From 96ace2bad13cc4463c6cd2b15e9e5f43a7ea9fe9 Mon Sep 17 00:00:00 2001
From: Robert Longson <longsonr@gmail.com>
Date: Fri, 9 Jun 2023 02:26:38 +0000
Subject: [PATCH] Bug 1837487 - stop asserting when Q units are used r=emilio

Differential Revision: https://phabricator.services.mozilla.com/D180384
---
 dom/svg/SVGElement.cpp             |  4 +--
 dom/svg/SVGGeometryProperty.cpp    | 37 ---------------------------
 dom/svg/SVGLength.cpp              | 41 ++++++++++++++++++++++++++++++
 dom/svg/SVGLength.h                |  4 +++
 dom/svg/crashtests/1837487.html    |  3 +++
 dom/svg/crashtests/crashtests.list |  1 +
 6 files changed, 51 insertions(+), 39 deletions(-)
 create mode 100644 dom/svg/crashtests/1837487.html

diff --git a/dom/svg/SVGElement.cpp b/dom/svg/SVGElement.cpp
index db059f8ae948..3073ecda4fe4 100644
--- a/dom/svg/SVGElement.cpp
+++ b/dom/svg/SVGElement.cpp
@@ -1061,8 +1061,8 @@ bool SVGElement::UpdateDeclarationBlockFromLength(
     return false;
   }
 
-  nsCSSUnit cssUnit = SVGGeometryProperty::SpecifiedUnitTypeToCSSUnit(
-      aLength.GetSpecifiedUnitType());
+  nsCSSUnit cssUnit =
+      SVGLength::SpecifiedUnitTypeToCSSUnit(aLength.GetSpecifiedUnitType());
 
   if (cssUnit == eCSSUnit_Percent) {
     Servo_DeclarationBlock_SetPercentValue(aBlock.Raw(), aPropId,
diff --git a/dom/svg/SVGGeometryProperty.cpp b/dom/svg/SVGGeometryProperty.cpp
index 7b58221b8d4a..79c87df470a1 100644
--- a/dom/svg/SVGGeometryProperty.cpp
+++ b/dom/svg/SVGGeometryProperty.cpp
@@ -11,46 +11,9 @@
 #include "SVGImageElement.h"
 #include "SVGRectElement.h"
 #include "SVGUseElement.h"
-#include "nsCSSValue.h"
 
 namespace mozilla::dom::SVGGeometryProperty {
 
-nsCSSUnit SpecifiedUnitTypeToCSSUnit(uint8_t aSpecifiedUnit) {
-  switch (aSpecifiedUnit) {
-    case SVGLength_Binding::SVG_LENGTHTYPE_NUMBER:
-    case SVGLength_Binding::SVG_LENGTHTYPE_PX:
-      return nsCSSUnit::eCSSUnit_Pixel;
-
-    case SVGLength_Binding::SVG_LENGTHTYPE_MM:
-      return nsCSSUnit::eCSSUnit_Millimeter;
-
-    case SVGLength_Binding::SVG_LENGTHTYPE_CM:
-      return nsCSSUnit::eCSSUnit_Centimeter;
-
-    case SVGLength_Binding::SVG_LENGTHTYPE_IN:
-      return nsCSSUnit::eCSSUnit_Inch;
-
-    case SVGLength_Binding::SVG_LENGTHTYPE_PT:
-      return nsCSSUnit::eCSSUnit_Point;
-
-    case SVGLength_Binding::SVG_LENGTHTYPE_PC:
-      return nsCSSUnit::eCSSUnit_Pica;
-
-    case SVGLength_Binding::SVG_LENGTHTYPE_PERCENTAGE:
-      return nsCSSUnit::eCSSUnit_Percent;
-
-    case SVGLength_Binding::SVG_LENGTHTYPE_EMS:
-      return nsCSSUnit::eCSSUnit_EM;
-
-    case SVGLength_Binding::SVG_LENGTHTYPE_EXS:
-      return nsCSSUnit::eCSSUnit_XHeight;
-
-    default:
-      MOZ_ASSERT_UNREACHABLE("Unknown unit type");
-      return nsCSSUnit::eCSSUnit_Pixel;
-  }
-}
-
 nsCSSPropertyID AttrEnumToCSSPropId(const SVGElement* aElement,
                                     uint8_t aAttrEnum) {
   // This is a very trivial function only applied to a few elements,
diff --git a/dom/svg/SVGLength.cpp b/dom/svg/SVGLength.cpp
index efe3c5178593..77ce3b748162 100644
--- a/dom/svg/SVGLength.cpp
+++ b/dom/svg/SVGLength.cpp
@@ -9,6 +9,7 @@
 #include "mozilla/ArrayUtils.h"
 #include "mozilla/dom/SVGElement.h"
 #include "mozilla/dom/SVGSVGElement.h"
+#include "nsCSSValue.h"
 #include "nsTextFormatter.h"
 #include "SVGContentUtils.h"
 #include <limits>
@@ -169,6 +170,46 @@ float SVGLength::GetPixelsPerUnit(const UserSpaceMetrics& aMetrics,
   }
 }
 
