Bug 1267272 - NULL pointer mozilla::dom::SVGSVGElement::GetIntrinsicHeight. r=seth
authorRobert Longson <longsonr@gmail.com>
Sun, 08 May 2016 11:17:46 +0100
changeset 364761 01b755909dc18b700bd88eb616862e4872a6daf9
parent 364760 70bfcf9f09d5970324d6c7f4ed4330a56a826e53
child 364762 80b7ac3b97b80ec928f7e522ae3879a8b1c32dab
push id17559
push userbmo:gasolin@mozilla.com
push dateMon, 09 May 2016 08:55:35 +0000
reviewersseth
bugs1267272
milestone49.0a1
Bug 1267272 - NULL pointer mozilla::dom::SVGSVGElement::GetIntrinsicHeight. r=seth
dom/svg/crashtests/1267272-1.svg
dom/svg/crashtests/crashtests.list
dom/svg/crashtests/invalid-image.svg
image/VectorImage.cpp
new file mode 100644
--- /dev/null
+++ b/dom/svg/crashtests/1267272-1.svg
@@ -0,0 +1,7 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
+  <filter id="f">
+  	<feImage xlink:href="invalid-image.svg"/>
+  </filter>
+  <rect filter='url(#f)' width="1" height="1"/>
+</svg>
--- a/dom/svg/crashtests/crashtests.list
+++ b/dom/svg/crashtests/crashtests.list
@@ -70,11 +70,12 @@ load 880544-1.svg
 load 880544-2.svg
 load 880544-3.svg
 load 880544-4.svg
 load 880544-5.svg
 load 898915-1.svg
 load 1035248-1.svg
 load 1035248-2.svg
 load 1244898-1.xhtml
+load 1267272-1.svg
 # Disabled for now due to it taking a very long time to run - bug 1259356
 #load long-clipPath-reference-chain.svg
 load zero-size-image.svg
new file mode 100644
--- /dev/null
+++ b/dom/svg/crashtests/invalid-image.svg
@@ -0,0 +1,1 @@
+X
--- a/image/VectorImage.cpp
+++ b/image/VectorImage.cpp
@@ -681,16 +681,20 @@ VectorImage::IsOpaque()
 {
   return false; // In general, SVG content is not opaque.
 }
 
 //******************************************************************************
 NS_IMETHODIMP_(already_AddRefed<SourceSurface>)
 VectorImage::GetFrame(uint32_t aWhichFrame, uint32_t aFlags)
 {
+  if (mError) {
+    return nullptr;
+  }
+
   // Look up height & width
   // ----------------------
   SVGSVGElement* svgElem = mSVGDocumentWrapper->GetRootSVGElem();
   MOZ_ASSERT(svgElem, "Should have a root SVG elem, since we finished "
                       "loading without errors");
   nsIntSize imageIntSize(svgElem->GetIntrinsicWidth(),
                          svgElem->GetIntrinsicHeight());