Changeset 254458 in webkit


Ignore:
Timestamp:
Jan 13, 2020 3:06:30 PM (4 years ago)
Author:
commit-queue@webkit.org
Message:

Fix computeFloatVisibleRectInContainer to handle non-SVG object parent
https://bugs.webkit.org/show_bug.cgi?id=205282
Source/WebCore:

<rdar://problem/57975185>

Patch by Sunny He <sunny_he@apple.com> on 2020-01-13
Reviewed by Darin Adler.

Test: svg/dom/replaceChild-document-crash.html

  • rendering/svg/SVGRenderSupport.cpp:

(WebCore::SVGRenderSupport::computeFloatVisibleRectInContainer):

LayoutTests:

Patch by Sunny He <sunny_he@apple.com> on 2020-01-13
Reviewed by Darin Adler.

  • svg/dom/replaceChild-document-crash-expected.txt: Added.
  • svg/dom/replaceChild-document-crash.html: Added.
Location:
trunk
Files:
2 added
3 edited

Legend:

Unmodified
Added
Removed
  • trunk/LayoutTests/ChangeLog

    r254454 r254458  
     12020-01-13  Sunny He  <sunny_he@apple.com>
     2
     3        Fix computeFloatVisibleRectInContainer to handle non-SVG object parent
     4        https://bugs.webkit.org/show_bug.cgi?id=205282
     5
     6        Reviewed by Darin Adler.
     7
     8        * svg/dom/replaceChild-document-crash-expected.txt: Added.
     9        * svg/dom/replaceChild-document-crash.html: Added.
     10
    1112020-01-13  Eric Carlson  <eric.carlson@apple.com>
    212
  • trunk/Source/WebCore/ChangeLog

    r254454 r254458  
     12020-01-13  Sunny He  <sunny_he@apple.com>
     2
     3        Fix computeFloatVisibleRectInContainer to handle non-SVG object parent
     4        https://bugs.webkit.org/show_bug.cgi?id=205282
     5        <rdar://problem/57975185>
     6
     7        Reviewed by Darin Adler.
     8
     9        Test: svg/dom/replaceChild-document-crash.html
     10
     11        * rendering/svg/SVGRenderSupport.cpp:
     12        (WebCore::SVGRenderSupport::computeFloatVisibleRectInContainer):
     13
    1142020-01-13  Eric Carlson  <eric.carlson@apple.com>
    215
  • trunk/Source/WebCore/rendering/svg/SVGRenderSupport.cpp

    r239427 r254458  
    6565Optional<FloatRect> SVGRenderSupport::computeFloatVisibleRectInContainer(const RenderElement& renderer, const FloatRect& rect, const RenderLayerModelObject* container, RenderObject::VisibleRectContext context)
    6666{
     67    // Ensure our parent is an SVG object.
     68    ASSERT(renderer.parent());
     69    auto& parent = *renderer.parent();
     70    if (!is<SVGElement>(parent.element()))
     71        return FloatRect();
     72
    6773    FloatRect adjustedRect = rect;
    6874    const SVGRenderStyle& svgStyle = renderer.style().svgStyle();
     
    7379    // Translate to coords in our parent renderer, and then call computeFloatVisibleRectInContainer() on our parent.
    7480    adjustedRect = renderer.localToParentTransform().mapRect(adjustedRect);
    75     return renderer.parent()->computeFloatVisibleRectInContainer(adjustedRect, container, context);
     81
     82    return parent.computeFloatVisibleRectInContainer(adjustedRect, container, context);
    7683}
    7784
Note: See TracChangeset for help on using the changeset viewer.