Bug 1693032 - SVG text reflow can flow through multiple outer svg elements r=emilio

longsonr · longsonr · commit f3136a33fd53 · 2021-02-17T14:51:47.000Z
Differential Revision: https://phabricator.services.mozilla.com/D105350
diff --git a/layout/svg/SVGContainerFrame.cpp b/layout/svg/SVGContainerFrame.cpp
@@ -281,8 +281,8 @@ nsIFrame* SVGDisplayContainerFrame::GetFrameForPoint(const gfxPoint& aPoint) {
 }
 
 void SVGDisplayContainerFrame::ReflowSVG() {
-  NS_ASSERTION(SVGUtils::OuterSVGIsCallingReflowSVG(this),
-               "This call is probably a wasteful mistake");
+  MOZ_ASSERT(SVGUtils::AnyOuterSVGIsCallingReflowSVG(this),
+             "This call is probably a wasteful mistake");
 
   MOZ_ASSERT(!HasAnyStateBits(NS_FRAME_IS_NONDISPLAY),
              "ReflowSVG mechanism not designed for this");
diff --git a/layout/svg/SVGObserverUtils.cpp b/layout/svg/SVGObserverUtils.cpp
@@ -490,7 +490,7 @@ void SVGTextPathObserver::OnRenderingChange() {
     text->AddStateBits(NS_STATE_SVG_TEXT_CORRESPONDENCE_DIRTY |
                        NS_STATE_SVG_POSITIONING_DIRTY);
 
-    if (SVGUtils::OuterSVGIsCallingReflowSVG(text)) {
+    if (SVGUtils::AnyOuterSVGIsCallingReflowSVG(text)) {
       text->AddStateBits(NS_FRAME_IS_DIRTY | NS_FRAME_HAS_DIRTY_CHILDREN);
       if (text->HasAnyStateBits(NS_FRAME_IS_NONDISPLAY)) {
         text->ReflowSVGNonDisplayText();
diff --git a/layout/svg/SVGTextFrame.cpp b/layout/svg/SVGTextFrame.cpp
@@ -3294,7 +3294,7 @@ nsIFrame* SVGTextFrame::GetFrameForPoint(const gfxPoint& aPoint) {
 }
 
 void SVGTextFrame::ReflowSVG() {
-  MOZ_ASSERT(SVGUtils::OuterSVGIsCallingReflowSVG(this),
+  MOZ_ASSERT(SVGUtils::AnyOuterSVGIsCallingReflowSVG(this),
              "This call is probaby a wasteful mistake");
 
   MOZ_ASSERT(!HasAnyStateBits(NS_FRAME_IS_NONDISPLAY),
diff --git a/layout/svg/crashtests/1693032.html b/layout/svg/crashtests/1693032.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<html>
+<head>
+    <script>
+      document.addEventListener('DOMContentLoaded', () => {
+        const svg_1 = document.createElementNS('http://www.w3.org/2000/svg', 'svg')
+        const svg_2 = document.createElementNS('http://www.w3.org/2000/svg', 'svg')
+        const switch_1 = document.createElementNS('http://www.w3.org/2000/svg', 'switch')
+        const metadata_1 = document.createElementNS('http://www.w3.org/2000/svg', 'metadata')
+        const foreign_1 = document.createElementNS('http://www.w3.org/2000/svg', 'foreignObject')
+        const text_1 = document.createElementNS('http://www.w3.org/2000/svg', 'text')
+        switch_1.appendChild(metadata_1)
+        svg_2.appendChild(text_1)
+        foreign_1.appendChild(svg_2)
+        switch_1.appendChild(foreign_1)
+        svg_1.appendChild(switch_1)
+        document.documentElement.appendChild(svg_1)
+      })
+    </script>
+</head>
+</html>
diff --git a/layout/svg/crashtests/crashtests.list b/layout/svg/crashtests/crashtests.list
@@ -237,3 +237,4 @@ load 1605223-1.html
 load 1609663.html
 load 1671950.html
 load 1678947.html
+load 1693032.html

Original file line number	Diff line number	Diff line change
`@@ -281,8 +281,8 @@ nsIFrame* SVGDisplayContainerFrame::GetFrameForPoint(const gfxPoint& aPoint) {`
`281`	`281`	`}`
`282`	`282`
`283`	`283`	`void SVGDisplayContainerFrame::ReflowSVG() {`
`284`		`- NS_ASSERTION(SVGUtils::OuterSVGIsCallingReflowSVG(this),`
`285`		`- "This call is probably a wasteful mistake");`
	`284`	`+ MOZ_ASSERT(SVGUtils::AnyOuterSVGIsCallingReflowSVG(this),`
	`285`	`+ "This call is probably a wasteful mistake");`
`286`	`286`
`287`	`287`	`MOZ_ASSERT(!HasAnyStateBits(NS_FRAME_IS_NONDISPLAY),`
`288`	`288`	`"ReflowSVG mechanism not designed for this");`
Original file line number	Diff line number	Diff line change
`@@ -3294,7 +3294,7 @@ nsIFrame* SVGTextFrame::GetFrameForPoint(const gfxPoint& aPoint) {`
`3294`	`3294`	`}`
`3295`	`3295`
`3296`	`3296`	`void SVGTextFrame::ReflowSVG() {`
`3297`		`- MOZ_ASSERT(SVGUtils::OuterSVGIsCallingReflowSVG(this),`
	`3297`	`+ MOZ_ASSERT(SVGUtils::AnyOuterSVGIsCallingReflowSVG(this),`
`3298`	`3298`	`"This call is probaby a wasteful mistake");`
`3299`	`3299`
`3300`	`3300`	`MOZ_ASSERT(!HasAnyStateBits(NS_FRAME_IS_NONDISPLAY),`