Bug 620468 - Bail out earlier when computing CTM of an <svg> element …

…with negative width/height attributes. r=longsonr

content/svg/content/src/nsSVGSVGElement.cpp

@@ -1001,6 +1001,10 @@ nsSVGSVGElement::GetViewBoxTransform() const
     viewportHeight = mViewportHeight;
   }
 
+  if (viewportWidth <= 0.0f || viewportHeight <= 0.0f) {
+    return gfxMatrix(0.0, 0.0, 0.0, 0.0, 0.0, 0.0); // singular
+  }
+
   nsSVGViewBoxRect viewBox;
   if (mViewBox.IsValid()) {
     viewBox = mViewBox.GetAnimValue();

content/svg/content/test/test_getCTM.html

@@ -35,6 +35,7 @@
   var g2 = doc.getElementById("g2");
   var g3 = doc.getElementById("g3");
   var g4 = doc.getElementById("g4");
+  var g5 = doc.getElementById("g5");
   var sym = doc.getElementById("sym");
   var symbolRect = doc.getElementById("symbolRect");
   var fO = doc.getElementById("fO");
@@ -61,9 +62,11 @@
   // symbolRect.nearestViewportElement == sym
   is((function(){try{return symbolRect.getCTM().e}catch(e){return e}})(), 70, "symbolRect.getCTM().e");
   is((function(){try{return symbolRect.getCTM().f}catch(e){return e}})(), 80, "symbolRect.getCTM().f");
-  // fO.nearestViewportElement = <svg> with no 'id'
+  // fO.nearestViewportElement == <svg> with no 'id'
   is((function(){try{return fO.getCTM().e}catch(e){return e}})(), 2, "fO.getCTM().e");
   is((function(){try{return fO.getCTM().f}catch(e){return e}})(), 3, "fO.getCTM().f");
+  // g5.nearestViewportElement == inner-2 
+  is((function(){try{return g5.getCTM()}catch(e){return e}})(), null, "g5.getCTM()");
 
   /* Tests the consistency with farthestViewportElement
      (code is from test_viewport.html) */
@@ -90,6 +93,8 @@
   // fO.farthestViewportElement == root
   is((function(){try{return fO.getScreenCTM().e}catch(e){return e}})(), 16, "symbolRect.getScreenCTM().e");
   is((function(){try{return fO.getScreenCTM().f}catch(e){return e}})(), 29, "symbolRect.getScreenCTM().f");
+  // g5.farthestViewportElement == root
+  is((function(){try{return g5.getScreenCTM()}catch(e){return e}})(), null, "g5.getScreenCTM()");
 
   SimpleTest.finish();
 }