Bug 492186 - Crash with altGlyphDef and getBBox. r=roc
authorRobert Longson <longsonr@gmail.com>
Wed, 17 Jun 2009 22:29:55 +0100
changeset 29311 7fcb443a08ce0fc228cb16b01166a5174213f31f
parent 29310 6bea55351cd178b0bff4b4e4b4bb75eaa54fb699
child 29312 51084a12bb468558b663eca5cdc0e7f7caa33da6
push id1
push usershaver@mozilla.com
push dateTue, 04 Jan 2011 17:58:04 +0000
reviewersroc
bugs492186
milestone1.9.2a1pre
Bug 492186 - Crash with altGlyphDef and getBBox. r=roc
layout/svg/base/src/nsSVGContainerFrame.cpp
layout/svg/base/src/nsSVGSwitchFrame.cpp
layout/svg/crashtests/492186-1.svg
layout/svg/crashtests/crashtests.list
--- a/layout/svg/base/src/nsSVGContainerFrame.cpp
+++ b/layout/svg/base/src/nsSVGContainerFrame.cpp
@@ -267,18 +267,21 @@ nsSVGDisplayContainerFrame::GetBBoxContr
 
   nsIFrame* kid = mFrames.FirstChild();
   while (kid) {
     nsISVGChildFrame* svgKid = do_QueryFrame(kid);
     if (svgKid) {
       gfxMatrix transform = aToBBoxUserspace;
       // nsSVGGlyphFrame's mContent is a nsTextNode!
       if (kid->GetType() != nsGkAtoms::svgGlyphFrame) {
-        transform = static_cast<nsSVGElement*>(kid->GetContent())->
-                      PrependLocalTransformTo(aToBBoxUserspace);
+        nsIContent *content = kid->GetContent();
+        if (content->IsNodeOfType(nsINode::eSVG)) {
+          transform = static_cast<nsSVGElement*>(content)->
+                        PrependLocalTransformTo(aToBBoxUserspace);
+        }
       }
       bboxUnion = bboxUnion.Union(svgKid->GetBBoxContribution(transform));
     }
     kid = kid->GetNextSibling();
   }
 
   return bboxUnion;
 }
--- a/layout/svg/base/src/nsSVGSwitchFrame.cpp
+++ b/layout/svg/base/src/nsSVGSwitchFrame.cpp
@@ -184,18 +184,22 @@ nsSVGSwitchFrame::NotifyRedrawUnsuspende
 }
 
 gfxRect
 nsSVGSwitchFrame::GetBBoxContribution(const gfxMatrix &aToBBoxUserspace)
 {
   nsIFrame* kid = GetActiveChildFrame();
   nsISVGChildFrame* svgKid = do_QueryFrame(kid);
   if (svgKid) {
-    gfxMatrix transform = static_cast<nsSVGElement*>(kid->GetContent())->
-                            PrependLocalTransformTo(aToBBoxUserspace);
+    nsIContent *content = kid->GetContent();
+    gfxMatrix transform = aToBBoxUserspace;
+    if (content->IsNodeOfType(nsINode::eSVG)) {
+      transform = static_cast<nsSVGElement*>(content)->
+                    PrependLocalTransformTo(aToBBoxUserspace);
+    }
     return svgKid->GetBBoxContribution(transform);
   }
   return gfxRect(0.0, 0.0, 0.0, 0.0);
 }
 
 nsIFrame *
 nsSVGSwitchFrame::GetActiveChildFrame()
 {
new file mode 100644
--- /dev/null
+++ b/layout/svg/crashtests/492186-1.svg
@@ -0,0 +1,6 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+<altGlyphDef/>
+<script xmlns="http://www.w3.org/1999/xhtml">
+document.documentElement.getBBox();
+</script>
+</svg>
--- a/layout/svg/crashtests/crashtests.list
+++ b/layout/svg/crashtests/crashtests.list
@@ -68,9 +68,10 @@ load 461289-1.svg
 load 464374-1.svg
 load 466585-1.svg
 load 470124-1.svg
 load 474700-1.svg
 load 472782-1.svg
 load 475181-1.svg
 load 475193-1.html
 load 478128-1.svg
+load 492186-1.svg
 load extref-test-1.xhtml