Bug 566216. Our parent could be a document fragment. r=dholbert
authorBoris Zbarsky <bzbarsky@mit.edu>
Mon, 17 May 2010 14:18:25 -0400
changeset 42385 d10c3fba495b05373d116689085004b66e56adae
parent 42384 cf5dcc522934ef6e484838fa0c76bbd5b0bba154
child 42386 90d627f2471eb38d96d8b1ccef04465c8363da53
push id13310
push userbzbarsky@mozilla.com
push dateMon, 17 May 2010 18:20:00 +0000
treeherdermozilla-central@90d627f2471e [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersdholbert
bugs566216
milestone1.9.3a5pre
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
Bug 566216. Our parent could be a document fragment. r=dholbert
layout/svg/base/src/nsSVGUtils.cpp
layout/svg/crashtests/566216-1.svg
layout/svg/crashtests/crashtests.list
--- a/layout/svg/base/src/nsSVGUtils.cpp
+++ b/layout/svg/base/src/nsSVGUtils.cpp
@@ -251,17 +251,17 @@ nsSVGUtils::GetParentElement(nsIContent 
     nsIContent *result = bindingManager->GetInsertionParent(aContent);
     if (result) {
       return result->AsElement();
     }
   }
 
   // otherewise use the explicit one, whether it's null or not...
   nsIContent* parent = aContent->GetParent();
-  return parent ? parent->AsElement() : nsnull;
+  return parent && parent->IsElement() ? parent->AsElement() : nsnull;
 }
 
 float
 nsSVGUtils::GetFontSize(Element *aElement)
 {
   if (!aElement)
     return 1.0f;
 
new file mode 100644
--- /dev/null
+++ b/layout/svg/crashtests/566216-1.svg
@@ -0,0 +1,19 @@
+<?xml version="1.0"?>
+
+<svg xmlns="http://www.w3.org/2000/svg"><animate id="y"/><script>
+<![CDATA[
+
+function boom()
+{
+  var r = document.createRange();
+  r.setEnd(document.getElementById('y'), 0);
+  r.extractContents();
+}
+
+window.addEventListener("load", boom, false);
+
+]]>
+</script>
+</svg>
+
+
--- a/layout/svg/crashtests/crashtests.list
+++ b/layout/svg/crashtests/crashtests.list
@@ -79,8 +79,9 @@ load 478128-1.svg
 load 492186-1.svg
 load 508247-1.svg
 load 512890-1.svg
 load 515288-1.html
 load 522394-1.svg
 load 522394-2.svg
 load 522394-3.svg
 load extref-test-1.xhtml
+load 566216-1.svg