Bug 474700. Avoid negative-sized filter areas. r+sr=roc
authorRobert Longson <longsonr@gmail.com>
Fri, 30 Jan 2009 20:22:29 +1300
changeset 24448 5305114469ab177492cfba57d5950ef07be88004
parent 24447 e001ff8871ec566c01429f88cd0de9a22467e74b
child 24449 3a6adf4cc1c8e15655612f437a461c757049c938
push id5048
push userrocallahan@mozilla.com
push dateFri, 30 Jan 2009 08:38:37 +0000
treeherdermozilla-central@fed00e0efe5c [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
bugs474700
milestone1.9.2a1pre
Bug 474700. Avoid negative-sized filter areas. r+sr=roc
layout/svg/base/src/nsSVGFilterFrame.cpp
layout/svg/crashtests/474700-1.svg
layout/svg/crashtests/crashtests.list
--- a/layout/svg/base/src/nsSVGFilterFrame.cpp
+++ b/layout/svg/base/src/nsSVGFilterFrame.cpp
@@ -128,16 +128,20 @@ nsAutoFilterInstance::nsAutoFilterInstan
   if (!bbox && (units == nsIDOMSVGUnitTypes::SVG_UNIT_TYPE_OBJECTBOUNDINGBOX ||
                 primitiveUnits == nsIDOMSVGUnitTypes::SVG_UNIT_TYPE_OBJECTBOUNDINGBOX))
     return;
 
   gfxRect filterArea = nsSVGUtils::GetRelativeRect(units,
     &filter->mLengthAttributes[nsSVGFilterElement::X], bbox, aTarget);
   filterArea.RoundOut();
 
+  // 0 disables rendering, < 0 is error
+  if (filterArea.Width() <= 0 || filterArea.Height() <= 0)
+    return;
+
   PRBool resultOverflows;
   gfxIntSize filterRes;
 
   // Compute size of filter buffer
   if (filter->HasAttr(kNameSpaceID_None, nsGkAtoms::filterRes)) {
     PRInt32 filterResX, filterResY;
     filter->GetAnimatedIntegerValues(&filterResX, &filterResY, nsnull);
 
new file mode 100644
--- /dev/null
+++ b/layout/svg/crashtests/474700-1.svg
@@ -0,0 +1,1 @@
+<svg xmlns="http://www.w3.org/2000/svg"><filter id="f1" filterRes="10 20" height="-2"/><rect width="50" height="100" filter="url(#f1)"/></svg>
--- a/layout/svg/crashtests/crashtests.list
+++ b/layout/svg/crashtests/crashtests.list
@@ -55,11 +55,12 @@ load 409573-1.svg
 load 429774-1.svg
 load 441368-1.svg
 load 453754-1.svg
 load 455314-1.xhtml
 load 458453.html
 load 464374-1.svg
 load 466585-1.svg
 load 470124-1.svg
+load 474700-1.svg
 load 475181-1.svg
 load 475193-1.html
 load extref-test-1.xhtml