[SCM] WebKit Debian packaging branch, webkit-1.2, updated. upstream/1.1.90-6072-g9a69373
eric at webkit.org
eric at webkit.org
Thu Apr 8 00:38:59 UTC 2010
The following commit has been merged in the webkit-1.2 branch:
commit 7880beef9a883d3f4c801f98ff0c03fba7f314c2
Author: eric at webkit.org <eric at webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Date: Wed Dec 16 21:56:54 2009 +0000
2009-12-16 Dirk Schulze <krit at webkit.org>
Reviewed by Nikolas Zimmermann.
feMerge crahses if feMergeNodes attribute in is empty
https://bugs.webkit.org/show_bug.cgi?id=32489
The previous test only checked if feMerge works on empty node
without a last effect. In this case we get a source image and
everything works fine. This test also covers the case if there
is a last effect.
* platform/mac/svg/custom/empty-merge-expected.checksum:
* platform/mac/svg/custom/empty-merge-expected.png:
* platform/mac/svg/custom/empty-merge-expected.txt:
* svg/custom/empty-merge.svg:
2009-12-16 Dirk Schulze <krit at webkit.org>
Reviewed by Nikolas Zimmermann.
feMerge crahses if feMergeNodes attribute in is empty
https://bugs.webkit.org/show_bug.cgi?id=32489
SVGFEMergeElement only stored pointers to all effects of it's nodes
in a list. But it should store the RefPtr otherwise the effects get
dereferenced and WebKit crashes.
I also made a short clean-up in SVGFilterBuilder. No change in
functionality.
Test: I updated svg/custom/empty-merge.svg to cover this problem.
* svg/SVGFEMergeElement.cpp:
(WebCore::SVGFEMergeElement::build):
* svg/graphics/filters/SVGFEMerge.cpp:
(WebCore::FEMerge::FEMerge):
(WebCore::FEMerge::create):
(WebCore::FEMerge::mergeInputs):
(WebCore::FEMerge::setMergeInputs):
* svg/graphics/filters/SVGFEMerge.h:
* svg/graphics/filters/SVGFilterBuilder.cpp:
(WebCore::SVGFilterBuilder::add):
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@52219 268f45cc-cd09-0410-ab3c-d52691b4dbfc
diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index 78feaca..2911942 100644
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,5 +1,22 @@
2009-12-16 Dirk Schulze <krit at webkit.org>
+ Reviewed by Nikolas Zimmermann.
+
+ feMerge crahses if feMergeNodes attribute in is empty
+ https://bugs.webkit.org/show_bug.cgi?id=32489
+
+ The previous test only checked if feMerge works on empty node
+ without a last effect. In this case we get a source image and
+ everything works fine. This test also covers the case if there
+ is a last effect.
+
+ * platform/mac/svg/custom/empty-merge-expected.checksum:
+ * platform/mac/svg/custom/empty-merge-expected.png:
+ * platform/mac/svg/custom/empty-merge-expected.txt:
+ * svg/custom/empty-merge.svg:
+
+2009-12-16 Dirk Schulze <krit at webkit.org>
+
Reviewed by Darin Adler.
sourceGraphic wrong if positive x,y is >0 and objectBB is selected on Filter
diff --git a/LayoutTests/platform/mac/svg/custom/empty-merge-expected.checksum b/LayoutTests/platform/mac/svg/custom/empty-merge-expected.checksum
index a52dd81..d9eab02 100644
--- a/LayoutTests/platform/mac/svg/custom/empty-merge-expected.checksum
+++ b/LayoutTests/platform/mac/svg/custom/empty-merge-expected.checksum
@@ -1 +1 @@
-2fd864fa7542ee18457a298ded77cec1
\ No newline at end of file
+43d38b779dd3330bfb490ba26a4bff71
\ No newline at end of file
diff --git a/LayoutTests/platform/mac/svg/custom/empty-merge-expected.png b/LayoutTests/platform/mac/svg/custom/empty-merge-expected.png
index 1eb644d..73861f0 100644
Binary files a/LayoutTests/platform/mac/svg/custom/empty-merge-expected.png and b/LayoutTests/platform/mac/svg/custom/empty-merge-expected.png differ
