Bug 713413 - Fix crash when dynamically adding foreignObject as a child of non-displayed element. r=dholbert
authorRobert Longson <longsonr@gmail.com>
Thu, 29 Dec 2011 11:59:02 +0000
changeset 84733 29b864db2073f2d252439b1549a17e91fbbe3909
parent 84732 c443d73c4346d7d873f2774f37d67aadf8543bed
child 84734 52384048e349c8973fa9a528c6e599369e80a00e
push id805
push userakeybl@mozilla.com
push dateWed, 01 Feb 2012 18:17:35 +0000
treeherdermozilla-aurora@6fb3bf232436 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersdholbert
bugs713413
milestone12.0a1
Bug 713413 - Fix crash when dynamically adding foreignObject as a child of non-displayed element. r=dholbert
layout/svg/base/src/nsSVGForeignObjectFrame.cpp
layout/svg/crashtests/713413-1.svg
layout/svg/crashtests/crashtests.list
--- a/layout/svg/base/src/nsSVGForeignObjectFrame.cpp
+++ b/layout/svg/base/src/nsSVGForeignObjectFrame.cpp
@@ -135,17 +135,22 @@ nsSVGForeignObjectFrame::AttributeChange
   return NS_OK;
 }
 
 /* virtual */ void
 nsSVGForeignObjectFrame::DidSetStyleContext(nsStyleContext* aOldStyleContext)
 {
   nsSVGForeignObjectFrameBase::DidSetStyleContext(aOldStyleContext);
 
-  UpdateGraphic();
+  // No need to invalidate before first reflow - that will happen elsewhere.
+  // Moreover we haven't been initialised properly yet so we may not have the
+  // right state bits.
+  if (!(GetStateBits() & NS_FRAME_FIRST_REFLOW)) {
+    UpdateGraphic();
+  }
 }
 
 NS_IMETHODIMP
 nsSVGForeignObjectFrame::Reflow(nsPresContext*           aPresContext,
                                 nsHTMLReflowMetrics&     aDesiredSize,
                                 const nsHTMLReflowState& aReflowState,
                                 nsReflowStatus&          aStatus)
 {
new file mode 100644
--- /dev/null
+++ b/layout/svg/crashtests/713413-1.svg
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<svg xmlns="http://www.w3.org/2000/svg">
+
+<marker id="m"></marker>
+
+<script>
+window.addEventListener("load", function() {
+  document.getElementById("m").appendChild(document.createElementNS("http://www.w3.org/2000/svg", "foreignObject"));
+}, false);
+</script>
+
+</svg>
--- a/layout/svg/crashtests/crashtests.list
+++ b/layout/svg/crashtests/crashtests.list
@@ -116,8 +116,9 @@ load 657077-1.svg
 load 669025-1.svg
 load 669025-2.svg
 load 682411-1.svg
 load 692203-1.svg
 load 692203-2.svg
 load 693424-1.svg
 load 709920-1.svg
 load 709920-2.svg
+load 713413-1.svg