Commit 9cc43765 authored by oliver@apple.com's avatar oliver@apple.com

2010-03-04 Oliver Hunt <oliver@apple.com>

        Reviewed by Maciej Stachowiak.

        https://bugs.webkit.org/show_bug.cgi?id=35603
        SVG incorrectly allows nested <use> elements in a <use> shadow tree

        Simplify the handling of invalid or missing use-targets by cloning them
        to empty <g> elements rather than just allowing the <use> element to
        be copied into the shadow tree, as this violates a number of assumptions
        in the shadow tree handling code.

        Tests: svg/custom/use-nested-disallowed-target.svg
               svg/custom/use-nested-missing-target-added.svg
               svg/custom/use-nested-missing-target-removed.svg
               svg/custom/use-nested-missing-target.svg
               svg/custom/use-nested-notarget.svg

        * svg/SVGUseElement.cpp:
        (WebCore::SVGUseElement::buildPendingResource):
        (WebCore::SVGUseElement::buildShadowAndInstanceTree):
        (WebCore::SVGUseElement::expandUseElementsInShadowTree):

2010-03-04  Oliver Hunt  <oliver@apple.com>

        Reviewed by Maciej Stachowiak.

        https://bugs.webkit.org/show_bug.cgi?id=35603
        SVG incorrectly allows nested <use> elements in a <use> shadow tree

        Add test cases for various combinations of <use> and targets that aren't present.

