
 
   // Get the pattern transform
   gfxMatrix patternTransform = GetPatternTransform();
 
   // revert the vector effect transform so that the pattern appears unchanged
   if (aFillOrStroke == &nsStyleSVG::mStroke) {
     patternTransform.Multiply(nsSVGUtils::GetStrokeTransform(aSource).Invert());
   }