Bug 697978 - make display:none svg images load. r=dholbert,bzbarsky

content/base/public/nsContentUtils.h

@@ -235,6 +235,8 @@ public:
    */
   static bool     IsCallerTrustedForCapability(const char* aCapability);
 
+  static bool     IsImageSrcSetDisabled();
+
   /**
    * Returns the parent node of aChild crossing document boundaries.
    */

content/base/src/nsContentUtils.cpp

@@ -1453,6 +1453,13 @@ nsContentUtils::IsCallerTrustedForWrite()
   return IsCallerTrustedForCapability("UniversalBrowserWrite");
 }
 
+bool
+nsContentUtils::IsImageSrcSetDisabled()
+{
+  return Preferences::GetBool("dom.disable_image_src_set") &&
+         !IsCallerChrome();
+}
+
 // static
 nsINode*
 nsContentUtils::GetCrossDocParentNode(nsINode* aChild)

content/html/content/src/nsHTMLImageElement.cpp

@@ -76,7 +76,6 @@
 #include "nsEventDispatcher.h"
 
 #include "nsLayoutUtils.h"
-#include "mozilla/Preferences.h"
 
 using namespace mozilla;
 using namespace mozilla::dom;
@@ -487,10 +486,8 @@ nsHTMLImageElement::SetAttr(PRInt32 aNameSpaceID, nsIAtom* aName,
   if (aNotify &&
       aNameSpaceID == kNameSpaceID_None && aName == nsGkAtoms::src) {
 
-    // If caller is not chrome and dom.disable_image_src_set is true,
+    // Prevent setting image.src by exiting early
-    // prevent setting image.src by exiting early
+    if (nsContentUtils::IsImageSrcSetDisabled()) {
-    if (Preferences::GetBool("dom.disable_image_src_set") &&
-        !nsContentUtils::IsCallerChrome()) {
       return NS_OK;
     }
 

content/svg/content/src/nsSVGImageElement.cpp

@@ -167,6 +167,31 @@ nsSVGImageElement::LoadSVGImage(bool aForce, bool aNotify)
 //----------------------------------------------------------------------
 // nsIContent methods:
 
+nsresult
+nsSVGImageElement::AfterSetAttr(PRInt32 aNamespaceID, nsIAtom* aName,
+                                const nsAString* aValue, bool aNotify)
+{
+  if (aNamespaceID == kNameSpaceID_XLink && aName == nsGkAtoms::href) {
+
+    // If there's a frame it will deal
+    if (!GetPrimaryFrame()) {
+
+      // Prevent setting image.src by exiting early
+      if (nsContentUtils::IsImageSrcSetDisabled()) {
+        return NS_OK;
+      }
+
+      if (aValue) {
+        LoadSVGImage(true, aNotify);
+      } else {
+        CancelImageRequests(aNotify);
+      }
+    }
+  }
+  return nsSVGImageElementBase::AfterSetAttr(aNamespaceID, aName,
+                                             aValue, aNotify);
+}
+
 void
 nsSVGImageElement::MaybeLoadSVGImage()
 {

content/svg/content/src/nsSVGImageElement.h

@@ -77,6 +77,8 @@ public:
   NS_FORWARD_NSIDOMSVGELEMENT(nsSVGImageElementBase::)
 
   // nsIContent interface
+  virtual nsresult AfterSetAttr(PRInt32 aNamespaceID, nsIAtom* aName,
+                                const nsAString* aValue, bool aNotify);
   virtual nsresult BindToTree(nsIDocument* aDocument, nsIContent* aParent,
                               nsIContent* aBindingParent,
                               bool aCompileEventHandlers);
@@ -94,6 +96,8 @@ public:
 
   void MaybeLoadSVGImage();
 
+  bool IsImageSrcSetDisabled() const;
+
   virtual nsXPCClassInfo* GetClassInfo();
 protected:
   nsresult LoadSVGImage(bool aForce, bool aNotify);

layout/reftests/svg/image/image-load-01.svg

@@ -0,0 +1,20 @@
+<!--
+     Any copyright is dedicated to the Public Domain.
+     http://creativecommons.org/publicdomain/zero/1.0/
+-->
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
+
+  <title>Testcase to ensure that images load when they don't have frames</title>
+
+  <rect width="100%" height="100%" fill="lime"/>
+  <rect width="64" height="64" fill="red"/>
+
+  <script>
+    var img = document.createElementNS("http://www.w3.org/2000/svg", "image");
+    img.setAttribute("width", "64");
+    img.setAttribute("height", "64");
+    document.querySelector("svg").appendChild(img);
+    img.setAttributeNS("http://www.w3.org/1999/xlink", "xlink:href", "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAEAAAABACAIAAAAlC+aJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAgY0hSTQAAeiYAAICEAAD6AAAAgOgAAHUwAADqYAAAOpgAABdwnLpRPAAAAJFJREFUaEPt1UEOg0AMBEHz/0ez8IY5zFqqKFdLkGrHz7yz/PO9wOrv7qf/81n983uBCwAl1EYgQCD8H5eQhCTUboAAgbCBcNwdaBdIgIAlbjdAgEDYQDjuDrQLJEDAErcbIEAgbCAcdwfaBRIgYInbDRAgEDYQjrsD7QIJELDE7QYIEAgbCMfdgXaBBAhkS3wAXsqyIo0zj4gAAAAASUVORK5CYII=");
+  </script>
+
+</svg>

layout/reftests/svg/image/reftest.list

@@ -2,6 +2,7 @@
 
 == image-fill-01.svg          ../pass.svg
 == image-filter-01.svg        image-filter-01-ref.svg
+== image-load-01.svg          ../pass.svg
 == image-opacity-01.svg       image-opacity-01-ref.svg
 == image-opacity-02.svg       image-opacity-02-ref.svg
 == image-rotate-01.svg        image-rotate-01-ref.svg

layout/svg/base/src/nsSVGImageFrame.cpp

@@ -47,7 +47,6 @@
 #include "nsIInterfaceRequestorUtils.h"
 #include "gfxPlatform.h"
 #include "nsSVGSVGElement.h"
-#include "mozilla/Preferences.h"
 
 using namespace mozilla;
 
@@ -210,10 +209,9 @@ nsSVGImageFrame::AttributeChanged(PRInt32         aNameSpaceID,
   }
   if (aNameSpaceID == kNameSpaceID_XLink &&
       aAttribute == nsGkAtoms::href) {
-    // If caller is not chrome and dom.disable_image_src_set is true,
+
-    // prevent setting image.src by exiting early
+    // Prevent setting image.src by exiting early
-    if (Preferences::GetBool("dom.disable_image_src_set") &&
+    if (nsContentUtils::IsImageSrcSetDisabled()) {
-        !nsContentUtils::IsCallerChrome()) {
       return NS_OK;
     }
     nsSVGImageElement *element = static_cast<nsSVGImageElement*>(mContent);