Changeset 242856 in webkit

Timestamp:

Mar 13, 2019, 1:24:34 AM (7 years ago)

Author:

bshafiei@apple.com

Message:

Cherry-pick r242515. rdar://problem/48839275

SVGPathSegList.insertItemBefore() should fail if the newItem belongs to an animating animPathSegList
​https://bugs.webkit.org/show_bug.cgi?id=195333
<rdar://problem/48475802>

Reviewed by Simon Fraser.

Source/WebCore:

Because the SVG1.1 specs states that the newItem should be removed from
its original list before adding it to another list,
SVGPathSegList.insertItemBefore() should fail if the new item belongs to
an animating animPathSegList since it is read-only.

Test: svg/dom/SVGPathSegList-insert-from-animating-animPathSegList.svg

• svg/SVGPathSegList.cpp: (WebCore::SVGPathSegList::processIncomingListItemValue):

LayoutTests:

• svg/dom/SVGPathSegList-insert-from-animating-animPathSegList-expected.txt: Added.
• svg/dom/SVGPathSegList-insert-from-animating-animPathSegList.svg: Added.

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@242515 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Location:

branches/safari-607-branch

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/svg/dom/SVGPathSegList-insert-from-animating-animPathSegList-expected.txt (added)
• LayoutTests/svg/dom/SVGPathSegList-insert-from-animating-animPathSegList.svg (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/svg/SVGPathSegList.cpp (modified) (1 diff)

branches/safari-607-branch/LayoutTests/ChangeLog

@@ +1 @@
+2019-03-13  Babak Shafiei  <bshafiei@apple.com>
+
+        Cherry-pick r242515. rdar://problem/48839275
+
+    SVGPathSegList.insertItemBefore() should fail if the newItem belongs to an animating animPathSegList
+    https://bugs.webkit.org/show_bug.cgi?id=195333
+    <rdar://problem/48475802>
+    
+    Reviewed by Simon Fraser.
+    
+    Source/WebCore:
+    
+    Because the SVG1.1 specs states that the newItem should be removed from
+    its original list before adding it to another list,
+    SVGPathSegList.insertItemBefore() should fail if the new item belongs to
+    an animating animPathSegList since it is read-only.
+    
+    Test: svg/dom/SVGPathSegList-insert-from-animating-animPathSegList.svg
+    
+    * svg/SVGPathSegList.cpp:
+    (WebCore::SVGPathSegList::processIncomingListItemValue):
+    
+    LayoutTests:
+    
+    * svg/dom/SVGPathSegList-insert-from-animating-animPathSegList-expected.txt: Added.
+    * svg/dom/SVGPathSegList-insert-from-animating-animPathSegList.svg: Added.
+    
+    
+    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@242515 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+    2019-03-05  Said Abou-Hallawa  <sabouhallawa@apple.com>
+
+            SVGPathSegList.insertItemBefore() should fail if the newItem belongs to an animating animPathSegList
+            https://bugs.webkit.org/show_bug.cgi?id=195333
+            <rdar://problem/48475802>
+
+            Reviewed by Simon Fraser.
+
+            * svg/dom/SVGPathSegList-insert-from-animating-animPathSegList-expected.txt: Added.
+            * svg/dom/SVGPathSegList-insert-from-animating-animPathSegList.svg: Added.
+
 2019-03-13  Babak Shafiei  <bshafiei@apple.com>
 

branches/safari-607-branch/Source/WebCore/ChangeLog

@@ +1 @@
+2019-03-13  Babak Shafiei  <bshafiei@apple.com>
+
+        Cherry-pick r242515. rdar://problem/48839275
+
+    SVGPathSegList.insertItemBefore() should fail if the newItem belongs to an animating animPathSegList
+    https://bugs.webkit.org/show_bug.cgi?id=195333
+    <rdar://problem/48475802>
+    
+    Reviewed by Simon Fraser.
+    
+    Source/WebCore:
+    
+    Because the SVG1.1 specs states that the newItem should be removed from
+    its original list before adding it to another list,
+    SVGPathSegList.insertItemBefore() should fail if the new item belongs to
+    an animating animPathSegList since it is read-only.
+    
+    Test: svg/dom/SVGPathSegList-insert-from-animating-animPathSegList.svg
+    
+    * svg/SVGPathSegList.cpp:
+    (WebCore::SVGPathSegList::processIncomingListItemValue):
+    
+    LayoutTests:
+    
+    * svg/dom/SVGPathSegList-insert-from-animating-animPathSegList-expected.txt: Added.
+    * svg/dom/SVGPathSegList-insert-from-animating-animPathSegList.svg: Added.
+    
+    
+    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@242515 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+    2019-03-05  Said Abou-Hallawa  <sabouhallawa@apple.com>
+
+            SVGPathSegList.insertItemBefore() should fail if the newItem belongs to an animating animPathSegList
+            https://bugs.webkit.org/show_bug.cgi?id=195333
+            <rdar://problem/48475802>
+
+            Reviewed by Simon Fraser.
+
+            Because the SVG1.1 specs states that the newItem should be removed from
+            its original list before adding it to another list,
+            SVGPathSegList.insertItemBefore() should fail if the new item belongs to
+            an animating animPathSegList since it is read-only.
+
+            Test: svg/dom/SVGPathSegList-insert-from-animating-animPathSegList.svg
+
+            * svg/SVGPathSegList.cpp:
+            (WebCore::SVGPathSegList::processIncomingListItemValue):
+
 2019-03-13  Babak Shafiei  <bshafiei@apple.com>
 

branches/safari-607-branch/Source/WebCore/svg/SVGPathSegList.cpp

@@ -86 +86 @@
     RefPtr<SVGAnimatedPathSegListPropertyTearOff> propertyTearOff = static_pointer_cast<SVGAnimatedPathSegListPropertyTearOff>(animatedPropertyOfItem);
     int indexToRemove = propertyTearOff->findItem(newItem.get());
-    ASSERT(indexToRemove != -1);
+
+    // If newItem does not exist in the propertyTearOff baseVal() list, it has to be
+    // in its animVal() list and it has to be animating.
+    if (indexToRemove == -1) {
+        ASSERT(propertyTearOff->isAnimating());
+        ASSERT(propertyTearOff->animVal()->findItem(newItem.get()) != -1);
+        return false;
+    }
 
     // Do not remove newItem if already in this list at the target index.