Bug 732836 - stop asserts when width or height attributes are removed from a use element. r=dholbert
authorRobert Longson <longsonr@gmail.com>
Wed, 07 Mar 2012 10:50:36 +0000
changeset 88436 e984475c1fdbd3c5e472f70c31b6530f71d9ff2a
parent 88425 8ef88a69f8619b20032b0806b6e94b79a4bfcf18
child 88437 73479a0b9f3c7f56084de85eb69f5c62c51722bc
push id22199
push userbmo@edmorley.co.uk
push dateThu, 08 Mar 2012 13:15:53 +0000
treeherdermozilla-central@09a8a48476e5 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersdholbert
bugs732836
milestone13.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 732836 - stop asserts when width or height attributes are removed from a use element. r=dholbert
content/svg/content/src/nsSVGUseElement.cpp
layout/svg/base/src/nsSVGUtils.cpp
layout/svg/crashtests/732836-1.svg
layout/svg/crashtests/crashtests.list
--- a/content/svg/content/src/nsSVGUseElement.cpp
+++ b/content/svg/content/src/nsSVGUseElement.cpp
@@ -423,19 +423,17 @@ nsSVGUseElement::SyncWidthOrHeight(nsIAt
     if (mLengthAttributes[index].IsExplicitlySet()) {
       target->SetLength(aName, mLengthAttributes[index]);
       return;
     }
     if (svg) {
       // Our width/height attribute is now no longer explicitly set, so we
       // need to revert the clone's width/height to the width/height of the
       // content that's being cloned.
-      nsSVGSVGElement* svgElement =
-        static_cast<nsSVGSVGElement*>(mSource.get());
-      svgElement->SyncWidthOrHeight(aName, target);
+      TriggerReclone();
       return;
     }
     // Our width/height attribute is now no longer explicitly set, so we
     // need to set the value to 100%
     nsSVGLength2 length;
     length.Init(nsSVGUtils::XY, 0xff,
                 100, nsIDOMSVGLength::SVG_LENGTHTYPE_PERCENTAGE);
     target->SetLength(aName, length);
--- a/layout/svg/base/src/nsSVGUtils.cpp
+++ b/layout/svg/base/src/nsSVGUtils.cpp
@@ -1210,16 +1210,21 @@ nsSVGUtils::HitTestChildren(nsIFrame *aF
   // Traverse the list in reverse order, so that if we get a hit we know that's
   // the topmost frame that intersects the point; then we can just return it.
   nsIFrame* result = nsnull;
   for (nsIFrame* current = aFrame->PrincipalChildList().LastChild();
        current;
        current = current->GetPrevSibling()) {
     nsISVGChildFrame* SVGFrame = do_QueryFrame(current);
     if (SVGFrame) {
+      const nsIContent* content = current->GetContent();
+      if (content->IsSVG() &&
+          !static_cast<const nsSVGElement*>(content)->HasValidDimensions()) {
+        continue;
+      }
       result = SVGFrame->GetFrameForPoint(aPoint);
       if (result)
         break;
     }
   }
 
   if (result && !HitTestClip(aFrame, aPoint))
     result = nsnull;
new file mode 100644
--- /dev/null
+++ b/layout/svg/crashtests/732836-1.svg
@@ -0,0 +1,17 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" >
+
+  <symbol id="z">
+    <use xlink:href="data:image/svg+xml,&lt;svg xmlns='http://www.w3.org/2000/svg' id='root' /&gt;#root" />
+  </symbol>
+
+  <use id="a" xlink:href="#z" width="20"/>
+
+  <script>
+  window.addEventListener("load", function() {
+    window.scrollByPages(0);
+    document.getElementById("a").removeAttribute("width");
+    document.elementFromPoint(0, 0);
+  }, false);
+  </script>
+
+</svg>
--- a/layout/svg/crashtests/crashtests.list
+++ b/layout/svg/crashtests/crashtests.list
@@ -119,8 +119,9 @@ load 682411-1.svg
 load 692203-1.svg
 load 692203-2.svg
 load 693424-1.svg
 load 709920-1.svg
 load 709920-2.svg
 load 713413-1.svg
 load 722003-1.svg
 load 725918-1.svg
+load 732836-1.svg