Commit 6bb6e21c authored by pdr@google.com's avatar pdr@google.com

Allow lazy initialization of SVG XML animated properties.

https://bugs.webkit.org/show_bug.cgi?id=84657

Reviewed by Tim Horton.

Source/WebCore:

When animating a property in the shadow tree, instance properties and tearoffs are created
but they simply reference the animated element's animating properties.

When starting an animation for the first time (see SVGAnimateElement::resetAnimatedType),
we initialize the root property and instance properties using startAnimValAnimation(...).
If an instance property is added while the root property is animating, this initialization
will not occur and we crash.

This patch updates the resetAnimValToBaseVal codepath to start (and initialize) an animated
property if it is not already animating. After this patch, instance properties can be added
in the middle of animation and they will be properly started/initialized.

Test: svg/animations/use-while-animating-crash.html

* svg/SVGAnimatedTypeAnimator.h:
(WebCore::SVGAnimatedTypeAnimator::resetFromBaseValue):
(WebCore::SVGAnimatedTypeAnimator::resetFromBaseValues):
(WebCore::SVGAnimatedTypeAnimator::executeAction):

LayoutTests:

* platform/mac/svg/animations/use-while-animating-crash-expected.txt: Added.
* svg/animations/use-while-animating-crash.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@131631 268f45cc-cd09-0410-ab3c-d52691b4dbfc
parent f530d882
2012-10-17 Philip Rogers <pdr@google.com>
Allow lazy initialization of SVG XML animated properties.
https://bugs.webkit.org/show_bug.cgi?id=84657
Reviewed by Tim Horton.
* platform/mac/svg/animations/use-while-animating-crash-expected.txt: Added.
* svg/animations/use-while-animating-crash.html: Added.
2012-10-17 Dan Carney <dcarney@google.com>
Bind isolatedWorldSecurityOrigin to world
......
<!DOCTYPE html>
<!-- Test for WK84657 - Test passes if the SVG animation does not crash and "PASS" is printed. -->
<html>
<head>
<script>
function crash() {
var useRectElement = document.getElementById('useRect');
useRectElement.setAttributeNS("http://www.w3.org/1999/xlink", "href", "#rect");
}
function startTest() {
if (window.testRunner) {
testRunner.waitUntilDone();
testRunner.dumpAsText();
}
var svgElement = document.getElementById('svg');
window.setTimeout(function() {
crash();
window.setTimeout(function() {
svgElement.setCurrentTime(100);
document.write("PASS");
if (window.testRunner)
testRunner.notifyDone();
}, 20); // This needs to be at least 20 to ensure an animation cycle runs.
}, 1);
}
</script>
</head>
<body onload="startTest()">
<svg id="svg" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
<defs>
<rect id="rect" x="100px" y="100px" width="100px" height="100px" fill="green">
<animate attributeName="x" from="100" to="0" begin="0s" dur="5s" repeatCount="1"/>
</rect>
</defs>
<use x="100px" y="100px" xlink:href="#rect"/>
<use id="useRect" x="100px" y="200px"/>
</svg>
</body>
</html>
2012-10-17 Philip Rogers <pdr@google.com>
Allow lazy initialization of SVG XML animated properties.
https://bugs.webkit.org/show_bug.cgi?id=84657
Reviewed by Tim Horton.
When animating a property in the shadow tree, instance properties and tearoffs are created
but they simply reference the animated element's animating properties.
When starting an animation for the first time (see SVGAnimateElement::resetAnimatedType),
we initialize the root property and instance properties using startAnimValAnimation(...).
If an instance property is added while the root property is animating, this initialization
will not occur and we crash.
This patch updates the resetAnimValToBaseVal codepath to start (and initialize) an animated
property if it is not already animating. After this patch, instance properties can be added
in the middle of animation and they will be properly started/initialized.
Test: svg/animations/use-while-animating-crash.html
* svg/SVGAnimatedTypeAnimator.h:
(WebCore::SVGAnimatedTypeAnimator::resetFromBaseValue):
(WebCore::SVGAnimatedTypeAnimator::resetFromBaseValues):
(WebCore::SVGAnimatedTypeAnimator::executeAction):
2012-10-17 Dan Carney <dcarney@google.com>
Bind isolatedWorldSecurityOrigin to world
......
......@@ -150,7 +150,10 @@ protected:
ASSERT(animatedTypes[0].properties.size() == 1);
ASSERT(type);
ASSERT(type->type() == m_type);
(type->*getter)() = castAnimatedPropertyToActualType<AnimValType>(animatedTypes[0].properties[0].get())->currentBaseValue();
typename AnimValType::ContentType& animatedTypeValue = (type->*getter)();
animatedTypeValue = castAnimatedPropertyToActualType<AnimValType>(animatedTypes[0].properties[0].get())->currentBaseValue();
executeAction<AnimValType>(StartAnimationAction, animatedTypes, 0, &animatedTypeValue);
}
template<typename AnimValType>
......@@ -198,6 +201,9 @@ protected:
pair<typename AnimValType1::ContentType, typename AnimValType2::ContentType>& animatedTypeValue = (type->*getter)();
animatedTypeValue.first = castAnimatedPropertyToActualType<AnimValType1>(animatedTypes[0].properties[0].get())->currentBaseValue();
animatedTypeValue.second = castAnimatedPropertyToActualType<AnimValType2>(animatedTypes[0].properties[1].get())->currentBaseValue();
executeAction<AnimValType1>(StartAnimationAction, animatedTypes, 0, &animatedTypeValue.first);
executeAction<AnimValType2>(StartAnimationAction, animatedTypes, 1, &animatedTypeValue.second);
}
template<typename AnimValType1, typename AnimValType2>
......@@ -262,7 +268,8 @@ private:
switch (action) {
case StartAnimationAction:
ASSERT(type);
property->animationStarted(type);
if (!property->isAnimating())
property->animationStarted(type);
break;
case StopAnimationAction:
ASSERT(!type);
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment