Bug 375775 - filter crash with display:none. r+sr=roc

layout/svg/base/src/nsSVGFilterFrame.cpp

@@ -57,31 +57,16 @@ NS_NewSVGFilterFrame(nsIPresShell* aPresShell, nsIContent* aContent, nsStyleCont
   return new (aPresShell) nsSVGFilterFrame(aContext);
 }
 
-nsSVGFilterFrame *
-NS_GetSVGFilterFrame(nsIURI *aURI, nsIContent *aContent)
+nsIContent *
+NS_GetSVGFilterElement(nsIURI *aURI, nsIContent *aContent)
 {
-  // Get the PresShell
-  nsIDocument *myDoc = aContent->GetCurrentDoc();
-  if (!myDoc) {
-    NS_WARNING("No document for this content!");
-    return nsnull;
-  }
-  nsIPresShell *presShell = myDoc->GetShellAt(0);
-  if (!presShell) {
-    NS_WARNING("no presshell");
-    return nsnull;
-  }
+  nsIContent* content = nsContentUtils::GetReferencedElement(aURI, aContent);
 
-  // Find the referenced frame
-  nsIFrame *filter;
-  if (!NS_SUCCEEDED(nsSVGUtils::GetReferencedFrame(&filter, aURI, aContent, presShell)))
-    return nsnull;
+  nsCOMPtr<nsIDOMSVGFilterElement> filter = do_QueryInterface(content);
+  if (filter)
+    return content;
 
-  nsIAtom* frameType = filter->GetType();
-  if (frameType != nsGkAtoms::svgFilterFrame)
-    return nsnull;
-
-  return NS_STATIC_CAST(nsSVGFilterFrame *, filter);
+  return nsnull;
 }
 
 NS_IMETHODIMP

layout/svg/base/src/nsSVGFilterFrame.h

@@ -70,7 +70,7 @@ private:
                          nsISVGChildFrame *aTarget);
 };
 
-nsSVGFilterFrame *
-NS_GetSVGFilterFrame(nsIURI *aURI, nsIContent *aContent);
+nsIContent *
+NS_GetSVGFilterElement(nsIURI *aURI, nsIContent *aContent);
 
 #endif

layout/svg/base/src/nsSVGUtils.cpp

@@ -83,10 +83,10 @@
 
 class nsSVGFilterProperty : public nsStubMutationObserver {
 public:
-  nsSVGFilterProperty(nsSVGFilterFrame *aFilter, nsIFrame *aFrame);
+  nsSVGFilterProperty(nsIContent *aFilter, nsIFrame *aFilteredFrame);
 
   nsRect GetRect() { return mFilterRect; }
-  nsSVGFilterFrame *GetFilterFrame() { return mFilter; }
+  nsSVGFilterFrame *GetFilterFrame();
   void RemoveMutationObserver();
 
   // nsISupports
@@ -108,26 +108,37 @@ private:
   void DoUpdate();
 
   nsWeakPtr mObservedFilter;
-  nsSVGFilterFrame *mFilter;
   nsIFrame *mFrame;  // frame being filtered
   nsRect mFilterRect;
 };
 
 NS_IMPL_ISUPPORTS1(nsSVGFilterProperty, nsIMutationObserver)
 
-nsSVGFilterProperty::nsSVGFilterProperty(nsSVGFilterFrame *aFilter,
-                                         nsIFrame *aFrame)
-  : mFilter(aFilter), mFrame(aFrame)
+nsSVGFilterProperty::nsSVGFilterProperty(nsIContent *aFilter,
+                                         nsIFrame *aFilteredFrame)
+  : mFrame(aFilteredFrame)
 {
-  mFilterRect = mFilter->GetInvalidationRegion(mFrame);
+  mObservedFilter = do_GetWeakReference(aFilter);
 
-  nsIFrame *filter = nsnull;
-  CallQueryInterface(mFilter, &filter);
+  nsSVGFilterFrame *filter = GetFilterFrame();
+  if (filter)
+    mFilterRect = filter->GetInvalidationRegion(mFrame);
 
-  nsCOMPtr<nsIContent> filterContent = filter->GetContent();
-  mObservedFilter = do_GetWeakReference(filterContent);
+  aFilter->AddMutationObserver(this);
+}
 
-  filterContent->AddMutationObserver(this);
+nsSVGFilterFrame *
+nsSVGFilterProperty::GetFilterFrame()
+{
+  nsCOMPtr<nsIContent> filter = do_QueryReferent(mObservedFilter);
+  if (filter) {
+    nsIFrame *frame =
+      NS_STATIC_CAST(nsGenericElement*, filter.get())->GetPrimaryFrame();
+    if (frame && frame->GetType() == nsGkAtoms::svgFilterFrame)
+      return NS_STATIC_CAST(nsSVGFilterFrame*, frame);
+  }
+
+  return nsnull;
 }
 
 void
@@ -144,8 +155,11 @@ nsSVGFilterProperty::DoUpdate()
   nsSVGOuterSVGFrame *outerSVGFrame = nsSVGUtils::GetOuterSVGFrame(mFrame);
   if (outerSVGFrame) {
     outerSVGFrame->InvalidateRect(mFilterRect);
-    mFilterRect = mFilter->GetInvalidationRegion(mFrame);
-    outerSVGFrame->InvalidateRect(mFilterRect);
+    nsSVGFilterFrame *filter = GetFilterFrame();
+    if (filter) {
+      mFilterRect = filter->GetInvalidationRegion(mFrame);
+      outerSVGFrame->InvalidateRect(mFilterRect);
+    }
   }
 }
 
@@ -776,8 +790,8 @@ AddEffectProperties(nsIFrame *aFrame)
   const nsStyleSVGReset *style = aFrame->GetStyleSVGReset();
 
   if (style->mFilter && !(aFrame->GetStateBits() & NS_STATE_SVG_FILTERED)) {
-    nsSVGFilterFrame *filter = NS_GetSVGFilterFrame(style->mFilter,
-                                                    aFrame->GetContent());
+    nsIContent *filter = NS_GetSVGFilterElement(style->mFilter,
+                                                aFrame->GetContent());
     if (filter) {
       nsSVGFilterProperty *property = new nsSVGFilterProperty(filter, aFrame);
       if (!property) {
@@ -947,7 +961,9 @@ nsSVGUtils::PaintChildWithEffects(nsSVGRenderState *aContext,
     nsSVGFilterProperty *property;
     property = NS_STATIC_CAST(nsSVGFilterProperty *,
                               aFrame->GetProperty(nsGkAtoms::filter));
-    property->GetFilterFrame()->FilterPaint(aContext, svgChildFrame);
+    nsSVGFilterFrame *filter = property->GetFilterFrame();
+    if (filter)
+      filter->FilterPaint(aContext, svgChildFrame);
   } else {
     svgChildFrame->PaintSVG(aContext, aDirtyRect);
   }