Changeset 157010 in webkit

Timestamp:

Oct 6, 2013 3:28:35 PM (11 years ago)

Author:

Antti Koivisto

Message:

Don't try to dispatch resize events for SVG images
​https://bugs.webkit.org/show_bug.cgi?id=122410

Reviewed by Darin Adler.

Tested by avoiding assertion in svg/custom/large-image-pattern-crash.html

• page/FrameView.cpp:

(WebCore::FrameView::sendResizeEventIfNeeded):

Bail out for SVG images. They have scripting disabled so the event wouldn't do anything anyway.
Use of FrameView mechanisms is just an implementation detail for SVG images, they are not
meant to act like real frames.

• rendering/svg/RenderSVGResourcePattern.cpp:

(WebCore::RenderSVGResourcePattern::createTileImage):

Switch to Element iterator. This will take NoEventDispatchAssertion verifying the change.

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• page/FrameView.cpp (modified) (1 diff)
• rendering/svg/RenderSVGResourcePattern.cpp (modified) (2 diffs)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2013-10-06  Antti Koivisto  <antti@apple.com>
+
+        Don't try to dispatch resize events for SVG images
+        https://bugs.webkit.org/show_bug.cgi?id=122410
+
+        Reviewed by Darin Adler.
+
+        Tested by avoiding assertion in svg/custom/large-image-pattern-crash.html
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::sendResizeEventIfNeeded):
+        
+            Bail out for SVG images. They have scripting disabled so the event wouldn't do anything anyway.
+            Use of FrameView mechanisms is just an implementation detail for SVG images, they are not
+            meant to act like real frames.
+
+        * rendering/svg/RenderSVGResourcePattern.cpp:
+        (WebCore::RenderSVGResourcePattern::createTileImage):
+        
+            Switch to Element iterator. This will take NoEventDispatchAssertion verifying the change.
+
 2013-10-06  Andreas Kling  <akling@apple.com>
 

trunk/Source/WebCore/page/FrameView.cpp

@@ -2770 +2770 @@
     if (!renderView || renderView->printing())
         return;
+    if (frame().page() && frame().page()->chrome().client().isSVGImageChromeClient())
+        return;
 
     IntSize currentSize;

trunk/Source/WebCore/rendering/svg/RenderSVGResourcePattern.cpp

@@ -24 +24 @@
 #include "RenderSVGResourcePattern.h"
 
+#include "ElementIterator.h"
 #include "FrameView.h"
 #include "GraphicsContext.h"
@@ -272 +273 @@
 
     // Draw the content into the ImageBuffer.
-    for (Node* node = attributes.patternContentElement()->firstChild(); node; node = node->nextSibling()) {
-        if (!node->isSVGElement() || !node->renderer())
+    auto children = childrenOfType<SVGElement>(attributes.patternContentElement());
+    for (auto it = children.begin(), end = children.end(); it != end; ++it) {
+        const SVGElement& child = *it;
+        if (!child.renderer())
             continue;
-        if (node->renderer()->needsLayout())
+        if (child.renderer()->needsLayout())
             return nullptr;
-        SVGRenderingContext::renderSubtreeToImageBuffer(tileImage.get(), node->renderer(), contentTransformation);
+        SVGRenderingContext::renderSubtreeToImageBuffer(tileImage.get(), child.renderer(), contentTransformation);
     }