Commit 35bcdf7b authored by commit-queue@webkit.org's avatar commit-queue@webkit.org
Browse files

2010-09-06 Shane Stephens <shanestephens@google.com>

        Reviewed by Dimitri Glazkov.

        [Crash] <animateMotion> element directly inside <symbol> element causes crash when referenced by <use>
        https://bugs.webkit.org/show_bug.cgi?id=44750

        Added test case to demonstrate crash bug.

        * svg/dom/symbol-embeddedAnimation-expected.txt: Added.
        * svg/dom/symbol-embeddedAnimation.svg: Added.
2010-09-06  Shane Stephens  <shanestephens@google.com>

        Reviewed by Dimitri Glazkov.

        [Crash] <animateMotion> element directly inside <symbol> element causes crash when referenced by <use>
        https://bugs.webkit.org/show_bug.cgi?id=44750

        Fixes crash by checking for null transforms and skipping update step
        when appropriate.

        Test: svg/dom/symbol-embeddedAnimation.svg

        * svg/SVGAnimateMotionElement.cpp:
        (WebCore::SVGAnimateMotionElement::applyResultsToTarget):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@66836 268f45cc-cd09-0410-ab3c-d52691b4dbfc
parent 060fbc68
2010-09-06 Shane Stephens <shanestephens@google.com>
Reviewed by Dimitri Glazkov.
[Crash] <animateMotion> element directly inside <symbol> element causes crash when referenced by <use>
https://bugs.webkit.org/show_bug.cgi?id=44750
Added test case to demonstrate crash bug.
* svg/dom/symbol-embeddedAnimation-expected.txt: Added.
* svg/dom/symbol-embeddedAnimation.svg: Added.
2010-09-06 Martin Robinson <mrobinson@igalia.com>
 
Unskip a couple of plugin tests which are now passing.
<?xml version="1.0" standalone="no"?>
<svg version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
<!-- use of animateMotion inside symbol tag should not crash -->
<use xlink:href="#crash"/>
<a id="crash">
<symbol>
<animateMotion/>
</symbol>
</a>
<text>Survived the crash!</text>
<script>
if (window.layoutTestController)
layoutTestController.dumpAsText();
</script>
</svg>
2010-09-06 Shane Stephens <shanestephens@google.com>
Reviewed by Dimitri Glazkov.
[Crash] <animateMotion> element directly inside <symbol> element causes crash when referenced by <use>
https://bugs.webkit.org/show_bug.cgi?id=44750
Fixes crash by checking for null transforms and skipping update step
when appropriate.
Test: svg/dom/symbol-embeddedAnimation.svg
* svg/SVGAnimateMotionElement.cpp:
(WebCore::SVGAnimateMotionElement::applyResultsToTarget):
2010-09-06 Xan Lopez <xlopez@igalia.com>
 
Rubber-stamped by Tor Arne Vestbø.
......@@ -222,6 +222,10 @@ void SVGAnimateMotionElement::applyResultsToTarget()
if (RenderObject* renderer = targetElement->renderer())
RenderSVGResource::markForLayoutAndParentResourceInvalidation(renderer);
AffineTransform* t = targetElement->supplementalTransform();
if (!t)
return;
// ...except in case where we have additional instances in <use> trees.
const HashSet<SVGElementInstance*>& instances = targetElement->instancesForElement();
const HashSet<SVGElementInstance*>::const_iterator end = instances.end();
......@@ -229,7 +233,8 @@ void SVGAnimateMotionElement::applyResultsToTarget()
SVGElement* shadowTreeElement = (*it)->shadowTreeElement();
ASSERT(shadowTreeElement);
AffineTransform* transform = shadowTreeElement->supplementalTransform();
AffineTransform* t = targetElement->supplementalTransform();
if (!transform)
continue;
transform->setMatrix(t->a(), t->b(), t->c(), t->d(), t->e(), t->f());
if (RenderObject* renderer = shadowTreeElement->renderer()) {
renderer->setNeedsTransformUpdate();
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment