Changeset 179772 in webkit

Timestamp:

Feb 6, 2015, 5:24:48 PM (12 years ago)

Author:

Said Abou-Hallawa

Message:

 

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/svg/animations/animate-montion-invalid-attribute-expected.svg (added)
• LayoutTests/svg/animations/animate-montion-invalid-attribute.svg (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/svg/SVGAnimateElementBase.cpp (modified) (1 diff)
• Source/WebCore/svg/SVGAnimationElement.cpp (modified) (1 diff)
• Source/WebCore/svg/SVGAnimationElement.h (modified) (2 diffs)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2015-02-06  Said Abou-Hallawa  <sabouhallawa@apple.com>
+
+        Invalid cast in WebCore::SVGAnimateElement::calculateAnimatedValue.
+        https://bugs.webkit.org/show_bug.cgi?id=135171.
+
+        Reviewed by Dean Jackson.
+
+        * svg/animations/animate-montion-invalid-attribute-expected.svg: Added.
+        * svg/animations/animate-montion-invalid-attribute.svg: Added.
+        Make sure that adding the same attribute to <animateMotion> and <animate>, which both
+        animate the same target element, will be ignored and we won't crash.
+
 2015-02-06  Simon Fraser  <simon.fraser@apple.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2015-02-06  Said Abou-Hallawa  <sabouhallawa@apple.com>
+
+        Invalid cast in WebCore::SVGAnimateElement::calculateAnimatedValue.
+        https://bugs.webkit.org/show_bug.cgi?id=135171.
+
+        Reviewed by Dean Jackson.
+
+        The bug happens when an SVG element is animated by <animateMotion> followed by an
+        <animateColor> or an <animate> and the values of the "attributeName" in both elements
+        are the same. The problem is <animateMotion> should not have an attribute to animate.
+        If it does by fuzz or by mistake, then we assume the <animateMotion> and the <animate>
+        animate the same attribute for the same element target. Therefore we schedule them in
+        the same AnimationVector in SMILTimeContainer::schedule(). When we call
+        SVGAnimateElementBase::calculateAnimatedValue() for an SVGAnimateColorElement and the
+        resultElement is SVGAnimateMotionElement, we fail to cast it to SVGAnimateElementBase
+        because SVGAnimateMotionElement is derived from SVGAnimationElement which is the base
+        class of all animate elements including SVGAnimateElementBase.
+
+        The fix is to nullify setting "attributeName" of an SVGAnimationElement. By doing so,
+        "attributeName" and its value will be ignored from the <animateMotion> which is correct.
+        
+        Tests: svg/animations/animate-montion-invalid-attribute.svg.
+
+        * svg/SVGAnimateElementBase.cpp:
+        (WebCore::SVGAnimateElementBase::setAttributeName):
+        Do not call SVGAnimationElement::setAttributeName() since SVGAnimationElement should
+        not have an attribute to animate. We prevent this by bypassing the parent in the class 
+        hierarchy: SVGAnimationElement and calling SVGSMILElement::setAttributeName() directly.
+        
+        * svg/SVGAnimationElement.cpp:
+        (WebCore::SVGAnimationElement::setAttributeName): Deleted.
+        * svg/SVGAnimationElement.h:
+        SVGAnimationElement should not have an attribute to animate. So implement its
+        setAttributeName() as a null function.
+
 2015-02-06  Simon Fraser  <simon.fraser@apple.com>
 

trunk/Source/WebCore/svg/SVGAnimateElementBase.cpp

@@ -425 +425 @@
 void SVGAnimateElementBase::setAttributeName(const QualifiedName& attributeName)
 {
-    SVGAnimationElement::setAttributeName(attributeName);
+    SVGSMILElement::setAttributeName(attributeName);
+    checkInvalidCSSAttributeType(targetElement());
     resetAnimatedPropertyType();
 }

trunk/Source/WebCore/svg/SVGAnimationElement.cpp

@@ -692 +692 @@
 }
 
-void SVGAnimationElement::setAttributeName(const QualifiedName& attributeName)
-{
-    SVGSMILElement::setAttributeName(attributeName);
-    checkInvalidCSSAttributeType(targetElement());
-}
-
 void SVGAnimationElement::checkInvalidCSSAttributeType(SVGElement* target)
 {

trunk/Source/WebCore/svg/SVGAnimationElement.h

@@ -195 +195 @@
 
     virtual void setTargetElement(SVGElement*) override;
-    virtual void setAttributeName(const QualifiedName&) override;
+    virtual void setAttributeName(const QualifiedName&) override { }
     bool hasInvalidCSSAttributeType() const { return m_hasInvalidCSSAttributeType; }
+    void checkInvalidCSSAttributeType(SVGElement*);
 
     virtual void updateAnimationMode();
@@ -205 +206 @@
     virtual void animationAttributeChanged() override;
     void setAttributeType(const AtomicString&);
-
-    void checkInvalidCSSAttributeType(SVGElement*);
 
     virtual bool calculateToAtEndOfDurationValue(const String& toAtEndOfDurationString) = 0;