Bug 591141. Protect against null pattern. r=roc

--HG-- extra : rebase_source : 51658e6b24a3c2b7857e44ab5880d240aacd8115
2010-09-06 15:12:46 +12:00 · 2010-09-06 15:12:46 +12:00 · 15547ee191
--- a/layout/generic/crashtests/591141.html
+++ b/layout/generic/crashtests/591141.html
@ -0,0 +1,7 @@
+<!DOCTYPE html>
+<html>
+<body>
+<svg><pattern id="p"/></svg>
+<div style="width: 100px; height: 100px; background: -moz-element(#p);"></div>
+</body>
+</html>
--- a/layout/generic/crashtests/crashtests.list
+++ b/layout/generic/crashtests/crashtests.list
@ -333,3 +333,4 @@ load 586806-1.html
 load 586806-2.html
 load 586806-3.html
 load 586973-1.html
+load 591141.html
--- a/layout/svg/base/src/nsSVGIntegrationUtils.cpp
+++ b/layout/svg/base/src/nsSVGIntegrationUtils.cpp
@ -504,6 +504,9 @@ DrawableFromPaintServer(nsIFrame*         aFrame,
    nsRefPtr<gfxPattern> pattern =
      server->GetPaintServerPattern(aTarget, 1.0, &overrideBounds);

+    if (!pattern)
+      return nsnull;
+
    // pattern is now set up to fill aPaintServerSize. But we want it to
    // fill aRenderSize, so we need to add a scaling transform.
    // We couldn't just have set overrideBounds to aRenderSize - it would have
@ -547,6 +550,8 @@ nsSVGIntegrationUtils::DrawPaintServer(nsIRenderingContext* aRenderingContext,
  nsRefPtr<gfxDrawable> drawable =
    DrawableFromPaintServer(aPaintServer, aTarget, aPaintServerSize, imageSize);

-  nsLayoutUtils::DrawPixelSnapped(aRenderingContext, drawable, aFilter,
-                                  aDest, aFill, aAnchor, aDirty);
+  if (drawable) {
+    nsLayoutUtils::DrawPixelSnapped(aRenderingContext, drawable, aFilter,
+                                    aDest, aFill, aAnchor, aDirty);
+  }
 }