diff --git a/content/svg/content/src/DOMSVGStringList.cpp b/content/svg/content/src/DOMSVGStringList.cpp index 3c743c5dfd64..8fd2a53d605c 100644 --- a/content/svg/content/src/DOMSVGStringList.cpp +++ b/content/svg/content/src/DOMSVGStringList.cpp @@ -141,6 +141,9 @@ DOMSVGStringList::InsertItemBefore(const nsAString & newItem, PRUint32 index, nsAString & _retval) { + if (newItem.IsEmpty()) { // takes care of DOMStringIsNull too + return NS_ERROR_DOM_SVG_INVALID_VALUE_ERR; + } index = NS_MIN(index, InternalList().Length()); // Ensure we have enough memory so we can avoid complex error handling below: @@ -160,6 +163,9 @@ DOMSVGStringList::ReplaceItem(const nsAString & newItem, PRUint32 index, nsAString & _retval) { + if (newItem.IsEmpty()) { // takes care of DOMStringIsNull too + return NS_ERROR_DOM_SVG_INVALID_VALUE_ERR; + } if (index >= InternalList().Length()) { return NS_ERROR_DOM_INDEX_SIZE_ERR; } diff --git a/content/svg/content/test/Makefile.in b/content/svg/content/test/Makefile.in index 4d8c8ccbc590..0925d9de0b03 100644 --- a/content/svg/content/test/Makefile.in +++ b/content/svg/content/test/Makefile.in @@ -90,6 +90,7 @@ _TEST_FILES = \ test_SVGMatrix.xhtml \ test_SVGPathSegList.xhtml \ test_SVGStyleElement.xhtml \ + test_SVGStringList.xhtml \ test_SVGTransformList.xhtml \ test_SVGTransformListAddition.xhtml \ test_SVGxxxList.xhtml \ diff --git a/content/svg/content/test/test_SVGStringList.xhtml b/content/svg/content/test/test_SVGStringList.xhtml new file mode 100644 index 000000000000..e1847292f1c8 --- /dev/null +++ b/content/svg/content/test/test_SVGStringList.xhtml @@ -0,0 +1,119 @@ + + + + Tests specific to SVGStringList + + + + +Mozilla Bug 724993 +

+ +
+
+
+ +