gecko-dev/dom/svg/crashtests
Emilio Cobos Álvarez a1f03332c2 Bug 1486488 - Don't assume that SVGAnimationElement has a parent on bind. r=dholbert
This is a regression from bug 1450250, which removed a if (!GetCx()) early
return in this function.

That early return was wrong, both because it prevented elements that were in
shadow trees from targeting other elements, but also because that check was not
present in AfterSetAttr, which means that dynamic updates to the attribute would
work.

Pass the SVGAnimationElement itself to resolve references. That's what we do for
attribute mutations, and also it's the same behavior we have, since the ID
lookup IDTracker does only depends on containing shadow root and containing
document, and that's invariant between a kid and it's DOM parent.

Some other code has been updated to take references instead of pointers so the
null-safety of those methods is explicit.

Differential Revision: https://phabricator.services.mozilla.com/D4349

--HG--
extra : moz-landing-system : lando
2018-08-28 09:06:08 +00:00
..
307322-1.svg
327705-1.svg
336994-1.html
344888-1.svg
345445-1.svg
360836-1.svg
369051-1.svg
369291-1.svg
369291-2.svg
369568-1.svg
374882-1.svg
380101-1.svg
381777-1.svg
383685-1.svg
385096.html
385554-1.html
385554-2.xul
388712-1.svg
395616-1.html
396618-1.html
397017-1.html
397551-1.svg
397704-1.svg
398926-both-different.svg
398926-both-same.svg
398926-fill.svg
398926-stroke.svg
405639-1.svg
406361-1.html
409811-1.html
410659-1.svg
410659-2.svg
410659-3.svg
412104-1.svg
413174-1.svg
414188-1.svg
427325-1.svg
428228-1.svg
428841-1.svg
436418-mpathRoot-1.svg
448244-1.svg
466576-1.xhtml
499879-1.svg
535691-1.svg
539167-1.svg
573316-1.svg
579356-1.svg
579356-2.svg
595608-1.svg
601251-1.html
601406-1.svg
603145-1.svg
613899-1.svg
613899-2.svg
719779-1.svg
723441-1.html
723441-resource.svg
751515-1.svg
761507-1.svg
831561.html
837450-1.svg
842463-1.html
847138-1.svg
864509.svg
898915-1.svg
1035248-1.svg
1035248-2.svg
1244898-1.xhtml
1250725.html Bug 1331081 - script generated patch to omit addEventListener/removeEventListener's third parameter when it's false, r=jaws. 2017-01-17 11:50:25 +01:00
1267272-1.svg Bug 1267272 - NULL pointer mozilla::dom::SVGSVGElement::GetIntrinsicHeight. r=seth 2016-05-08 11:17:46 +01:00
1282985-1.svg bug 1282985, don't try to notify about page load of already stopped page, r=khuey 2016-06-30 13:04:01 +03:00
1322286.html Bug 1322286 - Part 2. Crash test. r=mstange 2016-12-06 16:13:22 -10:00
1329093-1.html Bug 1329093 - Part 4: stylo: Delay SVG mapped attr resolution till later; r=bz 2017-03-09 17:46:26 -08:00
1329093-2.html Bug 1329093 - Part 4: stylo: Delay SVG mapped attr resolution till later; r=bz 2017-03-09 17:46:26 -08:00
1329849-1.svg Bug 1329849 - Add crash tests. r=dholbert 2017-01-19 21:08:05 +08:00
1329849-2.svg Bug 1329849 - Add crash tests. r=dholbert 2017-01-19 21:08:05 +08:00
1329849-3.svg Bug 1329849 - Add crash tests. r=dholbert 2017-01-19 21:08:05 +08:00
1329849-4.svg Bug 1329849 - Add crash tests. r=dholbert 2017-01-19 21:08:05 +08:00
1329849-5.svg Bug 1329849 - Add crash tests. r=dholbert 2017-01-19 21:08:05 +08:00
1329849-6.svg Bug 1329849 - Add crash tests. r=dholbert 2017-01-19 21:08:05 +08:00
1343147.svg Bug 1343147 - Part 2. A crash test of painting elements with both perspective and transform in generate text mask for background-clip:text. r=mstange 2017-09-08 14:24:17 +08:00
1347617-1.svg Bug 1347617 - Add crash tests. r=dholbert 2017-09-25 13:35:14 +08:00
1347617-2.svg Bug 1347617 - Add crash tests. r=dholbert 2017-09-25 13:35:14 +08:00
1347617-3.svg Bug 1347617 - Add crash tests. r=dholbert 2017-09-25 13:35:14 +08:00
1402798.html Bug 1402798 - Part 2. Add a crash test for applying fill:url() property to an SVG text element. r=longsonr+218550 2017-09-26 14:56:25 +08:00
1419250-1.html Bug 1419250 - check for division by zero in length conversions and fail the conversion in such cases r=dholbert 2017-12-30 17:07:27 +00:00
1420492.html Bug 1420492 - avoid division by zero when constructing an nsSVGArcConverter r=dholbert 2017-12-10 22:43:23 +00:00
1477853.html Bug 1477853: Don't assume that SVGAnimationElement has a parent on bind. r=heycam 2018-07-24 12:36:45 +02:00
1486488.html Bug 1486488 - Don't assume that SVGAnimationElement has a parent on bind. r=dholbert 2018-08-28 09:06:08 +00:00
crashtests.list Bug 1486488 - Don't assume that SVGAnimationElement has a parent on bind. r=dholbert 2018-08-28 09:06:08 +00:00
invalid-image.svg Bug 1267272 - NULL pointer mozilla::dom::SVGSVGElement::GetIntrinsicHeight. r=seth 2016-05-08 11:17:46 +01:00
long-clipPath-reference-chain.svg Bug 1253590, part 3 - Crashtest for long clipPath reference chains. r=longsonr 2016-03-12 18:22:33 +00:00
zero-size-image.svg