+/* static */
+nsCSSUnit SVGLength::SpecifiedUnitTypeToCSSUnit(uint8_t aSpecifiedUnit) {
+  switch (aSpecifiedUnit) {
+    case SVG_LENGTHTYPE_NUMBER:
+    case SVG_LENGTHTYPE_PX:
+      return nsCSSUnit::eCSSUnit_Pixel;
+
+    case SVG_LENGTHTYPE_MM:
+      return nsCSSUnit::eCSSUnit_Millimeter;
+
+    case SVG_LENGTHTYPE_CM:
+      return nsCSSUnit::eCSSUnit_Centimeter;
+
+    case SVG_LENGTHTYPE_IN:
+      return nsCSSUnit::eCSSUnit_Inch;
+
+    case SVG_LENGTHTYPE_PT:
+      return nsCSSUnit::eCSSUnit_Point;
+
+    case SVG_LENGTHTYPE_PC:
+      return nsCSSUnit::eCSSUnit_Pica;
+
+    case SVG_LENGTHTYPE_PERCENTAGE:
+      return nsCSSUnit::eCSSUnit_Percent;
+
+    case SVG_LENGTHTYPE_EMS:
+      return nsCSSUnit::eCSSUnit_EM;
+
+    case SVG_LENGTHTYPE_EXS:
+      return nsCSSUnit::eCSSUnit_XHeight;
+
+    case SVG_LENGTHTYPE_Q:
+      return nsCSSUnit::eCSSUnit_Quarter;
+
+    default:
+      MOZ_ASSERT_UNREACHABLE("Unknown unit type");
+      return nsCSSUnit::eCSSUnit_Pixel;
+  }
+}
+
 /* static */
 void SVGLength::GetUnitString(nsAString& aUnit, uint16_t aUnitType) {
   switch (aUnitType) {
diff --git a/dom/svg/SVGLength.h b/dom/svg/SVGLength.h
index a777f058fdeb..a16a43d2d671 100644
--- a/dom/svg/SVGLength.h
+++ b/dom/svg/SVGLength.h
@@ -13,6 +13,8 @@
 #include "mozilla/dom/SVGAnimatedLength.h"
 #include "mozilla/dom/SVGLengthBinding.h"
 
+enum nsCSSUnit : uint32_t;
+
 namespace mozilla {
 
 namespace dom {
@@ -109,6 +111,8 @@ class SVGLength {
 
   static float GetAbsUnitsPerAbsUnit(uint8_t aUnits, uint8_t aPerUnit);
 
+  static nsCSSUnit SpecifiedUnitTypeToCSSUnit(uint8_t aSpecifiedUnit);
+
   static void GetUnitString(nsAString& aUnit, uint16_t aUnitType);
 
   static uint16_t GetUnitTypeForString(const nsAString& aUnit);
diff --git a/dom/svg/crashtests/1837487.html b/dom/svg/crashtests/1837487.html
new file mode 100644
index 000000000000..576dfb996bbc
--- /dev/null
+++ b/dom/svg/crashtests/1837487.html
@@ -0,0 +1,3 @@
+<svg>
+<ellipse cx='5.0q'/>
+
diff --git a/dom/svg/crashtests/crashtests.list b/dom/svg/crashtests/crashtests.list
index cf645ebd5799..87ef0c6f98fc 100644
--- a/dom/svg/crashtests/crashtests.list
+++ b/dom/svg/crashtests/crashtests.list
@@ -97,3 +97,4 @@ load 1560179.html
 load 1572904.html
 load 1683907.html
 pref(dom.svg.pathSeg.enabled,true) load 1715387.html
+load 1837487.html