Skip to content
  • commit-queue@webkit.org's avatar
    Null dereference in SVGDocumentExtensions::removePendingResource when updating <use>'s href · 0dcb8ba8
    commit-queue@webkit.org authored
    https://bugs.webkit.org/show_bug.cgi?id=69284
    
    Patch by Florin Malita <fmalita@google.com> on 2012-01-21
    Reviewed by Nikolas Zimmermann.
    
    Source/WebCore:
    
    Test: svg/custom/use-crash-pending-resource.svg
    
    The crash is caused by assumptions in SVGUseElement that xlink:href is the only
    pending resource. This patch adds support for dealing with multiple pending resources.
    
    * rendering/svg/RenderSVGResourceContainer.cpp:
    (WebCore::RenderSVGResourceContainer::registerResource):
    * svg/SVGDocumentExtensions.cpp:
    (WebCore::SVGDocumentExtensions::hasPendingResource):
    (WebCore::SVGDocumentExtensions::isElementPendingResources):
    (WebCore::SVGDocumentExtensions::isElementPendingResource):
    (WebCore::SVGDocumentExtensions::removePendingResourceForElement):
    * svg/SVGDocumentExtensions.h:
    * svg/SVGStyledElement.cpp:
    (WebCore::SVGStyledElement::buildPendingResourcesIfNeeded):
    (WebCore::SVGStyledElement::clearHasPendingResourcesIfPossible):
    Renamed SVGDocumentExtensions::hasPendingResources -> Renamed SVGDocumentExtensions::hasPendingResource.
    Renamed SVGDocumentExtensions::isElementInPendingResources -> SVGDocumentExtensions::isElementPendingResources.
    Added support for querying and removing pending resources for a specific element.
    
    * svg/SVGUseElement.cpp:
    (WebCore::SVGUseElement::svgAttributeChanged):
    (WebCore::SVGUseElement::buildPendingResource):
    Refactored to support multiple pending resources.
    
    LayoutTests:
    
    * svg/custom/use-crash-pending-resource-expected.txt: Added.
    * svg/custom/use-crash-pending-resource.svg: Added.
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@105573 268f45cc-cd09-0410-ab3c-d52691b4dbfc
    0dcb8ba8