2089479 - SVG attributes added through DOM setters are reported to attribute observers as modifications

Status: RESOLVED FIXED

(Core :: SVG, defect)

Description

[Sylvestre Ledru [:Sylvestre]]

SVGElement::DidChangeValue computes the modification type with aName ? AttrModType::Modification : AttrModType::Addition. aName is never null, so it always reports Modification, including when an SVG DOM setter (for example rect.x.baseVal.value = 5 on a <rect> without an x attribute) adds the attribute. WillChangeValue still reports Addition for the same change, so observers see a mismatched pair.

Before bug 769207 part 3 the test was HasAttr(aName). Restoring that check fixes it.

The value reaches nsIMutationObserver::AttributeChanged consumers (for example accessibility). I found no web-visible consequence for SVG elements.

Found by Coverity Scan (CID 1696585, reported as a dereference-before-null-check).

Comment 1

[Sylvestre Ledru [:Sylvestre]]

Attachment: Bug 2089479 - Report attributes added through SVG DOM setters as additions in SVGElement::DidChangeValue (Coverity CID 1696585) r?#firefox-svg-reviewers

Bug 769207 part 3 replaced HasAttr(aName) with aName, which is never
null, so DidChangeValue always reported Modification while
WillChangeValue reported Addition for the same change.

Comment 2

[BugBot [:suhaib / :marco]]

Set release status flags based on info from the regressing bug 769207

Comment 3

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)]

Oh, sorry for the bug. Although I don't remember why I removed the check...

Comment 4

[Silaghi Andreea]

https://hg.mozilla.org/mozilla-central/rev/66bb2762c855