From 28bf89bc01705f7b9ed676309f812e67045aecc3 Mon Sep 17 00:00:00 2001
From: "tor%cs.brown.edu"
 <tor%cs.brown.edu@18797224-902f-48f8-a5cc-f745e15eee43>
Date: Mon, 3 Oct 2005 20:38:01 +0000
Subject: [PATCH] Bug 310754 - check stroke-dasharray before handoff to
 renderer.  r=jwatt, a=asa

git-svn-id: svn://10.0.0.236/branches/MOZILLA_1_8_BRANCH@181492 18797224-902f-48f8-a5cc-f745e15eee43
---
 .../layout/svg/base/src/nsSVGGlyphFrame.cpp    | 18 +++++++++++++++++-
 .../svg/base/src/nsSVGPathGeometryFrame.cpp    | 18 +++++++++++++++++-
 2 files changed, 34 insertions(+), 2 deletions(-)

diff --git a/mozilla/layout/svg/base/src/nsSVGGlyphFrame.cpp b/mozilla/layout/svg/base/src/nsSVGGlyphFrame.cpp
index 136460c2e9c..309077cb0b1 100644
--- a/mozilla/layout/svg/base/src/nsSVGGlyphFrame.cpp
+++ b/mozilla/layout/svg/base/src/nsSVGGlyphFrame.cpp
@@ -659,18 +659,34 @@ nsSVGGlyphFrame::GetStrokeDashArray(float **arr, PRUint32 *count)
 {
   const nsStyleCoord *dasharray = GetStyleSVG()->mStrokeDasharray;
   nsPresContext *presContext = nsSVGGlyphFrameBase::GetPresContext();
+  float totalLength = 0.0f;
 
   *count = GetStyleSVG()->mStrokeDasharrayLength;
+  *arr = nsnull;
 
   if (*count) {
     *arr = (float *) nsMemory::Alloc(*count * sizeof(float));
     if (*arr) {
-      for (PRUint32 i = 0; i < *count; i++)
+      for (PRUint32 i = 0; i < *count; i++) {
         (*arr)[i] = nsSVGUtils::CoordToFloat(presContext, mContent, dasharray[i]);
+        if ((*arr)[i] < 0.0f) {
+          nsMemory::Free(*arr);
+          *count = 0;
+          *arr = nsnull;
+          return NS_OK;
+        }
+        totalLength += (*arr)[i];
+      }
     } else {
       *count = 0;
+      *arr = nsnull;
       return NS_ERROR_OUT_OF_MEMORY;
     }
+
+    if (totalLength == 0.0f) {
+      nsMemory::Free(*arr);
+      *count = 0;
+    }
   }
 
   return NS_OK;
diff --git a/mozilla/layout/svg/base/src/nsSVGPathGeometryFrame.cpp b/mozilla/layout/svg/base/src/nsSVGPathGeometryFrame.cpp
index 4e2d71e59b8..6d988b9f6c9 100644
--- a/mozilla/layout/svg/base/src/nsSVGPathGeometryFrame.cpp
+++ b/mozilla/layout/svg/base/src/nsSVGPathGeometryFrame.cpp
@@ -547,18 +547,34 @@ nsSVGPathGeometryFrame::GetStrokeDashArray(float **arr, PRUint32 *count)
 {
   const nsStyleCoord *dasharray = GetStyleSVG()->mStrokeDasharray;
   nsPresContext *presContext = nsSVGPathGeometryFrameBase::GetPresContext();
+  float totalLength = 0.0f;
 
   *count = GetStyleSVG()->mStrokeDasharrayLength;
+  *arr = nsnull;
 
   if (*count) {
     *arr = (float *) nsMemory::Alloc(*count * sizeof(float));
     if (*arr) {
-      for (PRUint32 i = 0; i < *count; i++)
+      for (PRUint32 i = 0; i < *count; i++) {
         (*arr)[i] = nsSVGUtils::CoordToFloat(presContext, mContent, dasharray[i]);
+        if ((*arr)[i] < 0.0f) {
+          nsMemory::Free(*arr);
+          *count = 0;
+          *arr = nsnull;
+          return NS_OK;
+        }
+        totalLength += (*arr)[i];
+      }
     } else {
       *count = 0;
+      *arr = nsnull;
       return NS_ERROR_OUT_OF_MEMORY;
     }
+
+    if (totalLength == 0.0f) {
+      nsMemory::Free(*arr);
+      *count = 0;
+    }
   }
 
   return NS_OK;