Changeset 32907 in webkit


Ignore:
Timestamp:
May 6, 2008 10:32:54 AM (16 years ago)
Author:
rwlbuis@webkit.org
Message:

Reviewed by Rob Buis.

https://bugs.webkit.org/show_bug.cgi?id=18859\
Prevented SVGRootInlineBox from static_casting a
node to a class it doesn't inherit

Location:
trunk/WebCore
Files:
2 edited

Legend:

Unmodified
Added
Removed
  • trunk/WebCore/ChangeLog

    r32906 r32907  
     12008-05-06  Jonathan Haas  <myrdred@gmail.com>
     2
     3        Reviewed by Rob Buis.
     4
     5        https://bugs.webkit.org/show_bug.cgi?id=18859\
     6        Prevented SVGRootInlineBox from static_casting a
     7        node to a class it doesn't inherit
     8       
     9        * rendering/SVGRootInlineBox.cpp:
     10        (WebCore::SVGRootInlineBox::buildTextChunks):
     11
    1122008-05-06  Brady Eidson  <beidson@apple.com>
    213
  • trunk/WebCore/rendering/SVGRootInlineBox.cpp

    r32508 r32907  
    13811381            SVGTextContentElement* textContent = 0;
    13821382            Node* node = text->element()->parent();
    1383             if (node && node->isSVGElement())
    1384                 textContent = static_cast<SVGTextContentElement*>(node);
     1383            while (node && node->isSVGElement() && !textContent) {
     1384                if (static_cast<SVGElement*>(node)->isTextContent())
     1385                    textContent = static_cast<SVGTextContentElement*>(node);
     1386                else
     1387                    node = node->parentNode();
     1388            }
    13851389            ASSERT(textContent);
    13861390
Note: See TracChangeset for help on using the changeset viewer.