[SCM] WebKit Debian packaging branch, webkit-1.1, updated. upstream/1.1.15.1-1414-gc69ee75

[krit at webkit.org]

The following commit has been merged in the webkit-1.1 branch:
commit 19be13c58282798482082b33d057c460c5c5af6a
Author: krit at webkit.org <krit at webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Date:   Mon Oct 12 21:15:12 2009 +0000

    2009-10-12  Dirk Schulze  <krit at webkit.org>
    
            Reviewed by Eric Seidel.
    
            SVG - crash on feMerge when input not available
            [https://bugs.webkit.org/show_bug.cgi?id=30297]
    
            Make a early return in SVGFEMergeElement if the needed
            filter effect doesn't exist.
    
            Test: svg/filters/feMerge-wrong-input.svg
    
            * svg/SVGFEMergeElement.cpp:
            (WebCore::SVGFEMergeElement::build):
    
    2009-10-12  Dirk Schulze  <krit at webkit.org>
    
            Reviewed by Eirc Seidel.
    
            feMergeNod has a reference to an effect that doesn't exist. This test will
            check if SVGFEMergeElement handles this correctly and stops the filter process.
    
            * svg/filters/feMerge-wrong-input-expected.checksum: Added.
            * svg/filters/feMerge-wrong-input-expected.png: Added.
            * svg/filters/feMerge-wrong-input-expected.txt: Added.
            * svg/filters/feMerge-wrong-input.svg: Added.
    
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@49472 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index 8d18669..9226f10 100644
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,15 @@
+2009-10-12  Dirk Schulze  <krit at webkit.org>
+
+        Reviewed by Eirc Seidel.
+
+        feMergeNod has a reference to an effect that doesn't exist. This test will
+        check if SVGFEMergeElement handles this correctly and stops the filter process.
+
+        * svg/filters/feMerge-wrong-input-expected.checksum: Added.
+        * svg/filters/feMerge-wrong-input-expected.png: Added.
+        * svg/filters/feMerge-wrong-input-expected.txt: Added.
+        * svg/filters/feMerge-wrong-input.svg: Added.
+
 2009-10-12  Chris Marrin  <cmarrin at apple.com>
 
         Reviewed by Oliver Hunt.
diff --git a/LayoutTests/platform/mac/fast/block/positioning/005-expected.checksum b/LayoutTests/platform/mac/svg/filters/feMerge-wrong-input-expected.checksum
similarity index 100%
copy from LayoutTests/platform/mac/fast/block/positioning/005-expected.checksum
copy to LayoutTests/platform/mac/svg/filters/feMerge-wrong-input-expected.checksum
diff --git a/LayoutTests/platform/mac/fast/block/positioning/005-expected.png b/LayoutTests/platform/mac/svg/filters/feMerge-wrong-input-expected.png
similarity index 100%
copy from LayoutTests/platform/mac/fast/block/positioning/005-expected.png
copy to LayoutTests/platform/mac/svg/filters/feMerge-wrong-input-expected.png
diff --git a/LayoutTests/platform/mac/svg/filters/feMerge-wrong-input-expected.txt b/LayoutTests/platform/mac/svg/filters/feMerge-wrong-input-expected.txt
new file mode 100644
index 0000000..a9361e4
--- /dev/null
+++ b/LayoutTests/platform/mac/svg/filters/feMerge-wrong-input-expected.txt
@@ -0,0 +1,7 @@
+layer at (0,0) size 800x600
+  RenderView at (0,0) size 800x600
+layer at (0,0) size 800x600
+  RenderSVGRoot {svg} at (0,0) size 100x100
+    RenderSVGHiddenContainer {defs} at (0,0) size 0x0
+    RenderSVGContainer {g} at (0,0) size 0x0 [filter=filter]
+    RenderPath {rect} at (0,0) size 100x100 [fill={[type=SOLID] [color=#008000]}] [data="M0.00,0.00 L100.00,0.00 L100.00,100.00 L0.00,100.00 Z"]
diff --git a/LayoutTests/svg/filters/feMerge-wrong-input.svg b/LayoutTests/svg/filters/feMerge-wrong-input.svg
new file mode 100644
index 0000000..10133fe
--- /dev/null
+++ b/LayoutTests/svg/filters/feMerge-wrong-input.svg
@@ -0,0 +1,12 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+<defs>
+<!-- check that WebKit doesn't crash, if an effect is not available in feMerge -->
+<filter id="filter" primitiveUnits="objectBoundingBox">
+<feMerge>
+<feMergeNode in="does-not-exist"/>
+</feMerge>
+</filter>
+</defs>
+<g filter="url(#filter)"/>
+<rect x="0" y="0" width="100" height="100" fill="green"/>
+</svg>
diff --git a/WebCore/ChangeLog b/WebCore/ChangeLog
index 2df2a1d..4864567 100644
--- a/WebCore/ChangeLog
+++ b/WebCore/ChangeLog
@@ -1,3 +1,18 @@
+2009-10-12  Dirk Schulze  <krit at webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        SVG - crash on feMerge when input not available
+        [https://bugs.webkit.org/show_bug.cgi?id=30297]
+
+        Make a early return in SVGFEMergeElement if the needed
+        filter effect doesn't exist.
+
+        Test: svg/filters/feMerge-wrong-input.svg
+
+        * svg/SVGFEMergeElement.cpp:
+        (WebCore::SVGFEMergeElement::build):
+
 2009-10-12  Chris Marrin  <cmarrin at apple.com>
 
         Reviewed by Oliver Hunt.
diff --git a/WebCore/svg/SVGFEMergeElement.cpp b/WebCore/svg/SVGFEMergeElement.cpp
index cb3a781..8f4eed9 100644
--- a/WebCore/svg/SVGFEMergeElement.cpp
+++ b/WebCore/svg/SVGFEMergeElement.cpp
@@ -45,6 +45,8 @@ bool SVGFEMergeElement::build(SVGResourceFilter* filterResource)
     for (Node* n = firstChild(); n != 0; n = n->nextSibling()) {
         if (n->hasTagName(SVGNames::feMergeNodeTag)) {
             FilterEffect* mergeEffect = filterResource->builder()->getEffectById(static_cast<SVGFEMergeNodeElement*>(n)->in1());
+            if (!mergeEffect)
+                return false;
             mergeInputs.append(mergeEffect);
         }
     }

-- 
WebKit Debian packaging