Bug 1560179 - Image should not accept eSHAPE r=longsonr

Differential Revision: https://phabricator.services.mozilla.com/D35396

dom/svg/SVGImageElement.cpp

@@ -267,7 +267,8 @@ already_AddRefed<Path> SVGImageElement::BuildPath(PathBuilder* aBuilder) {
   // To get bound, the faster method GetGeometryBounds() should already return
   // success. For render and hittest, nsSVGImageFrame should have its own
   // implementation that doesn't need to build path for an image.
-  MOZ_CRASH("There is no reason to call BuildPath for SVGImageElement");
+  MOZ_ASSERT_UNREACHABLE(
+      "There is no reason to call BuildPath for SVGImageElement");
   return nullptr;
 }
 

dom/svg/SVGImageElement.h

@@ -56,6 +56,12 @@ class SVGImageElement : public SVGImageElementBase,
                                 const nsAttrValue* aOldValue,
                                 nsIPrincipal* aSubjectPrincipal,
                                 bool aNotify) override;
+  bool IsNodeOfType(uint32_t aFlags) const override {
+    // <imag> is not really a SVGGeometryElement, we should
+    // ignore eSHAPE flag accepted by SVGGeometryElement.
+    return SVGGraphicsElement::IsNodeOfType(aFlags);
+  }
+
   virtual nsresult BindToTree(BindContext&, nsINode& aParent) override;
   virtual void UnbindFromTree(bool aNullParent) override;
 

dom/svg/crashtests/1560179.html

@@ -0,0 +1,5 @@
+<svg class="">
+    <image class="" id="id_1" systemLanguage="">
+        <text class="" xml:space="preserve">
+            <textPath class="" xlink:href="#id_1">
+

dom/svg/crashtests/crashtests.list

@@ -94,3 +94,4 @@ skip-if(Android) load 1507961-1.html  # times out on Android due to the test siz
 load 1531578-1.html
 load test_nested_svg.html
 load 1555795.html
+load 1560179.html