Changeset 271785 in webkit

Timestamp:

Jan 24, 2021 4:28:45 PM (18 months ago)

Author:

Simon Fraser

Message:

SVG reference filter chain with errors applies only some of the filters, producing incorrect output
​https://bugs.webkit.org/show_bug.cgi?id=220893

Reviewed by Sam Weinig.

Source/WebCore:

If the CSS filter property refers to an invalid reference filter, ensure that
the entire reference filter is skipped. Previously, we'd add elements of the reference
filter up to the invalid one.

This behavior matches Gecko and Blink.

Tests: css3/filters/invalid-reference-filter-in-chain.html

css3/filters/invalid-reference-filter.html

• rendering/CSSFilter.cpp:

(WebCore::CSSFilter::buildReferenceFilter):

LayoutTests:

• css3/filters/invalid-reference-filter-expected.html: Added.
• css3/filters/invalid-reference-filter-in-chain-expected.html: Added.
• css3/filters/invalid-reference-filter-in-chain.html: Added.
• css3/filters/invalid-reference-filter.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/css3/filters/invalid-reference-filter-expected.html (added)
• LayoutTests/css3/filters/invalid-reference-filter-in-chain-expected.html (added)
• LayoutTests/css3/filters/invalid-reference-filter-in-chain.html (added)
• LayoutTests/css3/filters/invalid-reference-filter.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/rendering/CSSFilter.cpp (modified) (2 diffs)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2021-01-24  Simon Fraser  <simon.fraser@apple.com>
+
+        SVG reference filter chain with errors applies only some of the filters, producing incorrect output
+        https://bugs.webkit.org/show_bug.cgi?id=220893
+
+        Reviewed by Sam Weinig.
+
+        * css3/filters/invalid-reference-filter-expected.html: Added.
+        * css3/filters/invalid-reference-filter-in-chain-expected.html: Added.
+        * css3/filters/invalid-reference-filter-in-chain.html: Added.
+        * css3/filters/invalid-reference-filter.html: Added.
+
 2021-01-23  Per Arne Vollan  <pvollan@apple.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2021-01-24  Simon Fraser  <simon.fraser@apple.com>
+
+        SVG reference filter chain with errors applies only some of the filters, producing incorrect output
+        https://bugs.webkit.org/show_bug.cgi?id=220893
+
+        Reviewed by Sam Weinig.
+
+        If the CSS filter property refers to an invalid reference filter, ensure that
+        the entire reference filter is skipped. Previously, we'd add elements of the reference
+        filter up to the invalid one.
+
+        This behavior matches Gecko and Blink.
+
+        Tests: css3/filters/invalid-reference-filter-in-chain.html
+               css3/filters/invalid-reference-filter.html
+
+        * rendering/CSSFilter.cpp:
+        (WebCore::CSSFilter::buildReferenceFilter):
+
 2021-01-24  Rob Buis  <rbuis@igalia.com>
 

trunk/Source/WebCore/rendering/CSSFilter.cpp

@@ -111 +111 @@
     }
 
-    RefPtr<FilterEffect> effect;
-
     auto builder = makeUnique<SVGFilterBuilder>(&previousEffect);
     m_sourceAlpha = builder->getEffectById(SourceAlpha::effectName());
 
+    RefPtr<FilterEffect> effect;
+    Vector<Ref<FilterEffect>> referenceEffects;
+
     for (auto& effectElement : childrenOfType<SVGFilterPrimitiveStandardAttributes>(*filter)) {
         effect = effectElement.build(builder.get(), *this);
-        if (!effect)
-            continue;
+        if (!effect) {
+            LOG_WITH_STREAM(Filters, stream << "CSSFilter " << this << " buildReferenceFilter: failed to build effect from " << effectElement);
+            return nullptr;
+        }
 
         effectElement.setStandardAttributes(effect.get());
@@ -126 +129 @@
 
         builder->add(effectElement.result(), effect);
-        m_effects.append(*effect);
-    }
+        referenceEffects.append(*effect);
+    }
+    
+    m_effects.appendVector(WTFMove(referenceEffects));
     return effect;
 }