Bug 952270 - Null check result of GetPathForLengthOrPositionMeasuring in nsSVGTextFrame2::GetTextPath. r=longsonr, a=lsblakk
authorCameron McCormack <cam@mcc.id.au>
Fri, 20 Dec 2013 15:26:28 +1100
changeset 174559 4ecd4f2ba149231b3cb31e7d92b9da803a1cf2bd
parent 174558 d86ef4be9fc52ec97b73ea720ffb1982b20b350b
child 174560 97d982371403f6ff5ab74525193d016bffcf9e30
push id3224
push userlsblakk@mozilla.com
push dateTue, 04 Feb 2014 01:06:49 +0000
treeherdermozilla-beta@60c04d0987f1 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewerslongsonr, lsblakk
bugs952270
milestone28.0a2
Bug 952270 - Null check result of GetPathForLengthOrPositionMeasuring in nsSVGTextFrame2::GetTextPath. r=longsonr, a=lsblakk
layout/svg/crashtests/952270-1.svg
layout/svg/crashtests/crashtests.list
layout/svg/nsSVGTextFrame2.cpp
new file mode 100644
--- /dev/null
+++ b/layout/svg/crashtests/952270-1.svg
@@ -0,0 +1,9 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
+
+    <path id="path" transform="scale(2,1)" />
+
+    <text>
+        <textPath xlink:href="#path">F</textPath>
+    </text>
+
+</svg>
--- a/layout/svg/crashtests/crashtests.list
+++ b/layout/svg/crashtests/crashtests.list
@@ -172,8 +172,9 @@ load 885608-1.svg
 load 890782-1.svg
 load 890783-1.svg
 load 893510-1.svg
 load 895311-1.svg
 load 897342-1.svg
 load 898909-1.svg
 load 898951-1.svg
 load 919371-1.xhtml
+load 952270-1.svg
--- a/layout/svg/nsSVGTextFrame2.cpp
+++ b/layout/svg/nsSVGTextFrame2.cpp
@@ -4714,32 +4714,36 @@ nsSVGTextFrame2::GetTextPathPathFrame(ns
   return property->GetReferencedFrame(nsGkAtoms::svgPathGeometryFrame, nullptr);
 }
 
 TemporaryRef<Path>
 nsSVGTextFrame2::GetTextPath(nsIFrame* aTextPathFrame)
 {
   nsIFrame *pathFrame = GetTextPathPathFrame(aTextPathFrame);
 
-  if (pathFrame) {
-    nsSVGPathGeometryElement *element =
-      static_cast<nsSVGPathGeometryElement*>(pathFrame->GetContent());
-
-    RefPtr<Path> path = element->GetPathForLengthOrPositionMeasuring();
-
-    gfxMatrix matrix = element->PrependLocalTransformsTo(gfxMatrix());
-    if (!matrix.IsIdentity()) {
-      RefPtr<PathBuilder> builder =
-        path->TransformedCopyToBuilder(ToMatrix(matrix));
-      path = builder->Finish();
-    }
-
-    return path.forget();
-  }
-  return nullptr;
+  if (!pathFrame) {
+    return nullptr;
+  }
+
+  nsSVGPathGeometryElement *element =
+    static_cast<nsSVGPathGeometryElement*>(pathFrame->GetContent());
+
+  RefPtr<Path> path = element->GetPathForLengthOrPositionMeasuring();
+  if (!path) {
+    return nullptr;
+  }
+
+  gfxMatrix matrix = element->PrependLocalTransformsTo(gfxMatrix());
+  if (!matrix.IsIdentity()) {
+    RefPtr<PathBuilder> builder =
+      path->TransformedCopyToBuilder(ToMatrix(matrix));
+    path = builder->Finish();
+  }
+
+  return path.forget();
 }
 
 gfxFloat
 nsSVGTextFrame2::GetOffsetScale(nsIFrame* aTextPathFrame)
 {
   nsIFrame *pathFrame = GetTextPathPathFrame(aTextPathFrame);
   if (!pathFrame)
     return 1.0;