[SCM] WebKit Debian packaging branch, debian/experimental, updated. debian/1.3.8-1-1049-g2e11a8e

[jschuh at chromium.org]

The following commit has been merged in the debian/experimental branch:
commit 9de7d6ae63bc9e44fc611148dc512983e9658447
Author: jschuh at chromium.org <jschuh at chromium.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Date:   Fri Dec 24 11:54:24 2010 +0000

    2010-12-24  Justin Schuh  <jschuh at chromium.org>
    
            Reviewed by Darin Adler.
    
            setTargetAttributeAnimatedValue should check for a null shadowTreeElement.
            https://bugs.webkit.org/show_bug.cgi?id=51576
    
            * svg/custom/animate-disallowed-use-element-expected.txt: Added.
            * svg/custom/animate-disallowed-use-element.svg: Added.
    2010-12-24  Justin Schuh  <jschuh at chromium.org>
    
            Reviewed by Darin Adler.
    
            setTargetAttributeAnimatedValue should check for a null shadowTreeElement.
            https://bugs.webkit.org/show_bug.cgi?id=51576
    
            Disallowed elements may be pruned from the shadow tree, leaving a null
            shadowTreeElement. We should check for that before setting attributes.
    
            Test: svg/custom/animate-disallowed-use-element.svg
    
            * svg/SVGAnimationElement.cpp:
            (WebCore::SVGAnimationElement::setTargetAttributeAnimatedValue):
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@74629 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index 70498be..82d5947 100644
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,13 @@
+2010-12-24  Justin Schuh  <jschuh at chromium.org>
+
+        Reviewed by Darin Adler.
+
+        setTargetAttributeAnimatedValue should check for a null shadowTreeElement.
+        https://bugs.webkit.org/show_bug.cgi?id=51576
+
+        * svg/custom/animate-disallowed-use-element-expected.txt: Added.
+        * svg/custom/animate-disallowed-use-element.svg: Added.
+
 2010-12-24  Andrei Popescu  <andreip at google.com>
 
         Unreviewed build fix.
diff --git a/LayoutTests/svg/custom/animate-disallowed-use-element-expected.txt b/LayoutTests/svg/custom/animate-disallowed-use-element-expected.txt
new file mode 100644
index 0000000..07ad6c4
--- /dev/null
+++ b/LayoutTests/svg/custom/animate-disallowed-use-element-expected.txt
@@ -0,0 +1 @@
+PASS: Animating pruned shadow tree did not cause a crash.
diff --git a/LayoutTests/svg/custom/animate-disallowed-use-element.svg b/LayoutTests/svg/custom/animate-disallowed-use-element.svg
new file mode 100644
index 0000000..937444e
--- /dev/null
+++ b/LayoutTests/svg/custom/animate-disallowed-use-element.svg
@@ -0,0 +1,18 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
+    <script>
+        window.onload = function() {
+            if (window.layoutTestController) {
+                layoutTestController.dumpAsText();
+                layoutTestController.waitUntilDone();
+                setTimeout(function(){ layoutTestController.notifyDone() }, 0);
+            }
+        }
+    </script>
+    <defs>
+        <animate id="animate" />
+    </defs>
+    <use xlink:href="#inner_use" />
+    <use id="inner_use" xlink:href="#animate" />
+    <set from="0" to="10" dur="0.1s" xlink:href="#animate" attributeName="x" />
+    <text x="20" y="20" fill="green">PASS: Animating pruned shadow tree did not cause a crash.</text>
+</svg>
diff --git a/WebCore/ChangeLog b/WebCore/ChangeLog
index 722da11..4683aaf 100644
--- a/WebCore/ChangeLog
+++ b/WebCore/ChangeLog
@@ -1,3 +1,18 @@
+2010-12-24  Justin Schuh  <jschuh at chromium.org>
+
+        Reviewed by Darin Adler.
+
+        setTargetAttributeAnimatedValue should check for a null shadowTreeElement.
+        https://bugs.webkit.org/show_bug.cgi?id=51576
+
+        Disallowed elements may be pruned from the shadow tree, leaving a null
+        shadowTreeElement. We should check for that before setting attributes.
+
+        Test: svg/custom/animate-disallowed-use-element.svg
+
+        * svg/SVGAnimationElement.cpp:
+        (WebCore::SVGAnimationElement::setTargetAttributeAnimatedValue):
+
 2010-12-24  Evan Martin  <evan at chromium.org>
 
         Reviewed by Darin Adler.
diff --git a/WebCore/svg/SVGAnimationElement.cpp b/WebCore/svg/SVGAnimationElement.cpp
index 2acb085..0fcda6d 100644
--- a/WebCore/svg/SVGAnimationElement.cpp
+++ b/WebCore/svg/SVGAnimationElement.cpp
@@ -352,7 +352,8 @@ void SVGAnimationElement::setTargetAttributeAnimatedValue(const String& value)
     const HashSet<SVGElementInstance*>::const_iterator end = instances.end();
     for (HashSet<SVGElementInstance*>::const_iterator it = instances.begin(); it != end; ++it) {
         SVGElement* shadowTreeElement = (*it)->shadowTreeElement();
-        ASSERT(shadowTreeElement);
+        if (!shadowTreeElement)
+            continue;
         if (isCSS)
             shadowTreeElement->style()->setProperty(attributeName, value, "", ec);
         else

-- 
WebKit Debian packaging