LibWeb/SVG: Ensure SVG transform has an inverse before using it

This avoids a crash that occurred when calling `getBBox()` on an SVG
element that had a transform with no inverse.

Found by Domato.
This commit is contained in:
Tim Ledbetter 2024-07-21 23:29:06 +01:00 committed by Andreas Kling
commit d417b75683
Notes: github-actions[bot] 2024-07-22 07:14:16 +00:00
3 changed files with 17 additions and 3 deletions

View file

@ -0,0 +1,12 @@
<!DOCTYPE html>
<script src="../include.js"></script>
<svg xmlns="http://www.w3.org/2000/svg">
<rect id="rectElement" x="0" y="0" width="100" height="100" transform="scale(0)" />
</svg>
<script>
test(() => {
const rectElement = document.getElementById("rectElement");
rectElement.getBBox();
println("PASS (didn't crash)");
});
</script>