From 3e9878463da51a6353d41ea1bc087e9e965e9fe5 Mon Sep 17 00:00:00 2001
From: Cameron McCormack <cam@mcc.id.au>
Date: Wed, 25 Sep 2013 17:18:41 +1000
Subject: [PATCH] Bug 916704 - Always initialize SVGTextContentPaint::Paint and
 check SetupCairoState return value in nsSVGTextFrame2::PaintSVG. r=longsonr

---
 layout/svg/nsSVGGlyphFrame.cpp |  1 +
 layout/svg/nsSVGGlyphFrame.h   |  2 +-
 layout/svg/nsSVGTextFrame2.cpp | 27 ++++++++++++++++-----------
 3 files changed, 18 insertions(+), 12 deletions(-)

diff --git a/layout/svg/nsSVGGlyphFrame.cpp b/layout/svg/nsSVGGlyphFrame.cpp
index 26a5ad741b10..6ae0c9a27fcf 100644
--- a/layout/svg/nsSVGGlyphFrame.cpp
+++ b/layout/svg/nsSVGGlyphFrame.cpp
@@ -1143,6 +1143,7 @@ mozilla::SVGTextContextPaint::Paint::GetPattern(float aOpacity,
     // cache it, we'll have to compute mPatternMatrix, which is annoying.
     return pattern.forget();
   default:
+    MOZ_ASSERT(false, "invalid paint type");
     return nullptr;
   }
 
diff --git a/layout/svg/nsSVGGlyphFrame.h b/layout/svg/nsSVGGlyphFrame.h
index c41425781264..51eb1cbd0647 100644
--- a/layout/svg/nsSVGGlyphFrame.h
+++ b/layout/svg/nsSVGGlyphFrame.h
@@ -46,7 +46,7 @@ struct SVGTextContextPaint : public gfxTextContextPaint {
   float GetStrokeOpacity() MOZ_OVERRIDE { return mStrokeOpacity; }
 
   struct Paint {
-    Paint() {}
+    Paint() : mPaintType(eStyleSVGPaintType_None) {}
 
     void SetPaintServer(nsIFrame *aFrame, const gfxMatrix& aContextMatrix,
                         nsSVGPaintServerFrame *aPaintServerFrame) {
diff --git a/layout/svg/nsSVGTextFrame2.cpp b/layout/svg/nsSVGTextFrame2.cpp
index e5625370f57b..dad4e14fe576 100644
--- a/layout/svg/nsSVGTextFrame2.cpp
+++ b/layout/svg/nsSVGTextFrame2.cpp
@@ -3531,7 +3531,9 @@ nsSVGTextFrame2::PaintSVG(nsRenderingContext* aContext,
       (gfxTextContextPaint*)aContext->GetUserData(&gfxTextContextPaint::sUserDataKey);
 
     nsAutoPtr<gfxTextContextPaint> contextPaint;
-    SetupCairoState(gfx, frame, outerContextPaint, getter_Transfers(contextPaint));
+    gfxFont::DrawMode drawMode =
+      SetupCairoState(gfx, frame, outerContextPaint,
+                      getter_Transfers(contextPaint));
 
     // Set up the transform for painting the text frame for the substring
     // indicated by the run.
@@ -3540,16 +3542,19 @@ nsSVGTextFrame2::PaintSVG(nsRenderingContext* aContext,
     runTransform.Multiply(currentMatrix);
     gfx->SetMatrix(runTransform);
 
-    nsRect frameRect = frame->GetVisualOverflowRect();
-    bool paintSVGGlyphs;
-    if (ShouldRenderAsPath(aContext, frame, paintSVGGlyphs)) {
-      SVGTextDrawPathCallbacks callbacks(aContext, frame, matrixForPaintServers,
-                                         paintSVGGlyphs);
-      frame->PaintText(aContext, nsPoint(), frameRect, item,
-                       contextPaint, &callbacks);
-    } else {
-      frame->PaintText(aContext, nsPoint(), frameRect, item,
-                       contextPaint, nullptr);
+    if (drawMode != gfxFont::DrawMode(0)) {
+      nsRect frameRect = frame->GetVisualOverflowRect();
+      bool paintSVGGlyphs;
+      if (ShouldRenderAsPath(aContext, frame, paintSVGGlyphs)) {
+        SVGTextDrawPathCallbacks callbacks(aContext, frame,
+                                           matrixForPaintServers,
+                                           paintSVGGlyphs);
+        frame->PaintText(aContext, nsPoint(), frameRect, item,
+                         contextPaint, &callbacks);
+      } else {
+        frame->PaintText(aContext, nsPoint(), frameRect, item,
+                         contextPaint, nullptr);
+      }
     }
 
     if (frame == caretFrame && ShouldPaintCaret(run, caret)) {