Bug 1560179 - Image should not accept eSHAPE r=longsonr
authorviolet <violet.bugreport@gmail.com>
Thu, 20 Jun 2019 13:14:08 +0000
changeset 538959 74e7a89b8d26daebae7c0a622cce47747e2c81b7
parent 538958 23c7396d23af3c3ce82dd7435b42cae1af50e907
child 538960 30bd16cacdb636ee82c499c3acb99e7a2702fe7e
push id11522
push userffxbld-merge
push dateMon, 01 Jul 2019 09:00:55 +0000
treeherdermozilla-beta@53ea74d2bd09 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewerslongsonr
bugs1560179
milestone69.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1560179 - Image should not accept eSHAPE r=longsonr Differential Revision: https://phabricator.services.mozilla.com/D35396
dom/svg/SVGImageElement.cpp
dom/svg/SVGImageElement.h
dom/svg/crashtests/1560179.html
dom/svg/crashtests/crashtests.list
--- a/dom/svg/SVGImageElement.cpp
+++ b/dom/svg/SVGImageElement.cpp
@@ -262,17 +262,18 @@ bool SVGImageElement::GetGeometryBounds(
   *aBounds = aToBoundsSpace.TransformBounds(rect);
   return true;
 }
 
 already_AddRefed<Path> SVGImageElement::BuildPath(PathBuilder* aBuilder) {
   // To get bound, the faster method GetGeometryBounds() should already return
   // success. For render and hittest, nsSVGImageFrame should have its own
   // implementation that doesn't need to build path for an image.
-  MOZ_CRASH("There is no reason to call BuildPath for SVGImageElement");
+  MOZ_ASSERT_UNREACHABLE(
+      "There is no reason to call BuildPath for SVGImageElement");
   return nullptr;
 }
 
 //----------------------------------------------------------------------
 // SVGElement methods
 
 /* virtual */
 bool SVGImageElement::HasValidDimensions() const {
--- a/dom/svg/SVGImageElement.h
+++ b/dom/svg/SVGImageElement.h
@@ -51,16 +51,22 @@ class SVGImageElement : public SVGImageE
                       const nsAString& aValue,
                       nsIPrincipal* aMaybeScriptedPrincipal,
                       nsAttrValue& aResult) override;
   virtual nsresult AfterSetAttr(int32_t aNamespaceID, nsAtom* aName,
                                 const nsAttrValue* aValue,
                                 const nsAttrValue* aOldValue,
                                 nsIPrincipal* aSubjectPrincipal,
                                 bool aNotify) override;
+  bool IsNodeOfType(uint32_t aFlags) const override {
+    // <imag> is not really a SVGGeometryElement, we should
+    // ignore eSHAPE flag accepted by SVGGeometryElement.
+    return SVGGraphicsElement::IsNodeOfType(aFlags);
+  }
+
   virtual nsresult BindToTree(BindContext&, nsINode& aParent) override;
   virtual void UnbindFromTree(bool aNullParent) override;
 
   virtual EventStates IntrinsicState() const override;
 
   NS_IMETHOD_(bool) IsAttributeMapped(const nsAtom* name) const override;
 
   // SVGGeometryElement methods:
new file mode 100644
--- /dev/null
+++ b/dom/svg/crashtests/1560179.html
@@ -0,0 +1,5 @@
+<svg class="">
+    <image class="" id="id_1" systemLanguage="">
+        <text class="" xml:space="preserve">
+            <textPath class="" xlink:href="#id_1">
+
--- a/dom/svg/crashtests/crashtests.list
+++ b/dom/svg/crashtests/crashtests.list
@@ -89,8 +89,9 @@ load 1419250-1.html
 load 1420492.html
 load 1477853.html
 load 1486488.html
 load 1493447.html
 skip-if(Android) load 1507961-1.html  # times out on Android due to the test size
 load 1531578-1.html
 load test_nested_svg.html
 load 1555795.html
+load 1560179.html