Fixing bug 336471. Crash [@ nsSVGForeignObjectFrame::GetTMIncludingOffset]. r+sr=tor@acm.org

layout/svg/base/src/nsSVGForeignObjectFrame.cpp

@@ -473,11 +473,13 @@ nsSVGForeignObjectFrame::GetTMIncludingOffset()
   nsCOMPtr<nsIDOMSVGMatrix> ctm = GetCanvasTM();
   if (!ctm)
     return nsnull;
-  float svgX, svgY;
-  mX->GetValue(&svgX);
-  mY->GetValue(&svgY);
+
+  nsSVGForeignObjectElement *fO =
+    NS_STATIC_CAST(nsSVGForeignObjectElement*, mContent);
+  float x, y;
+  fO->GetAnimatedLengthValues(&x, &y, nsnull);
   nsIDOMSVGMatrix* matrix;
-  ctm->Translate(svgX, svgY, &matrix);
+  ctm->Translate(x, y, &matrix);
   return matrix;
 }
 

layout/svg/base/src/nsSVGForeignObjectFrame.h

@@ -152,10 +152,6 @@ protected:
   already_AddRefed<nsIDOMSVGMatrix> GetTMIncludingOffset();
   nsresult TransformPointFromOuterPx(float aX, float aY, nsPoint* aOut);
 
-  nsCOMPtr<nsIDOMSVGLength> mX;
-  nsCOMPtr<nsIDOMSVGLength> mY;
-  nsCOMPtr<nsIDOMSVGLength> mWidth;
-  nsCOMPtr<nsIDOMSVGLength> mHeight;
   nsCOMPtr<nsIDOMSVGMatrix> mCanvasTM;
   nsCOMPtr<nsIDOMSVGMatrix>    mOverrideCTM;