Bug 442633. Detect removal of href attribute on SVG <use> elements. r=longsonr,sr=mats

content/svg/content/src/nsSVGUseElement.cpp

@@ -478,7 +478,7 @@ nsSVGUseElement::DidChangeString(PRUint8 aAttrEnum, PRBool aDoSetAttr)
   if (aAttrEnum == HREF) {
     // we're changing our nature, clear out the clone information
     mOriginal = nsnull;
-
+    UnlinkSource();
     TriggerReclone();
   }
 }

layout/reftests/svg/dynamic-use-02.svg

@@ -0,0 +1,17 @@
+<!--
+     Any copyright is dedicated to the Public Domain.
+     http://creativecommons.org/licenses/publicdomain/
+-->
+<svg xmlns="http://www.w3.org/2000/svg"
+     xmlns:xlink="http://www.w3.org/1999/xlink"
+     style="background: lime;">
+  <defs>
+    <rect width="100%" height="100%" id="r"/>
+  </defs>
+  <use id="u" xlink:href="#r" fill="red"/>
+  <script type="text/javascript">
+    var u = document.getElementById("u");
+    u.getBoundingClientRect();
+    u.removeAttributeNS("http://www.w3.org/1999/xlink", "href");
+  </script>
+</svg>

layout/reftests/svg/reftest.list

@@ -40,6 +40,7 @@ include moz-only/reftest.list
 == dynamic-text-03.svg dynamic-text-03-ref.svg
 == dynamic-textPath-01.svg dynamic-textPath-01-ref.svg
 == dynamic-use-01.svg pass.svg
+== dynamic-use-02.svg pass.svg
 == use-01-extref.svg pass.svg
 == use-02-extref.svg use-02-extref-ref.svg
 == fallback-color-01a.svg pass.svg