Bug 1182496 - Don't create frames for SVG <text> descendants with failing conditional processing attributes. r=dholbert, a=lmandel
authorCameron McCormack <cam@mcc.id.au>
Fri, 17 Jul 2015 11:29:22 +1000
changeset 275386 01fff103d1fcc62591874c5666da4d5477b58bb9
parent 275385 e1edeb7ac8360b0d10698f7e0dd0c65891126f68
child 275387 b654784a57e25d72c00faa180c768279616d2e04
push id863
push userraliiev@mozilla.com
push dateMon, 03 Aug 2015 13:22:43 +0000
treeherdermozilla-release@f6321b14228d [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersdholbert, lmandel
bugs1182496
milestone40.0
Bug 1182496 - Don't create frames for SVG <text> descendants with failing conditional processing attributes. r=dholbert, a=lmandel
layout/base/nsCSSFrameConstructor.cpp
layout/reftests/svg/conditions-09-ref.svg
layout/reftests/svg/conditions-09.svg
layout/reftests/svg/reftest.list
layout/svg/crashtests/1182496-1.html
layout/svg/crashtests/crashtests.list
--- a/layout/base/nsCSSFrameConstructor.cpp
+++ b/layout/base/nsCSSFrameConstructor.cpp
@@ -5168,16 +5168,27 @@ nsCSSFrameConstructor::FindSVGData(Eleme
     return &sMarkerSVGData;
   }
 
   nsCOMPtr<SVGTests> tests(do_QueryInterface(aElement));
   if (tests && !tests->PassesConditionalProcessingTests()) {
     // Elements with failing conditional processing attributes never get
     // rendered.  Note that this is not where we select which frame in a
     // <switch> to render!  That happens in nsSVGSwitchFrame::PaintSVG.
+    if (aIsWithinSVGText) {
+      // SVGTextFrame doesn't handle conditional processing attributes,
+      // so don't create frames for descendants of <text> with failing
+      // attributes.  We need frames not to be created so that text layout
+      // is correct.
+      return &sSuppressData;
+    }
+    // If we're not inside <text>, create an nsSVGContainerFrame (which is a
+    // frame that doesn't render) so that paint servers can still be referenced,
+    // even if they live inside an element with failing conditional processing
+    // attributes.
     return &sContainerData;
   }
 
   // Ensure that a stop frame is a child of a gradient and that gradients
   // can only have stop children.
   bool parentIsGradient = aParentFrame &&
     (aParentFrame->GetType() == nsGkAtoms::svgLinearGradientFrame ||
      aParentFrame->GetType() == nsGkAtoms::svgRadialGradientFrame);
new file mode 100644
--- /dev/null
+++ b/layout/reftests/svg/conditions-09-ref.svg
@@ -0,0 +1,5 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="400" height="100">
+  <text x="10" y="20">
+    <tspan fill="green">This text should display.</tspan>
+  </text>
+</svg>
new file mode 100644
--- /dev/null
+++ b/layout/reftests/svg/conditions-09.svg
@@ -0,0 +1,6 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="400" height="100">
+  <text x="10" y="20">
+    <tspan systemLanguage="xx" fill="red">This text shouldn't display.</tspan>
+    <tspan fill="green">This text should display.</tspan>
+  </text>
+</svg>
--- a/layout/reftests/svg/reftest.list
+++ b/layout/reftests/svg/reftest.list
@@ -46,16 +46,17 @@ fuzzy-if(/^Windows\x20NT\x206\.[12]/.tes
 == conditions-01.svg pass.svg
 == conditions-02.svg pass.svg
 == conditions-03.svg pass.svg
 == conditions-04.svg pass.svg
 == conditions-05.svg about:blank
 == conditions-06.svg pass.svg
 == conditions-07.svg pass.svg
 == conditions-08.svg conditions-08-ref.svg
+== conditions-09.svg conditions-09-ref.svg
 == currentColor-01.svg pass.svg
 == currentColor-02.svg pass.svg
 == currentColor-03.svg pass.svg
 == data-uri-with-filter-01.xhtml data-uri-with-filter-01-ref.svg
 == data-uri-with-gradient-01.xhtml data-uri-with-gradient-01-ref.svg
 == data-uri-with-pattern-01.xhtml pass.svg
 == dynamic-attr-removal-1.svg pass.svg
 == dynamic-attr-removal-2.svg pass.svg
new file mode 100644
--- /dev/null
+++ b/layout/svg/crashtests/1182496-1.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<html>
+<head>
+  <script>
+    function tweak(){
+      document.body.innerHTML="fuzz"
+    }
+  </script>
+</head>
+<body onload="tweak()">
+  <svg xmlns="http://www.w3.org/2000/svg">
+    <text>
+      <foreignObject requiredFeatures="foo">
+        <svg style="position: absolute;"/>
+      </foreignObject>
+    </text>
+  </svg>
+</body>
+</html>
+
+
--- a/layout/svg/crashtests/crashtests.list
+++ b/layout/svg/crashtests/crashtests.list
@@ -184,8 +184,9 @@ load 963086-1.svg
 load 975773-1.svg
 load 974746-1.svg
 load 979407-1.svg
 load 979407-2.svg
 load 993443.svg
 load 1016145.svg
 load 1028512.svg
 load 1140080-1.svg
+load 1182496-1.html