Changeset 287076 in webkit

Timestamp:

Dec 15, 2021 8:59:20 AM (7 months ago)

Author:

commit-queue@webkit.org

Message:

Fix SVG resource invalidation logic causing incorrect layout state.
​https://bugs.webkit.org/show_bug.cgi?id=233190
<rdar://82895369>

When SVG resources perform parent layout/resource invalidation, we can incorrectly
cross the SVG boundary when operating on a node which isn't an SVGRoot.
This can cause us to exit layout() with elements that still needsLayout().

Patch by Gavin Phillips <​gavin.p@apple.com> on 2021-12-15
Reviewed by Darin Adler.

• rendering/svg/RenderSVGResource.cpp:

(WebCore::RenderSVGResource::markForLayoutAndParentResourceInvalidation):

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• rendering/svg/RenderSVGResource.cpp (modified) (1 diff)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2021-12-15  Gavin Phillips  <gavin.p@apple.com>
+
+        Fix SVG resource invalidation logic causing incorrect layout state.
+        https://bugs.webkit.org/show_bug.cgi?id=233190
+        <rdar://82895369>
+
+        When SVG resources perform parent layout/resource invalidation, we can incorrectly
+        cross the SVG boundary when operating on a node which isn't an SVGRoot.
+        This can cause us to exit layout() with elements that still needsLayout().
+
+        Reviewed by Darin Adler.
+
+        * rendering/svg/RenderSVGResource.cpp:
+        (WebCore::RenderSVGResource::markForLayoutAndParentResourceInvalidation):
+
 2021-12-15  Chris Lord  <clord@igalia.com>
 

trunk/Source/WebCore/rendering/svg/RenderSVGResource.cpp

@@ -208 +208 @@
             object.setNeedsLayout(MarkOnlyThis);
 #endif
-        else
-            object.setNeedsLayout(MarkContainingBlockChain);
+        else {
+            if (!is<RenderElement>(object))
+                object.setNeedsLayout(MarkOnlyThis);
+            else {
+                auto svgRoot = SVGRenderSupport::findTreeRootObject(downcast<RenderElement>(object));
+                if (!svgRoot || !svgRoot->isInLayout())
+                    object.setNeedsLayout(MarkContainingBlockChain);
+                else {
+                    // We just want to re-layout the ancestors up to the RenderSVGRoot.
+                    object.setNeedsLayout(MarkOnlyThis);
+                    for (auto current = object.parent(); current != svgRoot; current = current->parent())
+                        current->setNeedsLayout(MarkOnlyThis);
+                    svgRoot->setNeedsLayout(MarkOnlyThis);
+                }
+            }
+        }
     }