tor-browser

commit 6c19a7a0331d63b090e16c77445c5e59c98c93c0
parent fda608cc60444ddfb0d46cca9fe00377437943e6
Author: Timothy Nikkel <tnikkel@gmail.com>
Date:   Tue, 21 Oct 2025 10:01:43 +0000

Bug 1995212. Don't allow SVGViewportFrame to have negative size. r=gfx-reviewers,firefox-svg-reviewers,lsalzman,longsonr

Differential Revision: https://phabricator.services.mozilla.com/D269157

Diffstat:
M
layout/svg/SVGViewportFrame.cpp
 | 
6
++++++

1 file changed, 6 insertions(+), 0 deletions(-)
diff --git a/layout/svg/SVGViewportFrame.cpp b/layout/svg/SVGViewportFrame.cpp
@@ -55,6 +55,12 @@ void SVGViewportFrame::ReflowSVG() {
   float x, y, width, height;
   static_cast<SVGViewportElement*>(GetContent())
       ->GetAnimatedLengthValues(&x, &y, &width, &height, nullptr);
+  if (width < 0.0f) {
+    width = 0.0f;
+  }
+  if (height < 0.0f) {
+    height = 0.0f;
+  }
   mRect = nsLayoutUtils::RoundGfxRectToAppRect(gfxRect(x, y, width, height),
                                                AppUnitsPerCSSPixel());