Bug 566216. Our parent could be a document fragment. r=dholbert
authorBoris Zbarsky <bzbarsky@mit.edu>
Mon, 17 May 2010 14:18:25 -0400
changeset 42385 d10c3fba495b05373d116689085004b66e56adae
parent 42384 cf5dcc522934ef6e484838fa0c76bbd5b0bba154
child 42386 90d627f2471eb38d96d8b1ccef04465c8363da53
push id1
push usershaver@mozilla.com
push dateTue, 04 Jan 2011 17:58:04 +0000
reviewersdholbert
bugs566216
milestone1.9.3a5pre
Bug 566216. Our parent could be a document fragment. r=dholbert
layout/svg/base/src/nsSVGUtils.cpp
layout/svg/crashtests/566216-1.svg
layout/svg/crashtests/crashtests.list
--- a/layout/svg/base/src/nsSVGUtils.cpp
+++ b/layout/svg/base/src/nsSVGUtils.cpp
@@ -251,17 +251,17 @@ nsSVGUtils::GetParentElement(nsIContent 
     nsIContent *result = bindingManager->GetInsertionParent(aContent);
     if (result) {
       return result->AsElement();
     }
   }
 
   // otherewise use the explicit one, whether it's null or not...
   nsIContent* parent = aContent->GetParent();
-  return parent ? parent->AsElement() : nsnull;
+  return parent && parent->IsElement() ? parent->AsElement() : nsnull;
 }
 
 float
 nsSVGUtils::GetFontSize(Element *aElement)
 {
   if (!aElement)
     return 1.0f;
 
new file mode 100644
--- /dev/null
+++ b/layout/svg/crashtests/566216-1.svg
@@ -0,0 +1,19 @@
+<?xml version="1.0"?>
+
+<svg xmlns="http://www.w3.org/2000/svg"><animate id="y"/><script>
+<![CDATA[
+
+function boom()
+{
+  var r = document.createRange();
+  r.setEnd(document.getElementById('y'), 0);
+  r.extractContents();
+}
+
+window.addEventListener("load", boom, false);
+
+]]>
+</script>
+</svg>
+
+
--- a/layout/svg/crashtests/crashtests.list
+++ b/layout/svg/crashtests/crashtests.list
@@ -79,8 +79,9 @@ load 478128-1.svg
 load 492186-1.svg
 load 508247-1.svg
 load 512890-1.svg
 load 515288-1.html
 load 522394-1.svg
 load 522394-2.svg
 load 522394-3.svg
 load extref-test-1.xhtml
+load 566216-1.svg