Changeset 94058 in webkit

Timestamp:

Aug 30, 2011, 1:04:34 AM (15 years ago)

Author:

jeremy@chromium.org

Message:

Merge 92809 - Crash when clicking an SVG <a> link to the local document
​https://bugs.webkit.org/show_bug.cgi?id=66019
<rdar://problem/9933311>

Reviewed by Rob Buis.

Source/WebCore:

Check if the target element of an internal link is valid before
making use of it.

Test: svg/custom/click-internal-anchor-with-use-crash.xhtml

• svg/SVGAElement.cpp:

(WebCore::SVGAElement::defaultEventHandler):

LayoutTests:

Add a test which programmatically clicks a link referring to "#",
and should crash between r89745 and this commit.

• svg/custom/click-internal-anchor-with-use-crash-expected.txt: Added.
• svg/custom/click-internal-anchor-with-use-crash.xhtml: Added.

TBR=​timothy_horton@apple.com
Review URL: ​http://codereview.chromium.org/7807001

Location:

branches/chromium/835

Files:

• LayoutTests/svg/custom/click-internal-anchor-with-use-crash-expected.txt (copied) (copied from trunk/LayoutTests/svg/custom/click-internal-anchor-with-use-crash-expected.txt )
• LayoutTests/svg/custom/click-internal-anchor-with-use-crash.xhtml (copied) (copied from trunk/LayoutTests/svg/custom/click-internal-anchor-with-use-crash.xhtml )
• Source/WebCore/svg/SVGAElement.cpp (modified) (1 diff)

branches/chromium/835/Source/WebCore/svg/SVGAElement.cpp

@@ -171 +171 @@
                 }
                 // Only allow navigation to internal <view> anchors.
-                if (!targetElement->hasTagName(SVGNames::viewTag))
+                if (targetElement && !targetElement->hasTagName(SVGNames::viewTag))
                     return;
             }