Bug 974746 - Fix rotated zero width or height pattern crash. r=jwatt
authorRobert Longson <longsonr@gmail.com>
Thu, 20 Feb 2014 20:49:14 +0000
changeset 170107 723bd507c9ee50f5ad138cd33fa16c19e86ba0ae
parent 170106 485ec336ffff35e8481d5d93cc55095b8049c0d2
child 170108 ffd9d3ae66fe011bdb80aebe6db01b31ed8aef23
push id270
push userpvanderbeken@mozilla.com
push dateThu, 06 Mar 2014 09:24:21 +0000
reviewersjwatt
bugs974746
milestone30.0a1
Bug 974746 - Fix rotated zero width or height pattern crash. r=jwatt
layout/svg/crashtests/974746-1.svg
layout/svg/crashtests/crashtests.list
layout/svg/nsSVGPatternFrame.cpp
new file mode 100644
--- /dev/null
+++ b/layout/svg/crashtests/974746-1.svg
@@ -0,0 +1,9 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+
+    <pattern id="patternRotated" width="1" patternTransform="rotate(45 50 50)">
+        <rect/>
+    </pattern>
+
+    <rect width="100" height="100" fill="url(#patternRotated)"/>
+
+</svg>
--- a/layout/svg/crashtests/crashtests.list
+++ b/layout/svg/crashtests/crashtests.list
@@ -173,8 +173,9 @@ load 890782-1.svg
 load 890783-1.svg
 load 893510-1.svg
 load 895311-1.svg
 load 897342-1.svg
 load 898909-1.svg
 load 898951-1.svg
 load 919371-1.xhtml
 load 952270-1.svg
+load 974746-1.svg
--- a/layout/svg/nsSVGPatternFrame.cpp
+++ b/layout/svg/nsSVGPatternFrame.cpp
@@ -310,16 +310,19 @@ nsSVGPatternFrame::PaintPattern(gfxASurf
   } else {
     patternFrame->mCTM = new gfxMatrix(ctm);
   }
 
   // Get the bounding box of the pattern.  This will be used to determine
   // the size of the surface, and will also be used to define the bounding
   // box for the pattern tile.
   gfxRect bbox = GetPatternRect(patternUnits, callerBBox, ToMatrix(aContextMatrix), aSource);
+  if (bbox.Width() <= 0.0 || bbox.Height() <= 0.0) {
+    return NS_ERROR_FAILURE;
+  }
 
   // Get the pattern transform
   gfxMatrix patternTransform = GetPatternTransform();
 
   // revert the vector effect transform so that the pattern appears unchanged
   if (aFillOrStroke == &nsStyleSVG::mStroke) {
     patternTransform.Multiply(nsSVGUtils::GetStrokeTransform(aSource).Invert());
   }