From 0ce0423e6cf0dc5fb67f77a131d6683bdee1ca0f Mon Sep 17 00:00:00 2001
From: Robert Longson <longsonr@gmail.com>
Date: Sun, 3 Feb 2013 14:06:55 +0000
Subject: [PATCH] Bug 837450 -  Leak with getTransformToElement. r=jwatt

---
 content/svg/content/src/SVGTransformableElement.cpp |  2 +-
 content/svg/content/src/crashtests/837450-1.svg     | 10 ++++++++++
 content/svg/content/src/crashtests/crashtests.list  |  1 +
 3 files changed, 12 insertions(+), 1 deletion(-)
 create mode 100644 content/svg/content/src/crashtests/837450-1.svg

diff --git a/content/svg/content/src/SVGTransformableElement.cpp b/content/svg/content/src/SVGTransformableElement.cpp
index e06a67fd017e..c1e4efe124c9 100644
--- a/content/svg/content/src/SVGTransformableElement.cpp
+++ b/content/svg/content/src/SVGTransformableElement.cpp
@@ -221,7 +221,7 @@ SVGTransformableElement::GetTransformToElement(SVGGraphicsElement& aElement,
   nsCOMPtr<SVGMatrix> tmp = targetScreenCTM->Inverse(rv);
   if (rv.Failed()) return nullptr;
 
-  nsCOMPtr<SVGMatrix> mat = tmp->Multiply(*ourScreenCTM).get();
+  nsCOMPtr<SVGMatrix> mat = tmp->Multiply(*ourScreenCTM);
   return mat.forget();
 }
 
diff --git a/content/svg/content/src/crashtests/837450-1.svg b/content/svg/content/src/crashtests/837450-1.svg
new file mode 100644
index 000000000000..7c57363ce740
--- /dev/null
+++ b/content/svg/content/src/crashtests/837450-1.svg
@@ -0,0 +1,10 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+
+<script>
+
+var root = document.documentElement;
+root.getTransformToElement(root);
+
+</script>
+
+</svg>
diff --git a/content/svg/content/src/crashtests/crashtests.list b/content/svg/content/src/crashtests/crashtests.list
index c27bb832d91b..b8d177da9746 100644
--- a/content/svg/content/src/crashtests/crashtests.list
+++ b/content/svg/content/src/crashtests/crashtests.list
@@ -62,3 +62,4 @@ load 723441-1.html
 load 751515-1.svg
 load 761507-1.svg
 load 831561.html
+load 837450-1.svg