Bug 1474982 - Fix asertion failure when lengthAdjust value is empty r=heycam
authorRobert Longson <longsonr@gmail.com>
Sun, 23 Sep 2018 15:53:03 +0100
changeset 493566 42f0da322d14090133d4428764dd38125ec5016c
parent 493565 b106fa22e262c94ba29708ada8ad03347f4cc1a4
child 493567 e0409191447598c31c52a4d4296a897413693dbb
push id9984
push userffxbld-merge
push dateMon, 15 Oct 2018 21:07:35 +0000
treeherdermozilla-beta@183d27ea8570 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersheycam
bugs1474982
milestone64.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1474982 - Fix asertion failure when lengthAdjust value is empty r=heycam
layout/svg/SVGTextFrame.cpp
layout/svg/crashtests/1474982.html
layout/svg/crashtests/crashtests.list
--- a/layout/svg/SVGTextFrame.cpp
+++ b/layout/svg/SVGTextFrame.cpp
@@ -5219,21 +5219,24 @@ SVGTextFrame::DoGlyphPositioning()
     return;
   }
 
   // If the textLength="" attribute was specified, then we need ResolvePositions
   // to record that a new run starts with each glyph.
   SVGTextContentElement* element = static_cast<SVGTextContentElement*>(GetContent());
   nsSVGLength2* textLengthAttr =
     element->GetAnimatedLength(nsGkAtoms::textLength);
+  uint16_t lengthAdjust =
+    element->EnumAttributes()[SVGTextContentElement::LENGTHADJUST].GetAnimValue();
   bool adjustingTextLength = textLengthAttr->IsExplicitlySet();
   float expectedTextLength = textLengthAttr->GetAnimValue(element);
 
-  if (adjustingTextLength && expectedTextLength < 0.0f) {
-    // If textLength="" is less than zero, ignore it.
+  if (adjustingTextLength &&
+      (expectedTextLength < 0.0f || lengthAdjust == LENGTHADJUST_UNKNOWN)) {
+    // If textLength="" is less than zero or lengthAdjust is unknown, ignore it.
     adjustingTextLength = false;
   }
 
   // Get the x, y, dx, dy, rotate values for the subtree.
   nsTArray<gfxPoint> deltas;
   if (!ResolvePositions(deltas, adjustingTextLength)) {
     // If ResolvePositions returned false, it means either there were some
     // characters in the DOM but none of them are displayed, or there was
@@ -5272,18 +5275,16 @@ SVGTextFrame::DoGlyphPositioning()
   double adjustment = 0.0;
   mLengthAdjustScaleFactor = 1.0f;
   if (adjustingTextLength) {
     nscoord frameLength = vertical ? PrincipalChildList().FirstChild()->GetRect().height
                                    : PrincipalChildList().FirstChild()->GetRect().width;
     float actualTextLength =
       static_cast<float>(presContext->AppUnitsToGfxUnits(frameLength) * factor);
 
-    uint16_t lengthAdjust =
-      element->EnumAttributes()[SVGTextContentElement::LENGTHADJUST].GetAnimValue();
     switch (lengthAdjust) {
       case LENGTHADJUST_SPACINGANDGLYPHS:
         // Scale the glyphs and their positions.
         if (actualTextLength > 0) {
           mLengthAdjustScaleFactor = expectedTextLength / actualTextLength;
         }
         break;
 
new file mode 100644
--- /dev/null
+++ b/layout/svg/crashtests/1474982.html
@@ -0,0 +1,2 @@
+<svg>
+<text lengthAdjust="" textLength="0">A</text>
--- a/layout/svg/crashtests/crashtests.list
+++ b/layout/svg/crashtests/crashtests.list
@@ -204,15 +204,16 @@ load 1348564.svg
 load 1402109.html
 load 1402124.html
 load 1402486.html
 load 1421807-1.html
 pref(dom.webcomponents.shadowdom.enabled,true) load 1421807-2.html
 load 1422226.html
 load 1443092.html
 load 1467552-1.html
+load 1474982.html
 load conditional-outer-svg-nondirty-reflow-assert.xhtml
 load extref-test-1.xhtml
 load blob-merging-and-retained-display-list.html
 load empty-blob-merging.html
 load grouping-empty-bounds.html
 load 1480275.html
 load 1480224.html