Bug 655025 - Fix zippity graph. r=dholbert

layout/svg/base/src/nsISVGGlyphFragmentLeaf.h

@@ -87,6 +87,7 @@ public:
                                        nsTArray<float> &aRotate)=0;
   NS_IMETHOD_(PRUint16) GetTextAnchor()=0;
   NS_IMETHOD_(PRBool) IsAbsolutelyPositioned()=0;
+  NS_IMETHOD_(PRBool) IsEmpty() const=0;
   NS_IMETHOD_(void) SetTrimLeadingWhitespace(PRBool aTrimLeadingWhitespace)=0;
   NS_IMETHOD_(void) SetTrimTrailingWhitespace(PRBool aTrimTrailingWhitespace)=0;
   NS_IMETHOD_(PRBool) EndsWithWhitespace() const=0;

layout/svg/base/src/nsSVGGlyphFrame.cpp

@@ -692,7 +692,7 @@ nsSVGGlyphFrame::GetCharacterPositions(nsTArray<CharacterPosition>* aCharacterPo
                                        float aMetricsScale)
 {
   PRUint32 strLength = mTextRun->GetLength();
-  NS_ASSERTION(strLength > 0, "no text");
+  NS_ABORT_IF_FALSE(strLength > 0, "no text");
 
   const gfxFloat radPerDeg = M_PI / 180.0;
 
@@ -1419,7 +1419,11 @@ nsSVGGlyphFrame::GetCharNumAtPosition(nsIDOMSVGPoint *point)
 NS_IMETHODIMP_(nsISVGGlyphFragmentLeaf *)
 nsSVGGlyphFrame::GetFirstGlyphFragment()
 {
-  return this;
+  nsISVGGlyphFragmentLeaf *leaf = this;
+  while (leaf && leaf->IsEmpty()) {
+    leaf = leaf->GetNextGlyphFragment();
+  }
+  return leaf;
 }
 
 NS_IMETHODIMP_(nsISVGGlyphFragmentLeaf *)
@@ -1444,6 +1448,8 @@ NS_IMETHODIMP_(PRBool)
 nsSVGGlyphFrame::EndsWithWhitespace() const
 {
   const nsTextFragment* text = mContent->GetText();
+  NS_ABORT_IF_FALSE(text->GetLength() > 0, "text expected");
+
   return NS_IsAsciiWhitespace(text->CharAt(text->GetLength() - 1));
 }
 

layout/svg/base/src/nsSVGGlyphFrame.h

@@ -162,6 +162,9 @@ public:
                                        nsTArray<float> &aRotate);
   NS_IMETHOD_(PRUint16) GetTextAnchor();
   NS_IMETHOD_(PRBool) IsAbsolutelyPositioned();
+  NS_IMETHOD_(PRBool) IsEmpty() const {
+    return mContent->GetText()->GetLength() == 0;
+  }
   NS_IMETHOD_(void) SetTrimLeadingWhitespace(PRBool aTrimLeadingWhitespace) {
     mTrimLeadingWhitespace = aTrimLeadingWhitespace;
   }

layout/svg/crashtests/655025-1.svg

@@ -0,0 +1,6 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+  <text id="a">a</text>
+  <script>
+    document.getElementById("a").firstChild.nodeValue = "";
+  </script>
+</svg>

layout/svg/crashtests/655025-2.svg

@@ -0,0 +1,6 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+  <text id="a">a</text>
+  <script>
+    document.getElementById("a").appendChild(document.createTextNode(""));
+  </script>
+</svg>

layout/svg/crashtests/655025-3.svg

@@ -0,0 +1,9 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+  <script>
+    var a = document.createElementNS("http://www.w3.org/2000/svg", "text");
+    a.appendChild(document.createTextNode(""));
+    document.documentElement.appendChild(a);
+    a.getNumberOfChars();
+    document.documentElement.removeChild(a);
+  </script>
+</svg>

layout/svg/crashtests/crashtests.list

@@ -106,3 +106,6 @@ load 614367-1.svg
 load 620034-1.html
 load 621598-1.svg
 load 648819-1.html
+load 655025-1.svg
+load 655025-2.svg
+load 655025-3.svg