From 6689e321e559a89d71365b24242ddeaef711acb5 Mon Sep 17 00:00:00 2001 From: Cameron McCormack Date: Tue, 12 Feb 2013 15:21:58 +1100 Subject: [PATCH] Bug 840272 - Avoid asserting and crashing if SVG text frames are painted before they are reflowed. r=roc --- layout/svg/nsSVGTextFrame2.cpp | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/layout/svg/nsSVGTextFrame2.cpp b/layout/svg/nsSVGTextFrame2.cpp index 96e458a35156..dc64e6119ed4 100644 --- a/layout/svg/nsSVGTextFrame2.cpp +++ b/layout/svg/nsSVGTextFrame2.cpp @@ -2827,7 +2827,12 @@ nsSVGTextFrame2::BuildDisplayList(nsDisplayListBuilder* aBuilder, const nsRect& aDirtyRect, const nsDisplayListSet& aLists) { - NS_ASSERTION(!NS_SUBTREE_DIRTY(this), "reflow should have happened"); + if (NS_SUBTREE_DIRTY(this)) { + // We can sometimes be asked to paint before reflow happens and we + // have updated mPositions, etc. In this case, we just avoid + // painting. + return NS_OK; + } return aLists.Content()->AppendNewToTop( new (aBuilder) nsDisplaySVGText(aBuilder, this)); } @@ -3100,8 +3105,11 @@ nsSVGTextFrame2::PaintSVG(nsRenderingContext* aContext, // Text frames inside , , etc. will never have had // ReflowSVG called on them, so call UpdateGlyphPositioning to do this now. UpdateGlyphPositioning(true); - } else { - NS_ASSERTION(!NS_SUBTREE_DIRTY(this), "reflow should have happened"); + } else if (NS_SUBTREE_DIRTY(this)) { + // If we are asked to paint before reflow has recomputed mPositions etc. + // directly via PaintSVG, rather than via a display list, then we need + // to bail out here too. + return NS_OK; } gfxMatrix canvasTM = GetCanvasTM(FOR_PAINTING);