[SCM] WebKit Debian packaging branch, webkit-1.1, updated. upstream/1.1.22-985-g3c00f00
oliver at apple.com
oliver at apple.com
Wed Mar 17 18:15:19 UTC 2010
The following commit has been merged in the webkit-1.1 branch:
commit 8fd323efd6b45e55558ac431c5ca696bb2d3f11e
Author: oliver at apple.com <oliver at apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Date: Thu Mar 4 08:57:47 2010 +0000
2010-03-04 Oliver Hunt <oliver at apple.com>
Reviewed by Maciej Stachowiak.
https://bugs.webkit.org/show_bug.cgi?id=35603
SVG incorrectly allows nested <use> elements in a <use> shadow tree
Simplify the handling of invalid or missing use-targets by cloning them
to empty <g> elements rather than just allowing the <use> element to
be copied into the shadow tree, as this violates a number of assumptions
in the shadow tree handling code.
Tests: svg/custom/use-nested-disallowed-target.svg
svg/custom/use-nested-missing-target-added.svg
svg/custom/use-nested-missing-target-removed.svg
svg/custom/use-nested-missing-target.svg
svg/custom/use-nested-notarget.svg
* svg/SVGUseElement.cpp:
(WebCore::SVGUseElement::buildPendingResource):
(WebCore::SVGUseElement::buildShadowAndInstanceTree):
(WebCore::SVGUseElement::expandUseElementsInShadowTree):
2010-03-04 Oliver Hunt <oliver at apple.com>
Reviewed by Maciej Stachowiak.
https://bugs.webkit.org/show_bug.cgi?id=35603
SVG incorrectly allows nested <use> elements in a <use> shadow tree
Add test cases for various combinations of <use> and targets that aren't present.
* platform/mac/svg/custom/use-empty-reference-expected.txt: Added.
* svg/custom/use-nested-disallowed-target-expected.txt: Added.
* svg/custom/use-nested-disallowed-target.svg: Added.
* svg/custom/use-nested-missing-target-added-expected.txt: Added.
* svg/custom/use-nested-missing-target-added.svg: Added.
* svg/custom/use-nested-missing-target-expected.txt: Added.
* svg/custom/use-nested-missing-target-removed-expected.txt: Added.
* svg/custom/use-nested-missing-target-removed.svg: Added.
* svg/custom/use-nested-missing-target.svg: Added.
* svg/custom/use-nested-notarget-expected.txt: Added.
* svg/custom/use-nested-notarget.svg: Added.
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@55511 268f45cc-cd09-0410-ab3c-d52691b4dbfc
diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index 4ea056d..92647bb 100644
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,24 @@
+2010-03-04 Oliver Hunt <oliver at apple.com>
+
+ Reviewed by Maciej Stachowiak.
+
+ https://bugs.webkit.org/show_bug.cgi?id=35603
+ SVG incorrectly allows nested <use> elements in a <use> shadow tree
+
+ Add test cases for various combinations of <use> and targets that aren't present.
+
+ * platform/mac/svg/custom/use-empty-reference-expected.txt: Added.
+ * svg/custom/use-nested-disallowed-target-expected.txt: Added.
+ * svg/custom/use-nested-disallowed-target.svg: Added.
+ * svg/custom/use-nested-missing-target-added-expected.txt: Added.
+ * svg/custom/use-nested-missing-target-added.svg: Added.
+ * svg/custom/use-nested-missing-target-expected.txt: Added.
+ * svg/custom/use-nested-missing-target-removed-expected.txt: Added.
+ * svg/custom/use-nested-missing-target-removed.svg: Added.
+ * svg/custom/use-nested-missing-target.svg: Added.
+ * svg/custom/use-nested-notarget-expected.txt: Added.
+ * svg/custom/use-nested-notarget.svg: Added.
+
2010-03-04 Evan Stade <estade at chromium.org>
Reviewed by David Levin.
diff --git a/LayoutTests/platform/mac/svg/custom/use-empty-reference-expected.txt b/LayoutTests/platform/mac/svg/custom/use-empty-reference-expected.txt
index 2e1a0bf..0b5fdfc 100644
--- a/LayoutTests/platform/mac/svg/custom/use-empty-reference-expected.txt
+++ b/LayoutTests/platform/mac/svg/custom/use-empty-reference-expected.txt
@@ -3,3 +3,4 @@ layer at (0,0) size 800x600
layer at (0,0) size 800x600
RenderSVGRoot {svg} at (0,0) size 800x600
RenderSVGContainer {use} at (0,0) size 0x0
+ RenderSVGContainer {g} at (0,0) size 0x0
diff --git a/LayoutTests/fast/dom/beforeload/video-before-load-expected.txt b/LayoutTests/svg/custom/use-nested-disallowed-target-expected.txt
similarity index 100%
copy from LayoutTests/fast/dom/beforeload/video-before-load-expected.txt
copy to LayoutTests/svg/custom/use-nested-disallowed-target-expected.txt
diff --git a/LayoutTests/svg/custom/use-nested-disallowed-target.svg b/LayoutTests/svg/custom/use-nested-disallowed-target.svg
new file mode 100644
index 0000000..fc631fa
--- /dev/null
+++ b/LayoutTests/svg/custom/use-nested-disallowed-target.svg
@@ -0,0 +1,18 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" onload="runTest()">
+ <script type="text/javascript">
+ <![CDATA[
+ function runTest() {
+ if (window.layoutTestController)
+ layoutTestController.dumpAsText();
+ }
+ ]]>
+ </script>
+ <def>
+ <foreignObject id="badness"/>
+ </def>
+ <text y="30" id="myText" fill="green">PASS</text>
+ <use id="use1" xlink:href="#badness"/>
+ <use x="50" id="use2" xlink:href="#use1"></use>
+ <use y="50" id="use3" xlink:href="#use2"></use>
+ <use x="-50" id="use4" xlink:href="#use3"></use>
+</svg>
diff --git a/JavaScriptCore/tests/mozilla/js1_6/Array/browser.js b/LayoutTests/svg/custom/use-nested-missing-target-added-expected.txt
similarity index 100%
copy from JavaScriptCore/tests/mozilla/js1_6/Array/browser.js
copy to LayoutTests/svg/custom/use-nested-missing-target-added-expected.txt
diff --git a/LayoutTests/svg/custom/use-nested-missing-target-added.svg b/LayoutTests/svg/custom/use-nested-missing-target-added.svg
new file mode 100644
index 0000000..564978e
--- /dev/null
+++ b/LayoutTests/svg/custom/use-nested-missing-target-added.svg
@@ -0,0 +1,16 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" onload="runTest()">
+ <script type="text/javascript">
+ <![CDATA[
+ function runTest() {
+ if (window.layoutTestController)
+ layoutTestController.dumpAsText();
+ document.getElementById("myText1").id = "myText";
+ }
+ ]]>
+ </script>
+ <def>
+ <text id="myText1" fill="green" x="0" y="0">PASS</text>
+ </def>
+ <use y="30" id="use1" xlink:href="#myText"/>
+ <use y="30" xlink:href="#use1"/>
+</svg>
diff --git a/LayoutTests/fast/dom/beforeload/video-before-load-expected.txt b/LayoutTests/svg/custom/use-nested-missing-target-expected.txt
similarity index 100%
copy from LayoutTests/fast/dom/beforeload/video-before-load-expected.txt
copy to LayoutTests/svg/custom/use-nested-missing-target-expected.txt
diff --git a/LayoutTests/svg/custom/use-nested-missing-target-removed-expected.txt b/LayoutTests/svg/custom/use-nested-missing-target-removed-expected.txt
new file mode 100644
index 0000000..2987891
--- /dev/null
+++ b/LayoutTests/svg/custom/use-nested-missing-target-removed-expected.txt
@@ -0,0 +1,3 @@
+CONSOLE MESSAGE: line 7: TypeError: Result of expression 'document.getElementById("myText1")' [null] is not an object.
