From 4e78ff47bf7f1bb67cdb9079f148ba7763cd5252 Mon Sep 17 00:00:00 2001 From: "tor%cs.brown.edu" Date: Fri, 9 Jun 2006 21:06:35 +0000 Subject: [PATCH] Bug 340083 - crash with geometry inside desc/title. r+sr=roc git-svn-id: svn://10.0.0.236/trunk@199638 18797224-902f-48f8-a5cc-f745e15eee43 --- mozilla/layout/base/nsCSSFrameConstructor.cpp | 6 +++++- mozilla/layout/svg/base/src/nsSVGContainerFrame.cpp | 2 +- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/mozilla/layout/base/nsCSSFrameConstructor.cpp b/mozilla/layout/base/nsCSSFrameConstructor.cpp index 6f403770cfd..3a8e1f1b5d8 100644 --- a/mozilla/layout/base/nsCSSFrameConstructor.cpp +++ b/mozilla/layout/base/nsCSSFrameConstructor.cpp @@ -7652,15 +7652,19 @@ nsCSSFrameConstructor::ConstructSVGFrame(nsFrameConstructorState& aState, ; } - if (aTag != nsSVGAtoms::svg && !parentIsSVG) { + if ((aTag != nsSVGAtoms::svg && !parentIsSVG) || + (aTag == nsGkAtoms::desc || aTag == nsGkAtoms::title)) { // Sections 5.1 and G.4 of SVG 1.1 say that SVG elements other than // svg:svg not contained within svg:svg are incorrect, although they // don't seem to specify error handling. Ignore them, since many of // our frame classes can't deal. It *may* be that the document // should at that point be considered in error according to F.2, but // it's hard to tell. + // // Style mutation can't change this situation, so don't bother // adding to the undisplayed content map. + // + // We don't currently handle any UI for desc/title *aHaltProcessing = PR_TRUE; return NS_OK; } diff --git a/mozilla/layout/svg/base/src/nsSVGContainerFrame.cpp b/mozilla/layout/svg/base/src/nsSVGContainerFrame.cpp index f4fc3df6789..74bd6443be6 100644 --- a/mozilla/layout/svg/base/src/nsSVGContainerFrame.cpp +++ b/mozilla/layout/svg/base/src/nsSVGContainerFrame.cpp @@ -154,7 +154,7 @@ nsSVGDisplayContainerFrame::RemoveFrame(nsIAtom* aListName, nsISVGChildFrame* SVGFrame = nsnull; CallQueryInterface(aOldFrame, &SVGFrame); - if (SVGFrame) + if (SVGFrame && !(GetStateBits() & NS_STATE_SVG_NONDISPLAY_CHILD)) dirtyRect = SVGFrame->GetCoveredRegion(); PRBool result = nsSVGContainerFrame::RemoveFrame(aListName, aOldFrame);