Bug 1066270 - Don't crash when attempting to resolve a filter from an external resource document that hasn't undergone frame construction yet. r=roc
authorMarkus Stange <mstange@themasta.com>
Mon, 15 Sep 2014 12:12:52 +0200
changeset 205324 3bda71abf6481ebcbec0c95fccad4dc59d82d443
parent 205323 89bc7483714f35d74395df0b4c744fa367ddeae4
child 205325 f5ab7e76389e5b16b50c44acfb0a4d7521ce24bb
push id27489
push userkwierso@gmail.com
push dateMon, 15 Sep 2014 22:18:35 +0000
treeherdermozilla-central@02c3915bf742 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersroc
bugs1066270
milestone35.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1066270 - Don't crash when attempting to resolve a filter from an external resource document that hasn't undergone frame construction yet. r=roc
layout/svg/nsSVGFilterInstance.cpp
--- a/layout/svg/nsSVGFilterInstance.cpp
+++ b/layout/svg/nsSVGFilterInstance.cpp
@@ -139,18 +139,19 @@ nsSVGFilterInstance::GetFilterFrame()
   Element* element = filterElement.get();
   if (!element) {
     // The URL points to no element.
     return nullptr;
   }
 
   // Get the frame of the filter element.
   nsIFrame* frame = element->GetPrimaryFrame();
-  if (frame->GetType() != nsGkAtoms::svgFilterFrame) {
-    // The URL points to an element that's not an SVG filter element.
+  if (!frame || frame->GetType() != nsGkAtoms::svgFilterFrame) {
+    // The URL points to an element that's not an SVG filter element, or to an
+    // element that hasn't had its frame constructed yet.
     return nullptr;
   }
 
   return static_cast<nsSVGFilterFrame*>(frame);
 }
 
 float
 nsSVGFilterInstance::GetPrimitiveNumber(uint8_t aCtxType, float aValue) const