source: trunk/Source/WebCore/svg/SVGAnimatedTypeAnimator.h @ 108134

Revision 108134, 2.5 KB checked in by commit-queue@webkit.org, 3 years ago (diff)

Crash in SVGAnimateElement due to changed target
https://bugs.webkit.org/show_bug.cgi?id=75096

Patch by Stephen Chenney <schenney@chromium.org> on 2012-02-17
Reviewed by Nikolas Zimmermann.

Source/WebCore:

The SVGAnimateElement object creates various internal objects
depending on the type of property being animated, which depends on the
target. These objects were not being recreated when the target
changed, and crashes ensued. Now the SVGSMILElement provides a virtual
method that is called when the target changes, and SVGAnimateElement
updates its objects as necessary. We also deactivate the animation
when the target changes, forcing recomputation of other derived
objects.

This change also removes various unnecessary calls to semi-expensive
methods.

Not only does this change fix the new test, it also fixes potential
crashes in other tests that apparently never manifested before (but
manifest when this new test is included in DRT).

Test: svg/animations/svglength-animation-retarget-crash.html

  • svg/SVGAnimateElement.cpp:

(WebCore::SVGAnimateElement::hasValidAttributeType):
(WebCore::SVGAnimateElement::calculateAnimatedValue):
(WebCore::SVGAnimateElement::calculateFromAndToValues):
(WebCore::SVGAnimateElement::calculateFromAndByValues):
(WebCore::SVGAnimateElement::resetToBaseValue):
(WebCore::SVGAnimateElement::calculateDistance):
(WebCore):
(WebCore::SVGAnimateElement::targetElementDidChange):

  • svg/SVGAnimateElement.h:

(SVGAnimateElement):

  • svg/SVGAnimatedTypeAnimator.h:

(SVGAnimatedTypeAnimator):
(WebCore::SVGAnimatedTypeAnimator::type):

  • svg/animation/SVGSMILElement.cpp:

(WebCore::SVGSMILElement::targetElement):
(WebCore::SVGSMILElement::resetTargetElement):
(WebCore):

  • svg/animation/SVGSMILElement.h:

(SVGSMILElement):
(WebCore::SVGSMILElement::targetElementDidChange):

LayoutTests:

This test verifies that the target element information is correctly
updated when the target changes. Note that the clone is required, as
it causes the results of one animation to be pushed to a different
animation.

  • svg/animations/svglength-animation-retarget-crash-expected.txt: Added.
  • svg/animations/svglength-animation-retarget-crash.html: Added.
  • Property svn:eol-style set to native
Line 
1/*
2 * Copyright (C) Research In Motion Limited 2011. All rights reserved.
3 *
4 * This library is free software; you can redistribute it and/or
5 * modify it under the terms of the GNU Library General Public
6 * License as published by the Free Software Foundation; either
7 * version 2 of the License, or (at your option) any later version.
8 *
9 * This library is distributed in the hope that it will be useful,
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
12 * Library General Public License for more details.
13 *
14 * You should have received a copy of the GNU Library General Public License
15 * along with this library; see the file COPYING.LIB.  If not, write to
16 * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
17 * Boston, MA 02110-1301, USA.
18 */
19
20#ifndef SVGAnimatedTypeAnimator_h
21#define SVGAnimatedTypeAnimator_h
22
23#if ENABLE(SVG)
24#include "SVGAnimatedType.h"
25#include <wtf/PassOwnPtr.h>
26
27namespace WebCore {
28
29class SVGAnimationElement;
30
31class SVGAnimatedTypeAnimator {
32    WTF_MAKE_FAST_ALLOCATED;
33public:
34    virtual ~SVGAnimatedTypeAnimator() { }
35    virtual PassOwnPtr<SVGAnimatedType> constructFromString(const String&) = 0;
36   
37    virtual void calculateFromAndToValues(OwnPtr<SVGAnimatedType>& fromValue, OwnPtr<SVGAnimatedType>& toValue, const String& fromString, const String& toString) = 0;
38    virtual void calculateFromAndByValues(OwnPtr<SVGAnimatedType>& fromValue, OwnPtr<SVGAnimatedType>& toValue, const String& fromString, const String& toString) = 0;
39    virtual void calculateAnimatedValue(float percentage, unsigned repeatCount,
40                                        OwnPtr<SVGAnimatedType>& fromValue, OwnPtr<SVGAnimatedType>& toValue, OwnPtr<SVGAnimatedType>& animatedValue) = 0;
41    virtual float calculateDistance(const String& fromString, const String& toString) = 0;
42
43    void setContextElement(SVGElement* contextElement) { m_contextElement = contextElement; }
44
45    AnimatedPropertyType type() const { return m_type; }
46
47protected:
48    SVGAnimatedTypeAnimator(AnimatedPropertyType type, SVGAnimationElement* animationElement, SVGElement* contextElement)
49        : m_type(type)
50        , m_animationElement(animationElement)
51        , m_contextElement(contextElement)
52    {
53    }
54
55    AnimatedPropertyType m_type;
56    SVGAnimationElement* m_animationElement;
57    SVGElement* m_contextElement;
58};
59
60} // namespace WebCore
61
62#endif // ENABLE(SVG)
63#endif // SVGAnimatedTypeAnimator_h
Note: See TracBrowser for help on using the repository browser.