Bug 510202 - xlink:title should only work on links. r=dao,sr=bzbarsky

browser/base/content/browser.js

@@ -2673,7 +2673,12 @@ function FillInHTMLTooltip(tipElement)
   while (!titleText && !XLinkTitleText && !SVGTitleText && tipElement) {
     if (tipElement.nodeType == Node.ELEMENT_NODE) {
       titleText = tipElement.getAttribute("title");
-      XLinkTitleText = tipElement.getAttributeNS(XLinkNS, "title");
+      if ((tipElement instanceof HTMLAnchorElement && tipElement.href) ||
+          (tipElement instanceof HTMLAreaElement && tipElement.href) ||
+          (tipElement instanceof HTMLLinkElement && tipElement.href) ||
+          (tipElement instanceof SVGAElement && tipElement.hasAttributeNS(XLinkNS, "href"))) {
+        XLinkTitleText = tipElement.getAttributeNS(XLinkNS, "title");
+      }
       if (tipElement instanceof SVGElement) {
         let length = tipElement.childNodes.length;
         for (let i = 0; i < length; i++) {

browser/base/content/test/browser_bug329212.js

@@ -26,6 +26,8 @@ function test () {
     ok(FillInHTMLTooltip(doc.getElementById("link4"), "should get title"));
     is(tooltip.getAttribute("label"), "This is an xlink:title attribute");
 
+    ok(!FillInHTMLTooltip(doc.getElementById("text5"), "should not get title"));
+
     gBrowser.removeCurrentTab();
     finish();
   }, true);

browser/base/content/test/title_test.svg

@@ -42,4 +42,8 @@
       This link contains xlink:title attr.
     </text>
   </a>
+  <text id="text5" x="10px" y="160px" font-size="24px"
+        xlink:title="This is an xlink:title attribute but it isn't on a link" >
+    This contains nothing.
+  </text>
 </svg>

embedding/browser/webBrowser/nsDocShellTreeOwner.cpp

@@ -68,7 +68,11 @@
 #include "nsIDOMDocument.h"
 #include "nsIDOMDocumentType.h"
 #include "nsIDOMElement.h"
+#include "nsIDOMHTMLAnchorElement.h"
+#include "nsIDOMHTMLAreaElement.h"
+#include "nsIDOMHTMLLinkElement.h"
 #ifdef MOZ_SVG
+#include "nsIDOMSVGAElement.h"
 #include "nsIDOMSVGElement.h"
 #include "nsIDOMSVGTitleElement.h"
 #endif
@@ -1011,9 +1015,26 @@ DefaultTooltipTextProvider::GetNodeText(nsIDOMNode *aNode, PRUnichar **aText,
             found = PR_TRUE;
           else {
             // ...ok, that didn't work, try it in the XLink namespace
-            currElement->GetAttributeNS(NS_LITERAL_STRING("http://www.w3.org/1999/xlink"), NS_LITERAL_STRING("title"), outText);
-            if ( outText.Length() )
-              found = PR_TRUE;
+            NS_NAMED_LITERAL_STRING(xlinkNS, "http://www.w3.org/1999/xlink");
+            nsCOMPtr<nsIDOMHTMLAnchorElement> anchorContent(do_QueryInterface(currElement));
+            nsCOMPtr<nsIDOMHTMLAreaElement> areaContent(do_QueryInterface(currElement));
+            nsCOMPtr<nsIDOMHTMLLinkElement> linkContent(do_QueryInterface(currElement));
+            PRBool hasHref;
+            currElement->HasAttribute(NS_LITERAL_STRING("href"), &hasHref);
+#ifdef MOZ_SVG
+            nsCOMPtr<nsIDOMSVGAElement> svgAnchorContent(do_QueryInterface(currElement));
+            PRBool hasXlinkHref;
+            currElement->HasAttributeNS(xlinkNS, NS_LITERAL_STRING("href"), &hasXlinkHref);
+
+            if (((anchorContent || areaContent || linkContent) && hasHref) ||
+                (svgAnchorContent && hasXlinkHref)) {
+#else
+            if ((anchorContent || areaContent || linkContent) && hasHref) {
+#endif
+              currElement->GetAttributeNS(xlinkNS, NS_LITERAL_STRING("title"), outText);
+              if ( outText.Length() )
+                found = PR_TRUE;
+            }
 #ifdef MOZ_SVG
             else {
               nsCOMPtr<nsIDOMSVGElement> svgContent(do_QueryInterface(currElement));