Bug 757751 - attribute updates on non-rendered svg elements result in an abort. r=jwatt

layout/svg/base/src/nsSVGInnerSVGFrame.cpp

@@ -162,7 +162,8 @@ nsSVGInnerSVGFrame::AttributeChanged(PRInt32  aNameSpaceID,
                                      nsIAtom* aAttribute,
                                      PRInt32  aModType)
 {
-  if (aNameSpaceID == kNameSpaceID_None) {
+  if (aNameSpaceID == kNameSpaceID_None &&
+      !(GetStateBits() & NS_STATE_SVG_NONDISPLAY_CHILD)) {
 
     nsSVGSVGElement* content = static_cast<nsSVGSVGElement*>(mContent);
 

layout/svg/base/src/nsSVGOuterSVGFrame.cpp

@@ -581,7 +581,7 @@ nsSVGOuterSVGFrame::AttributeChanged(PRInt32  aNameSpaceID,
                                      PRInt32  aModType)
 {
   if (aNameSpaceID == kNameSpaceID_None &&
-      !(GetStateBits() & NS_FRAME_FIRST_REFLOW)) {
+      !(GetStateBits() & (NS_FRAME_FIRST_REFLOW | NS_STATE_SVG_NONDISPLAY_CHILD))) {
     if (aAttribute == nsGkAtoms::viewBox ||
         aAttribute == nsGkAtoms::preserveAspectRatio ||
         aAttribute == nsGkAtoms::transform) {

layout/svg/crashtests/757751-1.svg

@@ -0,0 +1,8 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+  <defs>
+    <svg id="x" viewBox=" 0 0 10 10"/>
+  </defs>
+  <script>
+    window.addEventListener("load", function() { document.getElementById("x").setAttribute("width", "2"); }, false);
+  </script>
+</svg>

layout/svg/crashtests/crashtests.list

@@ -131,4 +131,5 @@ load 740627-2.svg
 load 757704-1.svg
 load 757718-1.svg
 load 768351.svg
+load 757751-1.svg