From 739ada1351ac3dde6cf77f19bf567b2600881690 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Emilio=20Cobos=20=C3=81lvarez?= Date: Fri, 4 Feb 2022 23:25:22 +0000 Subject: [PATCH] Bug 1753105 - Deal with negative letter-spacing in SVGTextFrame. r=jfkthame Otherwise we can end up with a rect with negative width, bad stuff to follow. Differential Revision: https://phabricator.services.mozilla.com/D137881 --- layout/svg/SVGTextFrame.cpp | 4 ++++ .../tests/svg/crashtests/firefox-bug-1753105.html | 14 ++++++++++++++ 2 files changed, 18 insertions(+) create mode 100644 testing/web-platform/tests/svg/crashtests/firefox-bug-1753105.html diff --git a/layout/svg/SVGTextFrame.cpp b/layout/svg/SVGTextFrame.cpp index efc490ad47b0..ce89c3323633 100644 --- a/layout/svg/SVGTextFrame.cpp +++ b/layout/svg/SVGTextFrame.cpp @@ -855,6 +855,10 @@ SVGBBox TextRenderedRun::GetRunUserSpaceRect(nsPresContext* aContext, if (aFlags & eNoHorizontalOverflow) { x = 0.0; width = textRun->GetAdvanceWidth(range, &provider); + if (width < 0.0) { + x = width; + width = -width; + } } else { x = metrics.mBoundingBox.x; width = metrics.mBoundingBox.width; diff --git a/testing/web-platform/tests/svg/crashtests/firefox-bug-1753105.html b/testing/web-platform/tests/svg/crashtests/firefox-bug-1753105.html new file mode 100644 index 000000000000..3105c577beac --- /dev/null +++ b/testing/web-platform/tests/svg/crashtests/firefox-bug-1753105.html @@ -0,0 +1,14 @@ + +