Bug 1182496 - Don't create frames for SVG <text> descendants with failing conditional processing attributes. r=dholbert

2015-07-17 11:29:22 +10:00 · 2015-07-17 11:29:22 +10:00 · 2b9faf4b60
--- a/layout/base/nsCSSFrameConstructor.cpp
+++ b/layout/base/nsCSSFrameConstructor.cpp
@ -5182,6 +5182,17 @@ nsCSSFrameConstructor::FindSVGData(Element* aElement,
    // Elements with failing conditional processing attributes never get
    // rendered.  Note that this is not where we select which frame in a
    // <switch> to render!  That happens in nsSVGSwitchFrame::PaintSVG.
+    if (aIsWithinSVGText) {
+      // SVGTextFrame doesn't handle conditional processing attributes,
+      // so don't create frames for descendants of <text> with failing
+      // attributes.  We need frames not to be created so that text layout
+      // is correct.
+      return &sSuppressData;
+    }
+    // If we're not inside <text>, create an nsSVGContainerFrame (which is a
+    // frame that doesn't render) so that paint servers can still be referenced,
+    // even if they live inside an element with failing conditional processing
+    // attributes.
    return &sContainerData;
  }

--- a/layout/reftests/svg/conditions-09-ref.svg
+++ b/layout/reftests/svg/conditions-09-ref.svg
@ -0,0 +1,5 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="400" height="100">
+  <text x="10" y="20">
+    <tspan fill="green">This text should display.</tspan>
+  </text>
+</svg>
--- a/layout/reftests/svg/conditions-09.svg
+++ b/layout/reftests/svg/conditions-09.svg
@ -0,0 +1,6 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="400" height="100">
+  <text x="10" y="20">
+    <tspan systemLanguage="xx" fill="red">This text shouldn't display.</tspan>
+    <tspan fill="green">This text should display.</tspan>
+  </text>
+</svg>
--- a/layout/reftests/svg/reftest.list
+++ b/layout/reftests/svg/reftest.list
@ -52,6 +52,7 @@ random-if(Mulet) == conditions-05.svg about:blank # bug 1178062
 == conditions-06.svg pass.svg
 == conditions-07.svg pass.svg
 == conditions-08.svg conditions-08-ref.svg
+== conditions-09.svg conditions-09-ref.svg
 == currentColor-01.svg pass.svg
 == currentColor-02.svg pass.svg
 == currentColor-03.svg pass.svg
--- a/layout/svg/crashtests/1182496-1.html
+++ b/layout/svg/crashtests/1182496-1.html
@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<html>
+<head>
+  <script>
+    function tweak(){
+      document.body.innerHTML="fuzz"
+    }
+  </script>
+</head>
+<body onload="tweak()">
+  <svg xmlns="http://www.w3.org/2000/svg">
+    <text>
+      <foreignObject requiredFeatures="foo">
+        <svg style="position: absolute;"/>
+      </foreignObject>
+    </text>
+  </svg>
+</body>
+</html>
+
+
--- a/layout/svg/crashtests/crashtests.list
+++ b/layout/svg/crashtests/crashtests.list
@ -189,3 +189,4 @@ load 993443.svg
 load 1016145.svg
 load 1028512.svg
 load 1140080-1.svg
+load 1182496-1.html