Bug 1753105 - Deal with negative letter-spacing in SVGTextFrame. r=jfkthame

Otherwise we can end up with a rect with negative width, bad stuff to follow. Differential Revision: https://phabricator.services.mozilla.com/D137881
2022-02-04 23:25:22 +00:00 · 2022-02-04 23:25:22 +00:00 · 739ada1351
--- a/layout/svg/SVGTextFrame.cpp
+++ b/layout/svg/SVGTextFrame.cpp
@ -855,6 +855,10 @@ SVGBBox TextRenderedRun::GetRunUserSpaceRect(nsPresContext* aContext,
  if (aFlags & eNoHorizontalOverflow) {
    x = 0.0;
    width = textRun->GetAdvanceWidth(range, &provider);
+    if (width < 0.0) {
+      x = width;
+      width = -width;
+    }
  } else {
    x = metrics.mBoundingBox.x;
    width = metrics.mBoundingBox.width;
--- a/testing/web-platform/tests/svg/crashtests/firefox-bug-1753105.html
+++ b/testing/web-platform/tests/svg/crashtests/firefox-bug-1753105.html
@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<script>
+  document.addEventListener("DOMContentLoaded", () => {
+    const svg = document.createElementNS("http://www.w3.org/2000/svg", "svg")
+    const text = document.createElementNS("http://www.w3.org/2000/svg", "text")
+    text.setAttribute("letter-spacing", "-37vw")
+    const node = document.createTextNode("\n\n\r7%Ù î¯•\0ó …§ð†ªã€€&**=ðŸ¯šð¯‚ï¸¡ó ”©Û¹â€Ùªv*/ð¯„ð–¹§åžçº¶*;{0ð–£”9ï¿¼Ì†ë¢»\r\n^æŽ¶ï¿ºð©¹º*|\r\nðŸ©‚Ù«ð‡½ë«»eçŠ®ã‡†á²ð¡‡‚\u2028á¨²â¤\rv+ðŸ§Œ8ï¬¬\nð¯Žè›¥ó „ˆêº¡\nâ’ð±’Ù Û¹ð–¯¸0ó ¤™/á¾‚ð«ž¾99Â a&=ð‰‚Û¹ð¯©’ã‚™2ó ¥µ^0ê’‹ð—»ð…»\0X%+0*/é•³ã€€ÙªÈºXá©¿L2â¼¤ð›ªˆÂðª¸ð›‰")
+    text.appendChild(node)
+    svg.appendChild(text)
+    document.documentElement.appendChild(svg)
+    const rect = document.documentElement.getBoundingClientRect()
+    node.convertRectFromNode(rect, svg, {})
+  })
+</script>