diff --git a/LayoutTests/platform/mac/svg/custom/empty-merge-expected.txt b/LayoutTests/platform/mac/svg/custom/empty-merge-expected.txt
index 1c1f46a..0e43bb5 100644
--- a/LayoutTests/platform/mac/svg/custom/empty-merge-expected.txt
+++ b/LayoutTests/platform/mac/svg/custom/empty-merge-expected.txt
@@ -1,9 +1,9 @@
-KCanvasResource {id="MyFilter" [type=FILTER] [bounding box=at (0,0) size 100x100] [bounding box mode=0]}
+KCanvasResource {id="MyFilter1" [type=FILTER] [bounding box=at (-10.00%,-10.00%) size 120.00%x120.00%]}
+KCanvasResource {id="MyFilter2" [type=FILTER] [bounding box=at (-10.00%,-10.00%) size 120.00%x120.00%]}
layer at (0,0) size 800x600
RenderView at (0,0) size 800x600
layer at (0,0) size 800x600
- RenderSVGRoot {svg} at (-0.50,-0.50) size 102x102
+ RenderSVGRoot {svg} at (10,10) size 220x100
RenderSVGHiddenContainer {defs} at (0,0) size 0x0
- RenderPath {rect} at (0.50,0.50) size 101x101 [stroke={[type=SOLID] [color=#0000FF]}] [fill={[type=SOLID] [color=#888888]}] [data="M1.00,1.00 L101.00,1.00 L101.00,101.00 L1.00,101.00 Z"]
- RenderSVGContainer {g} at (-0.50,-0.50) size 101x101 [filter=MyFilter]
- RenderPath {rect} at (-0.50,-0.50) size 101x101 [stroke={[type=SOLID] [color=#0000FF]}] [fill={[type=SOLID] [color=#008000]}] [data="M0.00,0.00 L100.00,0.00 L100.00,100.00 L0.00,100.00 Z"]
+ RenderPath {rect} at (10,10) size 100x100 [fill={[type=SOLID] [color=#008000]}] [filter=MyFilter1] [data="M10.00,10.00 L110.00,10.00 L110.00,110.00 L10.00,110.00 Z"]
+ RenderPath {rect} at (130,10) size 100x100 [fill={[type=SOLID] [color=#008000]}] [filter=MyFilter2] [data="M130.00,10.00 L230.00,10.00 L230.00,110.00 L130.00,110.00 Z"]
diff --git a/LayoutTests/svg/custom/empty-merge.svg b/LayoutTests/svg/custom/empty-merge.svg
index fc04731..df5f557 100644
--- a/LayoutTests/svg/custom/empty-merge.svg
+++ b/LayoutTests/svg/custom/empty-merge.svg
@@ -1,17 +1,18 @@
-<?xml version="1.0"?>
-<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN"
- "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
<svg xmlns="http://www.w3.org/2000/svg" version="1.1">
- <title>TestCase for empty feMerge component</title>
- <defs>
- <filter id="MyFilter" filterUnits="userSpaceOnUse" x="0" y="0" width="100" height="100">
- <feMerge>
- <feMergeNode/>
- </feMerge>
- </filter>
- </defs>
- <rect x="1" y="1" width="100" height="100" fill="#888888" stroke="blue" />
- <g filter="url(#MyFilter)" >
- <rect fill="green" stroke="blue" x="0" y="0" width="100" height="100"/>
- </g>
+<!-- TestCase for empty feMerge component. You should see 2 green rects -->
+<defs>
+<filter id="MyFilter1">
+ <feMerge>
+ <feMergeNode/>
+ </feMerge>
+</filter>
+<filter id="MyFilter2">
+ <feOffset/>
+ <feMerge>
+ <feMergeNode/>
+ </feMerge>
+</filter>
+</defs>
+<rect fill="green" x="10" y="10" width="100" height="100" filter="url(#MyFilter1)"/>
+<rect fill="green" x="130" y="10" width="100" height="100" filter="url(#MyFilter2)"/>
</svg>
diff --git a/WebCore/ChangeLog b/WebCore/ChangeLog
index 20fb368..e5d15c9 100644
--- a/WebCore/ChangeLog
+++ b/WebCore/ChangeLog
@@ -1,3 +1,29 @@
+2009-12-16 Dirk Schulze <krit at webkit.org>
+
+ Reviewed by Nikolas Zimmermann.
+
+ feMerge crahses if feMergeNodes attribute in is empty
+ https://bugs.webkit.org/show_bug.cgi?id=32489
+
+ SVGFEMergeElement only stored pointers to all effects of it's nodes
+ in a list. But it should store the RefPtr otherwise the effects get
+ dereferenced and WebKit crashes.
+ I also made a short clean-up in SVGFilterBuilder. No change in
+ functionality.
+
+ Test: I updated svg/custom/empty-merge.svg to cover this problem.
+
+ * svg/SVGFEMergeElement.cpp:
+ (WebCore::SVGFEMergeElement::build):
+ * svg/graphics/filters/SVGFEMerge.cpp:
+ (WebCore::FEMerge::FEMerge):
+ (WebCore::FEMerge::create):
+ (WebCore::FEMerge::mergeInputs):
+ (WebCore::FEMerge::setMergeInputs):
+ * svg/graphics/filters/SVGFEMerge.h:
+ * svg/graphics/filters/SVGFilterBuilder.cpp:
+ (WebCore::SVGFilterBuilder::add):
+
2009-12-16 Brian Weinstein <bweinstein at apple.com>
Reviewed by Timothy Hatcher.
diff --git a/WebCore/svg/SVGFEMergeElement.cpp b/WebCore/svg/SVGFEMergeElement.cpp
index 6c703ca..078de22 100644
--- a/WebCore/svg/SVGFEMergeElement.cpp
+++ b/WebCore/svg/SVGFEMergeElement.cpp
@@ -39,7 +39,7 @@ SVGFEMergeElement::~SVGFEMergeElement()
bool SVGFEMergeElement::build(SVGResourceFilter* filterResource)
{
- Vector<FilterEffect*> mergeInputs;
+ Vector<RefPtr<FilterEffect> > mergeInputs;
for (Node* n = firstChild(); n != 0; n = n->nextSibling()) {
if (n->hasTagName(SVGNames::feMergeNodeTag)) {
FilterEffect* mergeEffect = filterResource->builder()->getEffectById(static_cast<SVGFEMergeNodeElement*>(n)->in1());
diff --git a/WebCore/svg/graphics/filters/SVGFEMerge.cpp b/WebCore/svg/graphics/filters/SVGFEMerge.cpp
index 3f9ad38..6ea0fb9 100644
--- a/WebCore/svg/graphics/filters/SVGFEMerge.cpp
+++ b/WebCore/svg/graphics/filters/SVGFEMerge.cpp
@@ -30,23 +30,23 @@
namespace WebCore {
-FEMerge::FEMerge(const Vector<FilterEffect*>& mergeInputs)
+FEMerge::FEMerge(const Vector<RefPtr<FilterEffect> >& mergeInputs)
: FilterEffect()
, m_mergeInputs(mergeInputs)
{
}
-PassRefPtr<FEMerge> FEMerge::create(const Vector<FilterEffect*>& mergeInputs)
+PassRefPtr<FEMerge> FEMerge::create(const Vector<RefPtr<FilterEffect> >& mergeInputs)
{
return adoptRef(new FEMerge(mergeInputs));
}
-const Vector<FilterEffect*>& FEMerge::mergeInputs() const
+const Vector<RefPtr<FilterEffect> >& FEMerge::mergeInputs() const
{
return m_mergeInputs;
}
-void FEMerge::setMergeInputs(const Vector<FilterEffect*>& mergeInputs)
+void FEMerge::setMergeInputs(const Vector<RefPtr<FilterEffect> >& mergeInputs)
{
m_mergeInputs = mergeInputs;
}
diff --git a/WebCore/svg/graphics/filters/SVGFEMerge.h b/WebCore/svg/graphics/filters/SVGFEMerge.h
index 02fbfac..7653be3 100644
--- a/WebCore/svg/graphics/filters/SVGFEMerge.h
+++ b/WebCore/svg/graphics/filters/SVGFEMerge.h
@@ -31,10 +31,10 @@ namespace WebCore {
class FEMerge : public FilterEffect {
public:
- static PassRefPtr<FEMerge> create(const Vector<FilterEffect*>&);
+ static PassRefPtr<FEMerge> create(const Vector<RefPtr<FilterEffect> >&);
- const Vector<FilterEffect*>& mergeInputs() const;
- void setMergeInputs(const Vector<FilterEffect*>& mergeInputs);
+ const Vector<RefPtr<FilterEffect> >& mergeInputs() const;
+ void setMergeInputs(const Vector<RefPtr<FilterEffect> >& mergeInputs);
virtual FloatRect uniteChildEffectSubregions(Filter*);
void apply(Filter*);
@@ -42,9 +42,9 @@ namespace WebCore {
TextStream& externalRepresentation(TextStream& ts) const;
private:
- FEMerge(const Vector<FilterEffect*>&);
+ FEMerge(const Vector<RefPtr<FilterEffect> >&);
- Vector<FilterEffect*> m_mergeInputs;
+ Vector<RefPtr<FilterEffect> > m_mergeInputs;
};
} // namespace WebCore
diff --git a/WebCore/svg/graphics/filters/SVGFilterBuilder.cpp b/WebCore/svg/graphics/filters/SVGFilterBuilder.cpp
index 67668d6..fc6924a 100644
--- a/WebCore/svg/graphics/filters/SVGFilterBuilder.cpp
+++ b/WebCore/svg/graphics/filters/SVGFilterBuilder.cpp
@@ -42,14 +42,14 @@ SVGFilterBuilder::SVGFilterBuilder()
void SVGFilterBuilder::add(const AtomicString& id, RefPtr<FilterEffect> effect)
{
if (id.isEmpty()) {
- m_lastEffect = effect.get();
+ m_lastEffect = effect;
return;
}
if (m_builtinEffects.contains(id))
return;
- m_lastEffect = effect.get();
+ m_lastEffect = effect;
m_namedEffects.set(id, m_lastEffect);
}
--
WebKit Debian packaging
More information about the Pkg-webkit-commits
mailing list