Bug 1967479 - Clear vertices if GetOrBuildPathForMeasuring() fails. r=longsonr

emilio · emilio · commit 58839dd9ab67 · 2025-05-22T10:38:03.000Z
It's failing here: https://searchfox.org/mozilla-central/rev/02d33f4bf984f65bd394bfd2d19d66569ae2cfe1/dom/svg/SVGEllipseElement.cpp#157-159 Which makes sense I think, because off the zero radii. Keep the state consistent in that case. Differential Revision: https://phabricator.services.mozilla.com/D250624
diff --git a/dom/svg/SVGMotionSMILAnimationFunction.cpp b/dom/svg/SVGMotionSMILAnimationFunction.cpp
@@ -208,17 +208,21 @@ void SVGMotionSMILAnimationFunction::RebuildPathAndVerticesFromMpathElem(
   mPathSourceType = ePathSourceType_Mpath;
 
   // Use the shape that's the target of our chosen <mpath> child.
-  SVGGeometryElement* shapeElem = aMpathElem->GetReferencedPath();
-  if (shapeElem && shapeElem->HasValidDimensions()) {
-    bool ok = shapeElem->GetDistancesFromOriginToEndsOfVisibleSegments(
-        &mPathVertices);
-    if (!ok) {
-      mPathVertices.Clear();
-      return;
-    }
-    if (mPathVertices.Length()) {
-      mPath = shapeElem->GetOrBuildPathForMeasuring();
-    }
+  SVGGeometryElement* shape = aMpathElem->GetReferencedPath();
+  if (!shape || !shape->HasValidDimensions()) {
+    return;
+  }
+  if (!shape->GetDistancesFromOriginToEndsOfVisibleSegments(&mPathVertices)) {
+    mPathVertices.Clear();
+    return;
+  }
+  if (mPathVertices.IsEmpty()) {
+    return;
+  }
+  mPath = shape->GetOrBuildPathForMeasuring();
+  if (!mPath) {
+    mPathVertices.Clear();
+    return;
   }
 }
 
@@ -237,7 +241,7 @@ void SVGMotionSMILAnimationFunction::RebuildPathAndVerticesFromPathAttr() {
 
   mPath = path.BuildPathForMeasuring(1.0f);
   bool ok = path.GetDistancesFromOriginToEndsOfVisibleSegments(&mPathVertices);
-  if (!ok || !mPathVertices.Length()) {
+  if (!ok || mPathVertices.IsEmpty() || !mPath) {
     mPath = nullptr;
     mPathVertices.Clear();
   }
@@ -265,7 +269,6 @@ void SVGMotionSMILAnimationFunction::RebuildPathAndVertices(
     mValueNeedsReparsingEverySample = false;
   } else {
     // Get path & vertices from basic SMIL attrs: from/by/to/values
-
     RebuildPathAndVerticesFromBasicAttrs(aTargetElement);
     mValueNeedsReparsingEverySample = true;
   }
diff --git a/testing/web-platform/tests/svg/animations/mpath-zero-radius-crash.html b/testing/web-platform/tests/svg/animations/mpath-zero-radius-crash.html
@@ -0,0 +1,18 @@
+<html>
+<head>
+  <script>
+    document.addEventListener("DOMContentLoaded", async () => {
+      const frame = document.createElementNS("http://www.w3.org/1999/xhtml", "frame")
+      document.documentElement.appendChild(frame)
+      frame.src = `data:text/html,` + encodeURIComponent(`<!doctype html>
+<svg>
+  <ellipse id="id_8" ry="100pt"></ellipse>
+  <animateMotion>
+    <desc></desc>
+    <mpath xlink:href="#id_8"></mpath>
+  </animateMotion>
+</svg>`);
+    })
+  </script>
+</head>
+</html>
