diff --git a/layout/svg/base/src/nsSVGImageFrame.cpp b/layout/svg/base/src/nsSVGImageFrame.cpp index 324534edaf61..899b4a1fd26e 100644 --- a/layout/svg/base/src/nsSVGImageFrame.cpp +++ b/layout/svg/base/src/nsSVGImageFrame.cpp @@ -115,7 +115,7 @@ public: #endif private: - gfxMatrix GetImageTransform(); + gfxMatrix GetImageTransform(PRInt32 aNativeWidth, PRInt32 aNativeHeight); nsCOMPtr mListener; @@ -193,20 +193,16 @@ nsSVGImageFrame::AttributeChanged(PRInt32 aNameSpaceID, } gfxMatrix -nsSVGImageFrame::GetImageTransform() +nsSVGImageFrame::GetImageTransform(PRInt32 aNativeWidth, PRInt32 aNativeHeight) { float x, y, width, height; nsSVGImageElement *element = static_cast(mContent); element->GetAnimatedLengthValues(&x, &y, &width, &height, nsnull); - PRInt32 nativeWidth, nativeHeight; - mImageContainer->GetWidth(&nativeWidth); - mImageContainer->GetHeight(&nativeHeight); - gfxMatrix viewBoxTM = nsSVGUtils::GetViewBoxTransform(element, width, height, - 0, 0, nativeWidth, nativeHeight, + 0, 0, aNativeWidth, aNativeHeight, element->mPreserveAspectRatio); return viewBoxTM * gfxMatrix().Translate(gfxPoint(x, y)) * GetCanvasTM(); @@ -241,6 +237,14 @@ nsSVGImageFrame::PaintSVG(nsSVGRenderState *aContext, } if (mImageContainer) { + PRInt32 nativeWidth, nativeHeight; + mImageContainer->GetWidth(&nativeWidth); + mImageContainer->GetHeight(&nativeHeight); + + if (nativeWidth == 0 || nativeHeight == 0) { + return NS_ERROR_FAILURE; + } + if (mImageContainer->GetType() == imgIContainer::TYPE_VECTOR) { // not supported for SVG images yet. return NS_ERROR_FAILURE; @@ -261,7 +265,8 @@ nsSVGImageFrame::PaintSVG(nsSVGRenderState *aContext, // NOTE: We need to cancel out the effects of Full-Page-Zoom, or else // it'll get applied an extra time by DrawSingleUnscaledImage. - ctx->Multiply(GetImageTransform().Scale(pageZoomFactor, pageZoomFactor)); + ctx->Multiply(GetImageTransform(nativeWidth, nativeHeight). + Scale(pageZoomFactor, pageZoomFactor)); // fill-opacity doesn't affect , so if we're allowed to // optimize group opacity, the opacity used for compositing the @@ -313,7 +318,11 @@ nsSVGImageFrame::GetFrameForPoint(const nsPoint &aPoint) mImageContainer->GetWidth(&nativeWidth); mImageContainer->GetHeight(&nativeHeight); - if (!nsSVGUtils::HitTestRect(GetImageTransform(), + if (nativeWidth == 0 || nativeHeight == 0) { + return nsnull; + } + + if (!nsSVGUtils::HitTestRect(GetImageTransform(nativeWidth, nativeHeight), 0, 0, nativeWidth, nativeHeight, PresContext()->AppUnitsToDevPixels(aPoint.x), PresContext()->AppUnitsToDevPixels(aPoint.y))) { diff --git a/layout/svg/crashtests/605626-1.svg b/layout/svg/crashtests/605626-1.svg new file mode 100644 index 000000000000..678b011797b4 --- /dev/null +++ b/layout/svg/crashtests/605626-1.svg @@ -0,0 +1,3 @@ + + + diff --git a/layout/svg/crashtests/crashtests.list b/layout/svg/crashtests/crashtests.list index 0176d8544dde..2a831401cb23 100644 --- a/layout/svg/crashtests/crashtests.list +++ b/layout/svg/crashtests/crashtests.list @@ -92,3 +92,4 @@ load 522394-2.svg load 522394-3.svg load extref-test-1.xhtml load 566216-1.svg +load 605626-1.svg