        * platform/mac/svg/custom/use-empty-reference-expected.txt: Added.
        * svg/custom/use-nested-disallowed-target-expected.txt: Added.
        * svg/custom/use-nested-disallowed-target.svg: Added.
        * svg/custom/use-nested-missing-target-added-expected.txt: Added.
        * svg/custom/use-nested-missing-target-added.svg: Added.
        * svg/custom/use-nested-missing-target-expected.txt: Added.
        * svg/custom/use-nested-missing-target-removed-expected.txt: Added.
        * svg/custom/use-nested-missing-target-removed.svg: Added.
        * svg/custom/use-nested-missing-target.svg: Added.
        * svg/custom/use-nested-notarget-expected.txt: Added.
        * svg/custom/use-nested-notarget.svg: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@55511 268f45cc-cd09-0410-ab3c-d52691b4dbfc
parent b25a5690
2010-03-04 Oliver Hunt <oliver@apple.com>
Reviewed by Maciej Stachowiak.
https://bugs.webkit.org/show_bug.cgi?id=35603
SVG incorrectly allows nested <use> elements in a <use> shadow tree
Add test cases for various combinations of <use> and targets that aren't present.
* platform/mac/svg/custom/use-empty-reference-expected.txt: Added.
* svg/custom/use-nested-disallowed-target-expected.txt: Added.
* svg/custom/use-nested-disallowed-target.svg: Added.
* svg/custom/use-nested-missing-target-added-expected.txt: Added.
* svg/custom/use-nested-missing-target-added.svg: Added.
* svg/custom/use-nested-missing-target-expected.txt: Added.
* svg/custom/use-nested-missing-target-removed-expected.txt: Added.
* svg/custom/use-nested-missing-target-removed.svg: Added.
* svg/custom/use-nested-missing-target.svg: Added.
* svg/custom/use-nested-notarget-expected.txt: Added.
* svg/custom/use-nested-notarget.svg: Added.
2010-03-04 Evan Stade <estade@chromium.org>
Reviewed by David Levin.
......
......@@ -3,3 +3,4 @@ layer at (0,0) size 800x600
layer at (0,0) size 800x600
RenderSVGRoot {svg} at (0,0) size 800x600
RenderSVGContainer {use} at (0,0) size 0x0
RenderSVGContainer {g} at (0,0) size 0x0
<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" onload="runTest()">
<script type="text/javascript">
<![CDATA[
function runTest() {
if (window.layoutTestController)
layoutTestController.dumpAsText();
}
]]>
</script>
<def>
<foreignObject id="badness"/>
</def>
<text y="30" id="myText" fill="green">PASS</text>
<use id="use1" xlink:href="#badness"/>
<use x="50" id="use2" xlink:href="#use1"></use>
<use y="50" id="use3" xlink:href="#use2"></use>
<use x="-50" id="use4" xlink:href="#use3"></use>
</svg>
<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" onload="runTest()">
<script type="text/javascript">
<![CDATA[
function runTest() {
if (window.layoutTestController)
layoutTestController.dumpAsText();
document.getElementById("myText1").id = "myText";
}
]]>
</script>
<def>
<text id="myText1" fill="green" x="0" y="0">PASS</text>
</def>
<use y="30" id="use1" xlink:href="#myText"/>
<use y="30" xlink:href="#use1"/>
</svg>
CONSOLE MESSAGE: line 7: TypeError: Result of expression 'document.getElementById("myText1")' [null] is not an object.
PASS
<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" onload="runTest()">
<script type="text/javascript">
<![CDATA[
function runTest() {
if (window.layoutTestController)
layoutTestController.dumpAsText();
document.getElementById("myText1").id = "myText1";
}
]]>
</script>
<text y="30" id="myText" fill="green">PASS</text>
<use y="30" id="use1" xlink:href="#myText"/>
<use y="30" xlink:href="#use1"/>
</svg>
<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" onload="runTest()">
<script type="text/javascript">
<![CDATA[
function runTest() {
if (window.layoutTestController)
layoutTestController.dumpAsText();
}
]]>
</script>
<text y="30" id="myText" fill="green">PASS</text>
<use id="use1" xlink:href="#missing"/>
<use x="50" id="use2" xlink:href="#use1"></use>
<use y="50" id="use3" xlink:href="#use2"></use>
<use x="-50" id="use4" xlink:href="#use3"></use>
</svg>
<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" onload="runTest()">
<script type="text/javascript">
<![CDATA[
function runTest() {
if (window.layoutTestController)
layoutTestController.dumpAsText();
}
]]>
</script>
<text y="30" id="myText" fill="green">PASS</text>
<use id="use1"/>
<use x="50" id="use2" xlink:href="#use1"></use>
<use y="50" id="use3" xlink:href="#use2"></use>
<use x="-50" id="use4" xlink:href="#use3"></use>
</svg>
2010-03-04 Oliver Hunt <oliver@apple.com>
Reviewed by Maciej Stachowiak.
https://bugs.webkit.org/show_bug.cgi?id=35603
SVG incorrectly allows nested <use> elements in a <use> shadow tree
Simplify the handling of invalid or missing use-targets by cloning them
to empty <g> elements rather than just allowing the <use> element to
be copied into the shadow tree, as this violates a number of assumptions
in the shadow tree handling code.
Tests: svg/custom/use-nested-disallowed-target.svg
svg/custom/use-nested-missing-target-added.svg
svg/custom/use-nested-missing-target-removed.svg
svg/custom/use-nested-missing-target.svg
svg/custom/use-nested-notarget.svg
* svg/SVGUseElement.cpp:
(WebCore::SVGUseElement::buildPendingResource):
(WebCore::SVGUseElement::buildShadowAndInstanceTree):
(WebCore::SVGUseElement::expandUseElementsInShadowTree):
2010-03-04 Leandro Pereira <leandro@profusion.mobi>
Reviewed by Gustavo Noronha Silva.
......
......@@ -414,7 +414,7 @@ void SVGUseElement::buildPendingResource()
ASSERT(!m_targetElementInstance);
if (!targetElement) {
if (m_isPendingResource)
if (m_isPendingResource || id.isEmpty())
return;
m_isPendingResource = true;
......@@ -434,7 +434,12 @@ void SVGUseElement::buildShadowAndInstanceTree(SVGShadowTreeRootElement* shadowR
{
String id = SVGURIReference::getTarget(href());
Element* targetElement = document()->getElementById(id);
ASSERT(targetElement);
if (!targetElement) {
// The only time we should get here is when the use element has not been
// given a resource to target.
ASSERT(m_resourceId.isEmpty());
return;
}
// Do not build the shadow/instance tree for <use> elements living in a shadow tree.
// The will be expanded soon anyway - see expandUseElementsInShadowTree().
......@@ -740,27 +745,15 @@ void SVGUseElement::expandUseElementsInShadowTree(SVGShadowTreeRootElement* shad
target = static_cast<SVGElement*>(targetElement);
// Don't ASSERT(target) here, it may be "pending", too.
if (target) {
// Setup sub-shadow tree root node
RefPtr<SVGShadowTreeContainerElement> cloneParent = new SVGShadowTreeContainerElement(document());
// Spec: In the generated content, the 'use' will be replaced by 'g', where all attributes from the
// 'use' element except for x, y, width, height and xlink:href are transferred to the generated 'g' element.
transferUseAttributesToReplacedElement(use, cloneParent.get());
ExceptionCode ec = 0;
// For instance <use> on <foreignObject> (direct case).
if (isDisallowedElement(target)) {
// We still have to setup the <use> replacment (<g>). Otherwhise
// associateInstancesWithShadowTreeElements() makes wrong assumptions.
// Replace <use> with referenced content.
ASSERT(use->parentNode());
use->parentNode()->replaceChild(cloneParent.release(), use, ec);
ASSERT(!ec);
return;
}
// Setup sub-shadow tree root node
RefPtr<SVGShadowTreeContainerElement> cloneParent = new SVGShadowTreeContainerElement(document());
// Spec: In the generated content, the 'use' will be replaced by 'g', where all attributes from the
// 'use' element except for x, y, width, height and xlink:href are transferred to the generated 'g' element.
transferUseAttributesToReplacedElement(use, cloneParent.get());
ExceptionCode ec = 0;
if (target && !isDisallowedElement(target)) {
RefPtr<Element> newChild = target->cloneElementWithChildren();
// We don't walk the target tree element-by-element, and clone each element,
......@@ -778,16 +771,16 @@ void SVGUseElement::expandUseElementsInShadowTree(SVGShadowTreeRootElement* shad
cloneParent->appendChild(newChild.release(), ec);
ASSERT(!ec);
}
// Replace <use> with referenced content.
ASSERT(use->parentNode());
use->parentNode()->replaceChild(cloneParent.release(), use, ec);
ASSERT(!ec);
// Replace <use> with referenced content.
ASSERT(use->parentNode());
use->parentNode()->replaceChild(cloneParent.release(), use, ec);
ASSERT(!ec);
// Immediately stop here, and restart expanding.
expandUseElementsInShadowTree(shadowRoot, shadowRoot);
return;
}
// Immediately stop here, and restart expanding.
expandUseElementsInShadowTree(shadowRoot, shadowRoot);
return;
}
for (RefPtr<Node> child = element->firstChild(); child; child = child->nextSibling())
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment