Changeset 191403 in webkit

Timestamp:

Oct 21, 2015 2:45:26 PM (9 years ago)

Author:

dino@apple.com

Message:

Null dereference loading Blink layout test svg/filters/display-none-filter-primitive.html
​https://bugs.webkit.org/show_bug.cgi?id=150212
<rdar://problem/23137376>

Reviewed by Brent Fulgham.

Source/WebCore:

Handle the case where a filter element doesn't have a renderer. Inspired by the Blink
commit:
​https://chromium.googlesource.com/chromium/src.git/+/fb79f7fc46552d45127acd2959a23662ad8f271e

Test: svg/filters/display-none-filter-primitive.html

• rendering/svg/RenderSVGResourceFilter.cpp:

(WebCore::RenderSVGResourceFilter::buildPrimitives):

• svg/graphics/filters/SVGFilterBuilder.cpp:

(WebCore::SVGFilterBuilder::appendEffectToEffectReferences):

LayoutTests:

• svg/filters/display-none-filter-primitive-expected.txt: Added.
• svg/filters/display-none-filter-primitive.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/svg/filters/display-none-filter-primitive-expected.txt (added)
• LayoutTests/svg/filters/display-none-filter-primitive.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/rendering/svg/RenderSVGResourceFilter.cpp (modified) (1 diff)
• Source/WebCore/svg/graphics/filters/SVGFilterBuilder.cpp (modified) (2 diffs)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2015-10-21  Dean Jackson  <dino@apple.com>
+
+        Null dereference loading Blink layout test svg/filters/display-none-filter-primitive.html
+        https://bugs.webkit.org/show_bug.cgi?id=150212
+        <rdar://problem/23137376>
+
+        Reviewed by Brent Fulgham.
+
+        * svg/filters/display-none-filter-primitive-expected.txt: Added.
+        * svg/filters/display-none-filter-primitive.html: Added.
+
 2015-10-21  Brady Eidson  <beidson@apple.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2015-10-21  Dean Jackson  <dino@apple.com>
+
+        Null dereference loading Blink layout test svg/filters/display-none-filter-primitive.html
+        https://bugs.webkit.org/show_bug.cgi?id=150212
+        <rdar://problem/23137376>
+
+        Reviewed by Brent Fulgham.
+
+        Handle the case where a filter element doesn't have a renderer. Inspired by the Blink
+        commit:
+        https://chromium.googlesource.com/chromium/src.git/+/fb79f7fc46552d45127acd2959a23662ad8f271e
+
+        Test: svg/filters/display-none-filter-primitive.html
+
+        * rendering/svg/RenderSVGResourceFilter.cpp:
+        (WebCore::RenderSVGResourceFilter::buildPrimitives):
+        * svg/graphics/filters/SVGFilterBuilder.cpp:
+        (WebCore::SVGFilterBuilder::appendEffectToEffectReferences):
+
 2015-10-21  Brady Eidson  <beidson@apple.com>
 

trunk/Source/WebCore/rendering/svg/RenderSVGResourceFilter.cpp

@@ -91 +91 @@
         element.setStandardAttributes(effect.get());
         effect->setEffectBoundaries(SVGLengthContext::resolveRectangle<SVGFilterPrimitiveStandardAttributes>(&element, filterElement().primitiveUnits(), targetBoundingBox));
-        effect->setOperatingColorSpace(element.renderer()->style().svgStyle().colorInterpolationFilters() == CI_LINEARRGB ? ColorSpaceLinearRGB : ColorSpaceDeviceRGB);
+        if (element.renderer())
+            effect->setOperatingColorSpace(element.renderer()->style().svgStyle().colorInterpolationFilters() == CI_LINEARRGB ? ColorSpaceLinearRGB : ColorSpaceDeviceRGB);
         builder->add(element.result(), WTF::move(effect));
     }

trunk/Source/WebCore/svg/graphics/filters/SVGFilterBuilder.cpp

@@ -67 +67 @@
     // The effect must be a newly created filter effect.
     ASSERT(!m_effectReferences.contains(effect));
-    ASSERT(object && !m_effectRenderer.contains(object));
+    ASSERT(!object || !m_effectRenderer.contains(object));
     m_effectReferences.add(effect, FilterEffectSet());
 
@@ -75 +75 @@
     for (unsigned i = 0; i < numberOfInputEffects; ++i)
         effectReferences(effect->inputEffect(i)).add(effect.get());
-    m_effectRenderer.add(object, effect.get());
+
+    // If object is null, that means the element isn't attached for some
+    // reason, which in turn mean that certain types of invalidation will not
+    // work (the LayoutObject -> FilterEffect mapping will not be defined).
+    if (object)
+        m_effectRenderer.add(object, effect.get());
 }