Bug 1402798 - Part 1. Check the type of an SVGPaint object from the correct frame. r=longsonr+218550
mTargetFrame is not a correct one, we should check the SVGStyle of 'frame'
object.
MozReview-Commit-ID: 3UNfbXkICkz
--- a/layout/svg/SVGObserverUtils.cpp
+++ b/layout/svg/SVGObserverUtils.cpp
@@ -626,33 +626,33 @@ SVGObserverUtils::GetEffectProperties(ns
return result;
}
nsSVGPaintServerFrame *
SVGObserverUtils::GetPaintServer(nsIFrame* aTargetFrame,
nsStyleSVGPaint nsStyleSVG::* aPaint,
PaintingPropertyDescriptor aType)
{
- const nsStyleSVG* svgStyle = aTargetFrame->StyleSVG();
- if ((svgStyle->*aPaint).Type() != eStyleSVGPaintType_Server)
- return nullptr;
-
// If we're looking at a frame within SVG text, then we need to look up
// to find the right frame to get the painting property off. We should at
// least look up past a text frame, and if the text frame's parent is the
// anonymous block frame, then we look up to its parent (the SVGTextFrame).
nsIFrame* frame = aTargetFrame;
if (frame->GetContent()->IsNodeOfType(nsINode::eTEXT)) {
frame = frame->GetParent();
nsIFrame* grandparent = frame->GetParent();
if (grandparent && grandparent->IsSVGTextFrame()) {
frame = grandparent;
}
}
+ const nsStyleSVG* svgStyle = frame->StyleSVG();
+ if ((svgStyle->*aPaint).Type() != eStyleSVGPaintType_Server)
+ return nullptr;
+
nsCOMPtr<nsIURI> paintServerURL =
SVGObserverUtils::GetPaintURI(frame, aPaint);
nsSVGPaintingProperty *property =
SVGObserverUtils::GetPaintingProperty(paintServerURL, frame, aType);
if (!property)
return nullptr;
nsIFrame* result = property->GetReferencedFrame();
if (!result)