Changeset 91653 in webkit

Timestamp:

Jul 24, 2011, 7:16:57 PM (14 years ago)

Author:

rwlbuis@webkit.org

Message:

2011-07-24 Rob Buis <​rbuis@rim.com>

Crash in SVGUseElement::updateContainerOffsets on <use> with no parent
​https://bugs.webkit.org/show_bug.cgi?id=63646

Reviewed by Darin Adler.

Prevent using invalid targetElementInstance->shadowTreeElement after shadow render tree recreation. This situation can
only occur when there was a valid shadowTreeElement before setting xlink:href to empty/invalid.

Test: svg/custom/use-shadow-root-parent-removal.svg

• svg/SVGUseElement.cpp: (WebCore::SVGUseElement::svgAttributeChanged):

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/svg/custom/use-shadow-root-parent-removal-expected.txt (added)
• LayoutTests/svg/custom/use-shadow-root-parent-removal.svg (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/svg/SVGUseElement.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2011-07-24  Rob Buis  <rbuis@rim.com>
+
+        Crash in SVGUseElement::updateContainerOffsets on <use> with no parent
+        https://bugs.webkit.org/show_bug.cgi?id=63646
+
+        Reviewed by Darin Adler.
+
+        * svg/custom/use-shadow-root-parent-removal-expected.txt: Added.
+        * svg/custom/use-shadow-root-parent-removal.svg: Added.
+
 2011-07-24  Balazs Kelemen  <kbalazs@webkit.org>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2011-07-24  Rob Buis  <rbuis@rim.com>
+
+        Crash in SVGUseElement::updateContainerOffsets on <use> with no parent
+        https://bugs.webkit.org/show_bug.cgi?id=63646
+
+        Reviewed by Darin Adler.
+
+        Prevent using invalid targetElementInstance->shadowTreeElement after shadow render tree recreation. This situation can
+        only occur when there was a valid shadowTreeElement before setting xlink:href to empty/invalid.
+
+        Test: svg/custom/use-shadow-root-parent-removal.svg
+
+        * svg/SVGUseElement.cpp:
+        (WebCore::SVGUseElement::svgAttributeChanged):
+
 2011-07-24  Patrick Gansterer  <paroga@webkit.org>
 

trunk/Source/WebCore/svg/SVGUseElement.cpp

@@ -228 +228 @@
         }
 
+        m_targetElementInstance = 0;
         invalidateShadowTree();
         return;