+PASS
+
diff --git a/LayoutTests/svg/custom/use-nested-missing-target-removed.svg b/LayoutTests/svg/custom/use-nested-missing-target-removed.svg
new file mode 100644
index 0000000..01bbd38
--- /dev/null
+++ b/LayoutTests/svg/custom/use-nested-missing-target-removed.svg
@@ -0,0 +1,14 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" onload="runTest()">
+ <script type="text/javascript">
+ <![CDATA[
+ function runTest() {
+ if (window.layoutTestController)
+ layoutTestController.dumpAsText();
+ document.getElementById("myText1").id = "myText1";
+ }
+ ]]>
+ </script>
+ <text y="30" id="myText" fill="green">PASS</text>
+ <use y="30" id="use1" xlink:href="#myText"/>
+ <use y="30" xlink:href="#use1"/>
+</svg>
diff --git a/LayoutTests/svg/custom/use-nested-missing-target.svg b/LayoutTests/svg/custom/use-nested-missing-target.svg
new file mode 100644
index 0000000..c46ae1e
--- /dev/null
+++ b/LayoutTests/svg/custom/use-nested-missing-target.svg
@@ -0,0 +1,15 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" onload="runTest()">
+ <script type="text/javascript">
+ <![CDATA[
+ function runTest() {
+ if (window.layoutTestController)
+ layoutTestController.dumpAsText();
+ }
+ ]]>
+ </script>
+ <text y="30" id="myText" fill="green">PASS</text>
+ <use id="use1" xlink:href="#missing"/>
+ <use x="50" id="use2" xlink:href="#use1"></use>
+ <use y="50" id="use3" xlink:href="#use2"></use>
+ <use x="-50" id="use4" xlink:href="#use3"></use>
+</svg>
diff --git a/LayoutTests/fast/dom/beforeload/video-before-load-expected.txt b/LayoutTests/svg/custom/use-nested-notarget-expected.txt
similarity index 100%
copy from LayoutTests/fast/dom/beforeload/video-before-load-expected.txt
copy to LayoutTests/svg/custom/use-nested-notarget-expected.txt
diff --git a/LayoutTests/svg/custom/use-nested-notarget.svg b/LayoutTests/svg/custom/use-nested-notarget.svg
new file mode 100644
index 0000000..a77bd85
--- /dev/null
+++ b/LayoutTests/svg/custom/use-nested-notarget.svg
@@ -0,0 +1,15 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" onload="runTest()">
+ <script type="text/javascript">
+ <![CDATA[
+ function runTest() {
+ if (window.layoutTestController)
+ layoutTestController.dumpAsText();
+ }
+ ]]>
+ </script>
+ <text y="30" id="myText" fill="green">PASS</text>
+ <use id="use1"/>
+ <use x="50" id="use2" xlink:href="#use1"></use>
+ <use y="50" id="use3" xlink:href="#use2"></use>
+ <use x="-50" id="use4" xlink:href="#use3"></use>
+</svg>
diff --git a/WebCore/ChangeLog b/WebCore/ChangeLog
index bc7484a..c7fea59 100644
--- a/WebCore/ChangeLog
+++ b/WebCore/ChangeLog
@@ -1,3 +1,26 @@
+2010-03-04 Oliver Hunt <oliver at apple.com>
+
+ Reviewed by Maciej Stachowiak.
+
+ https://bugs.webkit.org/show_bug.cgi?id=35603
+ SVG incorrectly allows nested <use> elements in a <use> shadow tree
+
+ Simplify the handling of invalid or missing use-targets by cloning them
+ to empty <g> elements rather than just allowing the <use> element to
+ be copied into the shadow tree, as this violates a number of assumptions
+ in the shadow tree handling code.
+
+ Tests: svg/custom/use-nested-disallowed-target.svg
+ svg/custom/use-nested-missing-target-added.svg
+ svg/custom/use-nested-missing-target-removed.svg
+ svg/custom/use-nested-missing-target.svg
+ svg/custom/use-nested-notarget.svg
+
+ * svg/SVGUseElement.cpp:
+ (WebCore::SVGUseElement::buildPendingResource):
+ (WebCore::SVGUseElement::buildShadowAndInstanceTree):
+ (WebCore::SVGUseElement::expandUseElementsInShadowTree):
+
2010-03-04 Leandro Pereira <leandro at profusion.mobi>
Reviewed by Gustavo Noronha Silva.
diff --git a/WebCore/svg/SVGUseElement.cpp b/WebCore/svg/SVGUseElement.cpp
index a8d4f7b..45bab6a 100644
--- a/WebCore/svg/SVGUseElement.cpp
+++ b/WebCore/svg/SVGUseElement.cpp
@@ -414,7 +414,7 @@ void SVGUseElement::buildPendingResource()
ASSERT(!m_targetElementInstance);
if (!targetElement) {
- if (m_isPendingResource)
+ if (m_isPendingResource || id.isEmpty())
return;
m_isPendingResource = true;
@@ -434,7 +434,12 @@ void SVGUseElement::buildShadowAndInstanceTree(SVGShadowTreeRootElement* shadowR
{
String id = SVGURIReference::getTarget(href());
Element* targetElement = document()->getElementById(id);
- ASSERT(targetElement);
+ if (!targetElement) {
+ // The only time we should get here is when the use element has not been
+ // given a resource to target.
+ ASSERT(m_resourceId.isEmpty());
+ return;
+ }
// Do not build the shadow/instance tree for <use> elements living in a shadow tree.
// The will be expanded soon anyway - see expandUseElementsInShadowTree().
@@ -740,27 +745,15 @@ void SVGUseElement::expandUseElementsInShadowTree(SVGShadowTreeRootElement* shad
target = static_cast<SVGElement*>(targetElement);
// Don't ASSERT(target) here, it may be "pending", too.
- if (target) {
- // Setup sub-shadow tree root node
- RefPtr<SVGShadowTreeContainerElement> cloneParent = new SVGShadowTreeContainerElement(document());
-
- // Spec: In the generated content, the 'use' will be replaced by 'g', where all attributes from the
- // 'use' element except for x, y, width, height and xlink:href are transferred to the generated 'g' element.
- transferUseAttributesToReplacedElement(use, cloneParent.get());
-
- ExceptionCode ec = 0;
-
- // For instance <use> on <foreignObject> (direct case).
- if (isDisallowedElement(target)) {
- // We still have to setup the <use> replacment (<g>). Otherwhise
- // associateInstancesWithShadowTreeElements() makes wrong assumptions.
- // Replace <use> with referenced content.
- ASSERT(use->parentNode());
- use->parentNode()->replaceChild(cloneParent.release(), use, ec);
- ASSERT(!ec);
- return;
- }
+ // Setup sub-shadow tree root node
+ RefPtr<SVGShadowTreeContainerElement> cloneParent = new SVGShadowTreeContainerElement(document());
+ // Spec: In the generated content, the 'use' will be replaced by 'g', where all attributes from the
+ // 'use' element except for x, y, width, height and xlink:href are transferred to the generated 'g' element.
+ transferUseAttributesToReplacedElement(use, cloneParent.get());
+
+ ExceptionCode ec = 0;
+ if (target && !isDisallowedElement(target)) {
RefPtr<Element> newChild = target->cloneElementWithChildren();
// We don't walk the target tree element-by-element, and clone each element,
@@ -778,16 +771,16 @@ void SVGUseElement::expandUseElementsInShadowTree(SVGShadowTreeRootElement* shad
cloneParent->appendChild(newChild.release(), ec);
ASSERT(!ec);
+ }
- // Replace <use> with referenced content.
- ASSERT(use->parentNode());
- use->parentNode()->replaceChild(cloneParent.release(), use, ec);
- ASSERT(!ec);
+ // Replace <use> with referenced content.
+ ASSERT(use->parentNode());
+ use->parentNode()->replaceChild(cloneParent.release(), use, ec);
+ ASSERT(!ec);
- // Immediately stop here, and restart expanding.
- expandUseElementsInShadowTree(shadowRoot, shadowRoot);
- return;
- }
+ // Immediately stop here, and restart expanding.
+ expandUseElementsInShadowTree(shadowRoot, shadowRoot);
+ return;
}
for (RefPtr<Node> child = element->firstChild(); child; child = child->nextSibling())
--
WebKit Debian packaging
More information about the Pkg-webkit-commits
mailing list