Changeset 249026 in webkit

Timestamp:

Aug 22, 2019, 2:13:38 PM (7 years ago)

Author:

Said Abou-Hallawa

Message:

Crash may happen when an SVG <feImage> element references the root <svg> element
​https://bugs.webkit.org/show_bug.cgi?id=201014

Reviewed by Ryosuke Niwa.

Source/WebCore:

When an <feImage> references an <svg> element as its target image but
this <svg> element is also one of the ancestors of the <feImage>, the
parent <filter> should not be applied.

Test: svg/filters/filter-image-ref-root.html

• svg/SVGFEImageElement.cpp:

(WebCore::SVGFEImageElement::build const):

LayoutTests:

Ensure the cyclic reference between the <feImage> renderer and its
ancestor <svg> root renderer is broken.

• svg/filters/filter-image-ref-root-expected.txt: Added.
• svg/filters/filter-image-ref-root.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/svg/filters/filter-image-ref-root-expected.txt (added)
• LayoutTests/svg/filters/filter-image-ref-root.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/svg/SVGFEImageElement.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2019-08-22  Said Abou-Hallawa  <sabouhallawa@apple.com>
+
+        Crash may happen when an SVG <feImage> element references the root <svg> element
+        https://bugs.webkit.org/show_bug.cgi?id=201014
+
+        Reviewed by Ryosuke Niwa.
+
+        Ensure the cyclic reference between the <feImage> renderer and its
+        ancestor <svg> root renderer is broken.
+
+        * svg/filters/filter-image-ref-root-expected.txt: Added.
+        * svg/filters/filter-image-ref-root.html: Added.
+
 2019-08-22  Tim Horton  <timothy_horton@apple.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2019-08-22  Said Abou-Hallawa  <sabouhallawa@apple.com>
+
+        Crash may happen when an SVG <feImage> element references the root <svg> element
+        https://bugs.webkit.org/show_bug.cgi?id=201014
+
+        Reviewed by Ryosuke Niwa.
+
+        When an <feImage> references an <svg> element as its target image but
+        this <svg> element is also one of the ancestors of the <feImage>, the
+        parent <filter> should not be applied.
+
+        Test: svg/filters/filter-image-ref-root.html
+
+        * svg/SVGFEImageElement.cpp:
+        (WebCore::SVGFEImageElement::build const):
+
 2019-08-22  Ryosuke Niwa  <rniwa@webkit.org>
 

trunk/Source/WebCore/svg/SVGFEImageElement.cpp

@@ -186 +186 @@
     if (m_cachedImage)
         return FEImage::createWithImage(filter, m_cachedImage->imageForRenderer(renderer()), preserveAspectRatio());
+
+    auto target = SVGURIReference::targetElementFromIRIString(href(), treeScope());
+    if (isDescendantOrShadowDescendantOf(target.element.get()))
+        return nullptr;
+
     return FEImage::createWithIRIReference(filter, treeScope(), href(), preserveAspectRatio());
 }