commit ebda7f435a3d643b216dd9efffea15438f7233dc
parent 0923d75a63760c72f6d7265e7073f940290d1269
Author: longsonr <longsonr@gmail.com>
Date: Mon, 13 Oct 2025 15:56:58 +0000
Bug 1467887 Part 2 - Don't try to process non-display text if it has not been reflowed r=jwatt
Differential Revision: https://phabricator.services.mozilla.com/D268257
Diffstat:
3 files changed, 11 insertions(+), 14 deletions(-)
diff --git a/layout/svg/SVGTextFrame.cpp b/layout/svg/SVGTextFrame.cpp
@@ -3163,25 +3163,14 @@ void SVGTextFrame::PaintSVG(gfxContext& aContext, const gfxMatrix& aTransform,
return;
}
- nsPresContext* presContext = PresContext();
+ if (IsSubtreeDirty()) {
+ return;
+ }
if (HasAnyStateBits(NS_FRAME_IS_NONDISPLAY)) {
- // If we are in a canvas DrawWindow call that used the
- // DRAWWINDOW_DO_NOT_FLUSH flag, then we may still have out
- // of date frames. Just don't paint anything if they are
- // dirty.
- if (presContext->PresShell()->InDrawWindowNotFlushing() &&
- IsSubtreeDirty()) {
- return;
- }
// Text frames inside <clipPath>, <mask>, etc. will never have had
// ReflowSVG called on them, so call UpdateGlyphPositioning to do this now.
UpdateGlyphPositioning();
- } else if (IsSubtreeDirty()) {
- // If we are asked to paint before reflow has recomputed mPositions etc.
- // directly via PaintSVG, rather than via a display list, then we need
- // to bail out here too.
- return;
}
const float epsilon = 0.0001;
@@ -3203,6 +3192,7 @@ void SVGTextFrame::PaintSVG(gfxContext& aContext, const gfxMatrix& aTransform,
// SVG frames' PaintSVG methods paint in CSS px, but normally frames paint in
// dev pixels. Here we multiply a CSS-px-to-dev-pixel factor onto aTransform
// so our non-SVG nsTextFrame children paint correctly.
+ nsPresContext* presContext = PresContext();
auto auPerDevPx = presContext->AppUnitsPerDevPixel();
float cssPxPerDevPx = nsPresContext::AppUnitsToFloatCSSPixels(auPerDevPx);
gfxMatrix canvasTMForChildren = aTransform;
diff --git a/layout/svg/crashtests/1467887-2.html b/layout/svg/crashtests/1467887-2.html
@@ -0,0 +1,6 @@
+<svg>
+<clipPath id="a">
+<text vector-effect="non-scaling-stroke">
+</svg>
+<mark style="clip-path: url(#a)">
+<select>
diff --git a/layout/svg/crashtests/crashtests.list b/layout/svg/crashtests/crashtests.list
@@ -240,6 +240,7 @@ load 1072758.html
load 1424031.html
load 1426575.html
load 1467887-1.html
+load 1467887-2.html
load 1536892.html
load 1539318-1.svg
load 1548985-1.html
