Bug 428228. Removing element from SVG <svg> crashes. r=longsonr, sr=roc, a=beltzner

2008-04-15 08:31:06 +00:00 · 2008-04-15 08:31:06 +00:00 · 7a4597b0b1
--- a/content/svg/content/src/crashtests/428228-1.svg
+++ b/content/svg/content/src/crashtests/428228-1.svg
@ -0,0 +1,17 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:svg="http://www.w3.org/2000/svg">
+<head>
+<script type="text/javascript">
+
+// Test that removing a direct child element of an SVG <svg> doesnt' crash:
+
+function boom()
+{
+  document.getElementById("s").removeChild(document.getElementById("r"));
+}
+
+</script>
+</head>
+
+<body onload="boom();">&#x06C0;<svg:svg id="s"><svg:rect id="r"/></svg:svg></body>
+
+</html>
--- a/content/svg/content/src/crashtests/crashtests.list
+++ b/content/svg/content/src/crashtests/crashtests.list
@ -33,4 +33,5 @@ load 410659-2.svg
 load 410659-3.svg
 load 412104-1.svg
 load 414188-1.svg
+load 428228-1.svg
 load 428841-1.svg
--- a/layout/svg/base/src/nsSVGUtils.cpp
+++ b/layout/svg/base/src/nsSVGUtils.cpp
@ -923,6 +923,11 @@ nsSVGUtils::UpdateGraphic(nsISVGChildFrame *aSVGFrame)
 void
 nsSVGUtils::NotifyAncestorsOfFilterRegionChange(nsIFrame *aFrame)
 {
+  if (aFrame->GetStateBits() & NS_STATE_IS_OUTER_SVG) {
+    // It would be better if we couldn't get here
+    return;
+  }
+
  aFrame = aFrame->GetParent();

  while (aFrame) {