Changeset 227697 in webkit

Timestamp:

Jan 26, 2018 2:36:39 PM (6 years ago)

Author:

Simon Fraser

Message:

REGRESSiON (r226492): Crash under Element::absoluteEventBounds() on a SVGPathElement which has not been laid out yet
​https://bugs.webkit.org/show_bug.cgi?id=182185
rdar://problem/36836262

Reviewed by Zalan Bujtas.

Document::absoluteRegionForEventTargets() can fire when layout is dirty, and SVGPathElement's path() can be null if it
hasn't been laid out yet. So protect against a null path in getBBox().

Not easily testable because internals.nonFastScrollableRects() forces layout, and the crash depends on the timing of
absoluteRegionForEventTargets().

• svg/SVGPathElement.cpp:

(WebCore::SVGPathElement::getBBox):

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• svg/SVGPathElement.cpp (modified) (1 diff)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2018-01-26  Simon Fraser  <simon.fraser@apple.com>
+
+        REGRESSiON (r226492): Crash under Element::absoluteEventBounds() on a SVGPathElement which has not been laid out yet
+        https://bugs.webkit.org/show_bug.cgi?id=182185
+        rdar://problem/36836262
+
+        Reviewed by Zalan Bujtas.
+
+        Document::absoluteRegionForEventTargets() can fire when layout is dirty, and SVGPathElement's path() can be null if it
+        hasn't been laid out yet. So protect against a null path in getBBox().
+
+        Not easily testable because internals.nonFastScrollableRects() forces layout, and the crash depends on the timing of
+        absoluteRegionForEventTargets().
+
+        * svg/SVGPathElement.cpp:
+        (WebCore::SVGPathElement::getBBox):
+
 2018-01-26  Chris Dumez  <cdumez@apple.com>
 

trunk/Source/WebCore/svg/SVGPathElement.cpp

@@ -421 +421 @@
 
     // FIXME: Eventually we should support getBBox for detached elements.
-    if (!renderer)
-        return FloatRect();
+    // FIXME: If the path is null it means we're calling getBBox() before laying out this element,
+    // which is an error.
+    if (!renderer || !renderer->hasPath())
+        return { };
 
     return renderer->path().boundingRect();