Changeset 273809 in webkit

Timestamp:

Mar 2, 2021, 8:52:00 PM (6 years ago)

Author:

commit-queue@webkit.org

Message:

Crash in removeSymbolElementsFromSubtree()
​https://bugs.webkit.org/show_bug.cgi?id=222397

Patch by Julian Gonzalez <​julian_a_gonzalez@apple.com> on 2021-03-02
Reviewed by Ryosuke Niwa.

Skip children in removeSymbolElementsFromSubtree(), so that
we don't see nodes that have been removed.

Thanks to Darin Adler for the initial version of this patch
and Ryosuke Niwa for refinements.

• svg/SVGUseElement.cpp:

(WebCore::SVGUseElement::updateShadowTree):
(WebCore::removeSymbolElementsFromSubtree):

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• svg/SVGUseElement.cpp (modified) (2 diffs)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2021-03-02  Julian Gonzalez  <julian_a_gonzalez@apple.com>
+
+        Crash in removeSymbolElementsFromSubtree()
+        https://bugs.webkit.org/show_bug.cgi?id=222397
+
+        Reviewed by Ryosuke Niwa.
+
+        Skip children in removeSymbolElementsFromSubtree(), so that
+        we don't see nodes that have been removed.
+
+        Thanks to Darin Adler for the initial version of this patch
+        and Ryosuke Niwa for refinements.
+
+        * svg/SVGUseElement.cpp:
+        (WebCore::SVGUseElement::updateShadowTree):
+        (WebCore::removeSymbolElementsFromSubtree):
+
 2021-03-02  Zalan Bujtas  <zalan@apple.com>
 

trunk/Source/WebCore/svg/SVGUseElement.cpp

@@ -225 +225 @@
     if (!isConnected())
         return;
+
+    ScriptDisallowedScope::InMainThread scriptDisallowedScope;
+
     document().removeSVGUseElement(*this);
 
@@ -351 +354 @@
     // but incorrect for ones that just happen to be in a subtree.
     Vector<Element*> symbolElements;
-    for (auto& descendant : descendantsOfType<SVGSymbolElement>(subtree))
-        symbolElements.append(&descendant);
+    for (auto it = descendantsOfType<Element>(subtree).begin(); it; ) {
+        if (is<SVGSymbolElement>(*it)) {
+            symbolElements.append(&*it);
+            it.traverseNextSkippingChildren();
+            continue;
+        }
+        ++it;
+    }
     disassociateAndRemoveClones(symbolElements);
 }