Bug 499543: handle total transparency in LegacyRGBToHex. r+sr=bzbarsky

content/base/src/nsAttrValue.cpp

@@ -393,8 +393,10 @@ nsAttrValue::ToString(nsAString& aResult) const
         PR_snprintf(buf, sizeof(buf), "#%02x%02x%02x",
                     NS_GET_R(v), NS_GET_G(v), NS_GET_B(v));
         CopyASCIItoUTF16(buf, aResult);
+      } else if (v == NS_RGBA(0,0,0,0)) {
+        aResult.AssignLiteral("transparent");
       } else {
-        NS_NOTREACHED("non-opaque color attribute cannot be stringified");
+        NS_NOTREACHED("translucent color attribute cannot be stringified");
         aResult.Truncate();
       }
       break;

content/html/document/crashtests/495543.svg

@@ -0,0 +1,16 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+<script type="text/javascript">
+
+function boom()
+{
+  var htmlBody = document.createElementNS("http://www.w3.org/1999/xhtml", "body");
+  document.documentElement.appendChild(htmlBody);
+  htmlBody.setAttribute('vlink', "transparent");
+  document.height;
+  document.vlinkColor;
+}
+
+window.addEventListener("load", boom, false);
+</script>
+
+</svg>

content/html/document/crashtests/crashtests.list

@@ -8,3 +8,4 @@ load 448564.html
 load 468562-1.html
 load 468562-2.html
 load 494225.html
+load 495543.svg

content/html/document/src/nsHTMLDocument.cpp

@@ -2401,8 +2401,10 @@ LegacyRGBToHex(nscolor aColor, nsAString& aResult)
     PR_snprintf(buf, sizeof(buf), "#%02x%02x%02x",
                 NS_GET_R(aColor), NS_GET_G(aColor), NS_GET_B(aColor));
     CopyASCIItoUTF16(buf, aResult);
+  } else if (aColor == NS_RGBA(0,0,0,0)) {
+    aResult.AssignLiteral("transparent");
   } else {
-    NS_NOTREACHED("non-opaque color property cannot be stringified");
+    NS_NOTREACHED("translucent color property cannot be stringified");
     aResult.Truncate();
   }
 }