commit 5a0d2702c25946b391432d3d82bb082ee323091c parent 1d4c4bf8da93bf0981b12baa4910e81664caa98e Author: longsonr <longsonr@gmail.com> Date: Thu, 23 Oct 2025 14:18:58 +0000 Bug 1995807 - Parsing of a negative value for a non-negative length such as width/height should be a syntax error, as it is with CSS r=emilio We're gradually migrating various attributes to mapped CSS. In CSS width/height etc cannot be negative - if a negative value is supplied it is ignored and the default value is used instead. Unmapped attributes should be similarly restricted - eventually they will become CSS mapped and until they do we might as well have the same restriction that they will eventually get anyway. https://github.com/w3c/svgwg/issues/193 says that this should be a parse error, same as CSS properties. Differential Revision: https://phabricator.services.mozilla.com/D269678 Diffstat:
5 files changed, 25 insertions(+), 13 deletions(-)
diff --git a/dom/svg/SVGAnimatedLength.cpp b/dom/svg/SVGAnimatedLength.cpp @@ -507,6 +507,9 @@ nsresult SVGAnimatedLength::SetBaseValueString(const nsAString& aValueAsString, if (!GetValueFromString(aValueAsString, value, &unitType)) { return NS_ERROR_DOM_SYNTAX_ERR; } + if (aSVGElement->LengthAttrIsNonNegative(mAttrEnum) && value < 0.0f) { + return NS_ERROR_DOM_SYNTAX_ERR; + } if (mIsBaseSet && mBaseVal == float(value) && mBaseUnitType == uint8_t(unitType)) { diff --git a/dom/svg/SVGElement.h b/dom/svg/SVGElement.h @@ -150,6 +150,13 @@ class SVGElement : public SVGElementBase // nsIContent bool IsStringAnimatable(uint8_t aAttrEnum) { return GetStringInfo().mInfos[aAttrEnum].mIsAnimatable; } + bool LengthAttrIsNonNegative(uint8_t aAttrEnum) { + const nsStaticAtom* name = GetLengthInfo().mInfos[aAttrEnum].mName; + return name == nsGkAtoms::width || name == nsGkAtoms::height || + name == nsGkAtoms::r || name == nsGkAtoms::rx || + name == nsGkAtoms::ry || name == nsGkAtoms::markerWidth || + name == nsGkAtoms::markerHeight || name == nsGkAtoms::textLength; + } bool NumberAttrAllowsPercentage(uint8_t aAttrEnum) { return IsSVGElement(nsGkAtoms::stop) && GetNumberInfo().mInfos[aAttrEnum].mName == nsGkAtoms::offset; diff --git a/dom/svg/test/test_getCTM.html b/dom/svg/test/test_getCTM.html @@ -81,10 +81,9 @@ function runTest() { is((function() { try { return symbolRect.getCTM().f; } catch (e) { return e; } })(), 82, "symbolRect.getCTM().f"); is((function() { try { return fO.getCTM().e; } catch (e) { return e; } })(), 2, "fO.getCTM().e"); is((function() { try { return fO.getCTM().f; } catch (e) { return e; } })(), 3, "fO.getCTM().f"); - let singular = root.createSVGMatrix(); - singular.a = 0; - singular.d = 0; - isMatrix((function() { try { return g5.getCTM(); } catch (e) { return e; } })(), singular, "g5.getCTM()"); + let m = root.createSVGMatrix(); + m.e = 439; + isMatrix((function() { try { return g5.getCTM(); } catch (e) { return e; } })(), m, "g5.getCTM()"); is((function() { try { return root.getScreenCTM().e; } catch (e) { return e; } })(), 11, "root.getScreenCTM().e"); is((function() { try { return root.getScreenCTM().f; } catch (e) { return e; } })(), 22, "root.getScreenCTM().f"); @@ -103,9 +102,9 @@ function runTest() { is((function() { try { return symbolRect.getScreenCTM().f; } catch (e) { return e; } })(), 108, "symbolRect.getScreenCTM().f"); is((function() { try { return fO.getScreenCTM().e; } catch (e) { return e; } })(), 16, "symbolRect.getScreenCTM().e"); is((function() { try { return fO.getScreenCTM().f; } catch (e) { return e; } })(), 29, "symbolRect.getScreenCTM().f"); - singular.e = 15; - singular.f = 28; - isMatrix((function() { try { return g5.getScreenCTM(); } catch (e) { return e; } })(), singular, "g5.getScreenCTM()"); + m.e = 454; + m.f = 28; + isMatrix((function() { try { return g5.getScreenCTM(); } catch (e) { return e; } })(), m, "g5.getScreenCTM()"); SimpleTest.finish(); } diff --git a/testing/web-platform/tests/html/semantics/embedded-content/the-img-element/naturalWidth-naturalHeight-width-height.tentative.html b/testing/web-platform/tests/html/semantics/embedded-content/the-img-element/naturalWidth-naturalHeight-width-height.tentative.html @@ -128,10 +128,10 @@ img { data-natural-width="300" data-natural-height="0"> <img src="data:image/svg+xml,<svg xmlns='http://www.w3.org/2000/svg' width='-5'></svg>" title="SVG image, with natural width being negative" - data-natural-width="0" data-natural-height="150"> + data-natural-width="300" data-natural-height="150"> <img src="data:image/svg+xml,<svg xmlns='http://www.w3.org/2000/svg' height='-5'></svg>" title="SVG image, with natural height being negative" - data-natural-width="300" data-natural-height="0"> + data-natural-width="300" data-natural-height="150"> <!-- Second group of SVG images: Same as above, but now with a viewBox that grants a 3:1 aspect-ratio; whenever we know one natural dimension, that should @@ -170,10 +170,12 @@ img { data-natural-width="0" data-natural-height="0"> <img src="data:image/svg+xml,<svg xmlns='http://www.w3.org/2000/svg' width='-5' viewBox='0 0 600 200'></svg>" title="SVG image, with natural width being negative, and aspect ratio from viewBox" - data-natural-width="0" data-natural-height="0"> + data-natural-width="300" data-natural-height="100" + data-width="720" data-height="240"> <img src="data:image/svg+xml,<svg xmlns='http://www.w3.org/2000/svg' height='-5' viewBox='0 0 600 200'></svg>" title="SVG image, with natural height being negative, and aspect ratio from viewBox" - data-natural-width="0" data-natural-height="0"> + data-natural-width="300" data-natural-height="100" + data-width="720" data-height="240"> <!-- Third group of SVG images: Check a degenerate 0-sized viewBox for some of the cases; it should have no impact. --> @@ -219,7 +221,8 @@ img { data-natural-width="0" data-natural-height="0"> <img src="data:image/svg+xml,<svg xmlns='http://www.w3.org/2000/svg' width='-5' height='-5' viewBox='0 0 600 200'></svg>" title="SVG image, with natural width and height being negative, and aspect ratio from viewBox" - data-natural-width="0" data-natural-height="0"> + data-natural-width="300" data-natural-height="100" + data-width="720" data-height="240"> </template> </head> <body> diff --git a/testing/web-platform/tests/svg/coordinate-systems/viewBox-synthesized-in-img-001-ref.html b/testing/web-platform/tests/svg/coordinate-systems/viewBox-synthesized-in-img-001-ref.html @@ -60,7 +60,7 @@ // To make the logic simpler, we just use 0 here for all of the testcase's // sizes that we expect to behave like 0 (e.g. 0%, -5, -5%). - const SVG_SIZE_VALS_TO_TEST = [ null, 0, 0, 0, 0, 10 ]; + const SVG_SIZE_VALS_TO_TEST = [ null, 0, 0, "100%", "100%", 10 ]; const IMG_SIZE_VALS_TO_TEST = [ 20, 30 ]; function go() {