Skip to content
  • commit-queue@webkit.org's avatar
    Source/WebCore: Crash due to bad data in SVGDocumentExtensions m_pendingResources · bfd3b665
    commit-queue@webkit.org authored
    https://bugs.webkit.org/show_bug.cgi?id=67488
    
    Patch by Ken Buchanan <kenrb@chromium.org> on 2011-09-10
    Reviewed by Nikolas Zimmermann.
    
    Resolving a crash condition caused by the deletion of
    elements while pending resource entries for those elements are still
    recorded.
    
    * rendering/svg/RenderSVGResourceContainer.cpp:
    (WebCore::RenderSVGResourceContainer::registerResource)
    * svg/SVGDocumentExtensions.h:
    (WebCore::SVGDocumentExtensions::isElementInPendingResources)
    * svg/SVGDocumentExtensions.cpp:
    (WebCore::SVGDocumentExtensions::addPendingResource)
    (WebCore::SVGDocumentExtensions::isElementInPendingResources)
    (WebCore::SVGDocumentExtensions::removeElementFromPendingResources)
    * svg/SVGStyledElement.h:
    (WebCore::SVGStyledElement::clearHasPendingResourcesIfPossible)
    * svg/SVGStyledElement.cpp:
    (WebCore::SVGStyledElement::buildPendingResourcesIfNeeded)
    (WebCore::SVGStyledElement::clearHasPendingResourcesIfPossible)
    * svg/SVGUseElement.cpp:
    (WebCore::SVGUseElement::svgAttributeChanged)
    
    LayoutTests: Crash due to bad data in SVGDocumentExtensions m_pendingResources.
    https://bugs.webkit.org/show_bug.cgi?id=67488
    
    Patch by Ken Buchanan <kenrb@chromium.org> on 2011-09-10
    Reviewed by Nikolas Zimmermann.
    
    Test added: validating that the crash referenced in the bug is not present.
    
    * svg/dom/SVGStyledElement-pendingResource-crash.html: Added.
    * svg/dom/SVGStyledElement-pendingResource-crash-expected.txt: Added.
    * svg/dom/resources/SVGStyledElement-pendingResource-crash.svg: Added.
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@94905 268f45cc-cd09-0410-ab3c-d52691b4dbfc
    bfd3b665