Bug 1402798 - Part 1. Check the type of an SVGPaint object from the correct frame. r=longsonr+218550
authorcku <cku@mozilla.com>
Tue, 26 Sep 2017 14:43:14 +0800
changeset 670373 19efc28f755bfe47e62ce10d4c4753a376bba6f8
parent 670372 40ffba3a6034e0cc9a1a8e4fc9e739adb07f9e04
child 670374 2a16ec0d0828043aed627f480ef3c316390e83b2
child 670536 589f692ad2d6793de78e4a0dad666683014ae498
push id81612
push userbmo:dharvey@mozilla.com
push dateTue, 26 Sep 2017 10:16:26 +0000
reviewerslongsonr
bugs1402798, 218550
milestone58.0a1
Bug 1402798 - Part 1. Check the type of an SVGPaint object from the correct frame. r=longsonr+218550 mTargetFrame is not a correct one, we should check the SVGStyle of 'frame' object. MozReview-Commit-ID: 3UNfbXkICkz
layout/svg/SVGObserverUtils.cpp
--- a/layout/svg/SVGObserverUtils.cpp
+++ b/layout/svg/SVGObserverUtils.cpp
@@ -626,33 +626,33 @@ SVGObserverUtils::GetEffectProperties(ns
   return result;
 }
 
 nsSVGPaintServerFrame *
 SVGObserverUtils::GetPaintServer(nsIFrame* aTargetFrame,
                                  nsStyleSVGPaint nsStyleSVG::* aPaint,
                                  PaintingPropertyDescriptor aType)
 {
-  const nsStyleSVG* svgStyle = aTargetFrame->StyleSVG();
-  if ((svgStyle->*aPaint).Type() != eStyleSVGPaintType_Server)
-    return nullptr;
-
   // If we're looking at a frame within SVG text, then we need to look up
   // to find the right frame to get the painting property off.  We should at
   // least look up past a text frame, and if the text frame's parent is the
   // anonymous block frame, then we look up to its parent (the SVGTextFrame).
   nsIFrame* frame = aTargetFrame;
   if (frame->GetContent()->IsNodeOfType(nsINode::eTEXT)) {
     frame = frame->GetParent();
     nsIFrame* grandparent = frame->GetParent();
     if (grandparent && grandparent->IsSVGTextFrame()) {
       frame = grandparent;
     }
   }
 
+  const nsStyleSVG* svgStyle = frame->StyleSVG();
+  if ((svgStyle->*aPaint).Type() != eStyleSVGPaintType_Server)
+    return nullptr;
+
   nsCOMPtr<nsIURI> paintServerURL =
     SVGObserverUtils::GetPaintURI(frame, aPaint);
   nsSVGPaintingProperty *property =
     SVGObserverUtils::GetPaintingProperty(paintServerURL, frame, aType);
   if (!property)
     return nullptr;
   nsIFrame* result = property->GetReferencedFrame();
   if (!result)