Changeset 239402 in webkit

Timestamp:

Dec 19, 2018, 3:51:03 PM (8 years ago)

Author:

rniwa@webkit.org

Message:

SVGUseElement::findTarget should return nullptr when there is a cycle
​https://bugs.webkit.org/show_bug.cgi?id=192840

Reviewed by Tim Horton.

r233366 added an early return to updateShadowTree() when there is a cycle between an use element and its target.
Consolidate this cycle detection code with the one in SVGUseElement::findTarget which detected cycles when
the SVG use element itself had a corresponding element.

No new tests since there should be no behavioral change.

• svg/SVGUseElement.cpp:

(WebCore::SVGUseElement::updateShadowTree):
(WebCore::SVGUseElement::findTarget const):

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• svg/SVGUseElement.cpp (modified) (3 diffs)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2018-12-18  Ryosuke Niwa  <rniwa@webkit.org>
+
+        SVGUseElement::findTarget should return nullptr when there is a cycle
+        https://bugs.webkit.org/show_bug.cgi?id=192840
+
+        Reviewed by Tim Horton.
+
+        r233366 added an early return to updateShadowTree() when there is a cycle between an use element and its target.
+        Consolidate this cycle detection code with the one in SVGUseElement::findTarget which detected cycles when
+        the SVG use element itself had a corresponding element.
+
+        No new tests since there should be no behavioral change.
+
+        * svg/SVGUseElement.cpp:
+        (WebCore::SVGUseElement::updateShadowTree):
+        (WebCore::SVGUseElement::findTarget const):
+
 2018-12-19  Myles C. Maxfield  <mmaxfield@apple.com>
 

trunk/Source/WebCore/svg/SVGUseElement.cpp

@@ -245 +245 @@
     }
 
-    if (isDescendantOf(target))
-        return;
-    
+    RELEASE_ASSERT(!isDescendantOf(target));
     {
         auto& shadowRoot = ensureUserAgentShadowRoot();
@@ -424 +422 @@
         return nullptr;
 
-    // Reject any target that has already been cloned to create one of the ancestors of this element,
-    // already in the shadow tree. This is sufficient to prevent cycles.
     if (correspondingElement) {
         for (auto& ancestor : lineageOfType<SVGElement>(*this)) {
@@ -431 +427 @@
                 return nullptr;
         }
+    } else {
+        if (target.contains(this))
+            return nullptr;
+        // Target should only refer to a node in the same tree or a node in another document.
+        ASSERT(!isDescendantOrShadowDescendantOf(&target));
     }