Bug 761507 - Fix issues with adoptNode and conditional processing. r=dholbert

content/svg/content/src/DOMSVGTests.cpp

@@ -269,7 +269,8 @@ DOMSVGTests::GetOrCreateStringListAttribute(PRUint8 aAttrEnum) const
   stringListPtr->SetIsCommaSeparated(aAttrEnum == LANGUAGE);
   nsresult rv = element->SetProperty(attrName,
                                      stringListPtr,
-                                     ReleaseStringListPropertyValue);
+                                     ReleaseStringListPropertyValue,
+                                     true);
   NS_ABORT_IF_FALSE(rv != NS_PROPTABLE_PROP_OVERWRITTEN,
                     "Setting property value when it's already set...?"); 
 

content/svg/content/src/crashtests/761507-1.svg

@@ -0,0 +1,18 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+<script>
+<![CDATA[
+
+function boom()
+{
+  var r = document.createElementNS("http://www.w3.org/2000/svg", "rect");
+  var f = r.requiredFeatures;
+  f.appendItem(1);
+  document.implementation.createDocument('', '', null).adoptNode(r);
+  r.getAttribute("requiredFeatures");
+}
+
+window.addEventListener("load", boom, false);
+
+]]>
+</script>
+</svg>

content/svg/content/src/crashtests/crashtests.list

@@ -60,3 +60,4 @@ load 613899-2.svg
 load zero-size-image.svg
 load 723441-1.html
 load 751515-1.svg
+load 761507-1.svg

content/svg/content/src/nsSVGSVGElement.cpp

@@ -1275,7 +1275,8 @@ nsSVGSVGElement::
   SVGPreserveAspectRatio* pAROverridePtr = new SVGPreserveAspectRatio(aPAR);
   nsresult rv = SetProperty(nsGkAtoms::overridePreserveAspectRatio,
                             pAROverridePtr,
-                            ReleasePreserveAspectRatioPropertyValue);
+                            ReleasePreserveAspectRatioPropertyValue,
+                            true);
   NS_ABORT_IF_FALSE(rv != NS_PROPTABLE_PROP_OVERWRITTEN,
                     "Setting override value when it's already set...?"); 
 
@@ -1387,7 +1388,8 @@ nsSVGSVGElement::SetViewBoxProperty(const nsSVGViewBoxRect& aViewBox)
   nsSVGViewBoxRect* pViewBoxOverridePtr = new nsSVGViewBoxRect(aViewBox);
   nsresult rv = SetProperty(nsGkAtoms::viewBox,
                             pViewBoxOverridePtr,
-                            ReleaseViewBoxPropertyValue);
+                            ReleaseViewBoxPropertyValue,
+                            true);
   NS_ABORT_IF_FALSE(rv != NS_PROPTABLE_PROP_OVERWRITTEN,
                     "Setting override value when it's already set...?"); 
 
@@ -1420,7 +1422,9 @@ nsSVGSVGElement::ClearViewBoxProperty()
 bool
 nsSVGSVGElement::SetZoomAndPanProperty(PRUint16 aValue)
 {
-  nsresult rv = SetProperty(nsGkAtoms::zoomAndPan, reinterpret_cast<void*>(aValue));
+  nsresult rv = SetProperty(nsGkAtoms::zoomAndPan,
+                            reinterpret_cast<void*>(aValue),
+                            nsnull, true);
   NS_ABORT_IF_FALSE(rv != NS_PROPTABLE_PROP_OVERWRITTEN,
                     "Setting override value when it's already set...?");