Bug 709920: Be more sensitive in checking for zero-size viewBox in nsSVGPatternFrame::ConstructCTM. r=longsonr a=khuey
authorDaniel Holbert <dholbert@cs.stanford.edu>
Tue, 13 Dec 2011 12:12:36 -0800
changeset 84157 7604f82c29d0bfcf7e1763fb31587f5cacf1c86f
parent 84156 300849c3dd10038d19a6cad6b10d8bae780ba0b7
child 84158 65485f06a977a6ebaf35bab1435a7255b83557a2
push id519
push userakeybl@mozilla.com
push dateWed, 01 Feb 2012 00:38:35 +0000
treeherdermozilla-beta@788ea1ef610b [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewerslongsonr, khuey
bugs709920
milestone11.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 709920: Be more sensitive in checking for zero-size viewBox in nsSVGPatternFrame::ConstructCTM. r=longsonr a=khuey
layout/svg/base/src/nsSVGPatternFrame.cpp
layout/svg/crashtests/709920-1.svg
layout/svg/crashtests/709920-2.svg
layout/svg/crashtests/crashtests.list
--- a/layout/svg/base/src/nsSVGPatternFrame.cpp
+++ b/layout/svg/base/src/nsSVGPatternFrame.cpp
@@ -576,17 +576,17 @@ nsSVGPatternFrame::ConstructCTM(const gf
       ctx = static_cast<nsSVGElement*>(targetContent)->GetCtx();
     }
     float scale = nsSVGUtils::MaxExpansion(callerCTM);
     tCTM.Scale(scale, scale);
   }
 
   const nsSVGViewBoxRect viewBox = GetViewBox().GetAnimValue();
 
-  if (viewBox.height <= 0.0f && viewBox.width <= 0.0f) {
+  if (viewBox.height <= 0.0f || viewBox.width <= 0.0f) {
     return tCTM;
   }
 
   float viewportWidth, viewportHeight;
   if (targetContent->IsSVG()) {
     // If we're dealing with an SVG target only retrieve the context once.
     // Calling the nsIFrame* variant of GetAnimValue would look it up on
     // every call.
new file mode 100644
--- /dev/null
+++ b/layout/svg/crashtests/709920-1.svg
@@ -0,0 +1,23 @@
+<svg xmlns="http://www.w3.org/2000/svg"
+     class="reftest-wait">
+  <!-- Test to be sure that a zero-sized-in-one-dimension viewBox doesn't
+       make us fail assertions. -->
+  <script>
+    document.addEventListener("MozReftestInvalidate", waitAndFinish, false);
+
+    function waitAndFinish() {
+      // Sadly, MozReftestInvalidate fires sooner than PaintPattern here, so
+      // we need to wait a little bit to give PaintPattern a chance to hit
+      // this bug.
+      setTimeout(finish, 100);
+    }
+
+    function finish() {
+      document.documentElement.removeAttribute("class");
+    }
+  </script>
+  <pattern id="test" viewBox="0 0 1 0">
+    <rect/>
+  </pattern>
+  <rect width="200" height="200" fill="url(#test)"/>
+</svg>
new file mode 100644
--- /dev/null
+++ b/layout/svg/crashtests/709920-2.svg
@@ -0,0 +1,23 @@
+<svg xmlns="http://www.w3.org/2000/svg"
+     class="reftest-wait">
+  <!-- Test to be sure that a zero-sized-in-one-dimension viewBox doesn't
+       make us fail assertions. -->
+  <script>
+    document.addEventListener("MozReftestInvalidate", waitAndFinish, false);
+
+    function waitAndFinish() {
+      // Sadly, MozReftestInvalidate fires sooner than PaintPattern here, so
+      // we need to wait a little bit to give PaintPattern a chance to hit
+      // this bug.
+      setTimeout(finish, 100);
+    }
+
+    function finish() {
+      document.documentElement.removeAttribute("class");
+    }
+  </script>
+  <pattern id="test" viewBox="0 0 0 1">
+    <rect/>
+  </pattern>
+  <rect width="200" height="200" fill="url(#test)"/>
+</svg>
--- a/layout/svg/crashtests/crashtests.list
+++ b/layout/svg/crashtests/crashtests.list
@@ -114,8 +114,10 @@ load 655025-2.svg
 load 655025-3.svg
 load 657077-1.svg
 load 669025-1.svg
 load 669025-2.svg
 load 682411-1.svg
 load 692203-1.svg
 load 692203-2.svg
 load 693424-1.svg
+load 709920-1.svg
+load 709920-2.svg