Bug 1908625 - SVG image elements should update if their href is removed r=emilio

Differential Revision: https://phabricator.services.mozilla.com/D217040

dom/svg/SVGFEImageElement.cpp

@@ -121,7 +121,13 @@ void SVGFEImageElement::AfterSetAttr(int32_t aNamespaceID, nsAtom* aName,
                                      bool aNotify) {
   if (aName == nsGkAtoms::href && (aNamespaceID == kNameSpaceID_XLink ||
                                    aNamespaceID == kNameSpaceID_None)) {
-    if (aValue) {
+    if (aNamespaceID == kNameSpaceID_XLink &&
+        mStringAttributes[HREF].IsExplicitlySet()) {
+      // href overrides xlink:href
+      return;
+    }
+    if (aValue || (aNamespaceID == kNameSpaceID_None &&
+                   mStringAttributes[XLINK_HREF].IsExplicitlySet())) {
       if (ShouldLoadImage()) {
         LoadSVGImage(true, aNotify);
       }

dom/svg/SVGImageElement.cpp

@@ -210,7 +210,13 @@ void SVGImageElement::AfterSetAttr(int32_t aNamespaceID, nsAtom* aName,
                                    bool aNotify) {
   if (aName == nsGkAtoms::href && (aNamespaceID == kNameSpaceID_None ||
                                    aNamespaceID == kNameSpaceID_XLink)) {
-    if (aValue) {
+    if (aNamespaceID == kNameSpaceID_XLink &&
+        mStringAttributes[HREF].IsExplicitlySet()) {
+      // href overrides xlink:href
+      return;
+    }
+    if (aValue || (aNamespaceID == kNameSpaceID_None &&
+                   mStringAttributes[XLINK_HREF].IsExplicitlySet())) {
       if (ShouldLoadImage()) {
         LoadSVGImage(true, aNotify);
       }

layout/svg/SVGImageFrame.cpp

@@ -190,6 +190,17 @@ nsresult SVGImageFrame::AttributeChanged(int32_t aNameSpaceID,
       return NS_OK;
     }
   }
+  if (aModType == dom::MutationEvent_Binding::REMOVAL &&
+      (aNameSpaceID == kNameSpaceID_None ||
+       aNameSpaceID == kNameSpaceID_XLink) &&
+      aAttribute == nsGkAtoms::href) {
+    auto* element = static_cast<SVGImageElement*>(GetContent());
+    if (aNameSpaceID == kNameSpaceID_None ||
+        !element->mStringAttributes[SVGImageElement::HREF].IsExplicitlySet()) {
+      mImageContainer = nullptr;
+      InvalidateFrame();
+    }
+  }
 
   return NS_OK;
 }

testing/web-platform/tests/svg/embedded/image-remove-href-1.svg

@@ -0,0 +1,17 @@
+<svg xmlns="http://www.w3.org/2000/svg"
+     xmlns:h="http://www.w3.org/1999/xhtml" viewBox="0 0 3 3" width="200" height="200" class="reftest-wait">
+  <metadata>
+    <title>removing href from an SVG image</title>
+    <h:link rel="match" href="reference/green-rect-100x100.svg"/>
+  </metadata>
+  <script href="/common/reftest-wait.js"></script>
+  <script href="/common/rendering-utils.js"></script>
+  <rect width='1.5' height='1.5' fill='green'/>
+  <image href="data:image/svg+xml,&lt;svg xmlns='http://www.w3.org/2000/svg' width='50' height='50' &gt;&lt;rect width='50' height='50' fill='red'/&gt;&lt;/svg&gt;" width="1.5" onload="test()"/>
+  <script>
+    function test() {
+      document.querySelector('image').removeAttribute('href');
+      waitForAtLeastOneFrame().then(takeScreenshot);
+    }
+  </script>
+</svg>

testing/web-platform/tests/svg/embedded/image-remove-href-2.svg

@@ -0,0 +1,17 @@
+<svg xmlns="http://www.w3.org/2000/svg"
+     xmlns:xlink="http://www.w3.org/1999/xlink"
+     xmlns:h="http://www.w3.org/1999/xhtml" viewBox="0 0 3 3" width="200" height="200" class="reftest-wait">
+  <metadata>
+    <title>removing href from an SVG image that has an xlink:href</title>
+    <h:link rel="match" href="reference/green-rect-100x100.svg"/>
+  </metadata>
+  <script href="/common/reftest-wait.js"></script>
+  <script href="/common/rendering-utils.js"></script>
+  <image href="data:image/svg+xml,&lt;svg xmlns='http://www.w3.org/2000/svg' width='50' height='50' &gt;&lt;rect width='50' height='50' fill='red'/&gt;&lt;/svg&gt;" xlink:href="data:image/svg+xml,&lt;svg xmlns='http://www.w3.org/2000/svg' xmlns:xlink='http://www.w3.org/1999/xlink' width='50' height='50' &gt;&lt;rect width='50' height='50' fill='green'/&gt;&lt;/svg&gt;" width="1.5" onload="test()"/>
+  <script>
+    function test() {
+      document.querySelector('image').removeAttribute('href');
+      waitForAtLeastOneFrame().then(takeScreenshot);
+    }
+  </script>
+</svg>