Bommels05/Mozilla
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Bug 340083 - crash with geometry inside desc/title. r+sr=roc

Browse Source 
git-svn-id: svn://10.0.0.236/trunk@199638 18797224-902f-48f8-a5cc-f745e15eee43
This commit is contained in:
tor%cs.brown.edu
2006-06-09 21:06:35 +00:00
parent 007c225a7e
commit 4e78ff47bf
2 changed files with 6 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
mozilla/layout/base/nsCSSFrameConstructor.cpp
View File

@@ -7652,15 +7652,19 @@ nsCSSFrameConstructor::ConstructSVGFrame(nsFrameConstructorState& aState,
;
}
if (aTag != nsSVGAtoms::svg && !parentIsSVG) {
if ((aTag != nsSVGAtoms::svg && !parentIsSVG) ||
(aTag == nsGkAtoms::desc || aTag == nsGkAtoms::title)) {
// Sections 5.1 and G.4 of SVG 1.1 say that SVG elements other than
// svg:svg not contained within svg:svg are incorrect, although they
// don't seem to specify error handling. Ignore them, since many of
// our frame classes can't deal. It *may* be that the document
// should at that point be considered in error according to F.2, but
// it's hard to tell.
//
// Style mutation can't change this situation, so don't bother
// adding to the undisplayed content map.
//
// We don't currently handle any UI for desc/title
*aHaltProcessing = PR_TRUE;
return NS_OK;
}

2
mozilla/layout/svg/base/src/nsSVGContainerFrame.cpp
View File

@@ -154,7 +154,7 @@ nsSVGDisplayContainerFrame::RemoveFrame(nsIAtom* aListName,
nsISVGChildFrame* SVGFrame = nsnull;
CallQueryInterface(aOldFrame, &SVGFrame);
if (SVGFrame)
if (SVGFrame && !(GetStateBits() & NS_STATE_SVG_NONDISPLAY_CHILD))
dirtyRect = SVGFrame->GetCoveredRegion();
PRBool result = nsSVGContainerFrame::RemoveFrame(aListName, aOldFrame);