Bug 492186 - Crash with altGlyphDef and getBBox. r=roc

layout/svg/base/src/nsSVGContainerFrame.cpp

@@ -272,8 +272,11 @@ nsSVGDisplayContainerFrame::GetBBoxContribution(const gfxMatrix &aToBBoxUserspac
       gfxMatrix transform = aToBBoxUserspace;
       // nsSVGGlyphFrame's mContent is a nsTextNode!
       if (kid->GetType() != nsGkAtoms::svgGlyphFrame) {
-        transform = static_cast<nsSVGElement*>(kid->GetContent())->
-                      PrependLocalTransformTo(aToBBoxUserspace);
+        nsIContent *content = kid->GetContent();
+        if (content->IsNodeOfType(nsINode::eSVG)) {
+          transform = static_cast<nsSVGElement*>(content)->
+                        PrependLocalTransformTo(aToBBoxUserspace);
+        }
       }
       bboxUnion = bboxUnion.Union(svgKid->GetBBoxContribution(transform));
     }

layout/svg/base/src/nsSVGSwitchFrame.cpp

@@ -189,8 +189,12 @@ nsSVGSwitchFrame::GetBBoxContribution(const gfxMatrix &aToBBoxUserspace)
   nsIFrame* kid = GetActiveChildFrame();
   nsISVGChildFrame* svgKid = do_QueryFrame(kid);
   if (svgKid) {
-    gfxMatrix transform = static_cast<nsSVGElement*>(kid->GetContent())->
-                            PrependLocalTransformTo(aToBBoxUserspace);
+    nsIContent *content = kid->GetContent();
+    gfxMatrix transform = aToBBoxUserspace;
+    if (content->IsNodeOfType(nsINode::eSVG)) {
+      transform = static_cast<nsSVGElement*>(content)->
+                    PrependLocalTransformTo(aToBBoxUserspace);
+    }
     return svgKid->GetBBoxContribution(transform);
   }
   return gfxRect(0.0, 0.0, 0.0, 0.0);

layout/svg/crashtests/492186-1.svg

@@ -0,0 +1,6 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+<altGlyphDef/>
+<script xmlns="http://www.w3.org/1999/xhtml">
+document.documentElement.getBBox();
+</script>
+</svg>

layout/svg/crashtests/crashtests.list

@@ -73,4 +73,5 @@ load 472782-1.svg
 load 475181-1.svg
 load 475193-1.html
 load 478128-1.svg
+load 492186-1.svg
 load extref-test-1.xhtml