Changeset 52219 in webkit


Ignore:
Timestamp:
Dec 16, 2009 1:56:54 PM (14 years ago)
Author:
eric@webkit.org
Message:

2009-12-16 Dirk Schulze <​krit@webkit.org>

Reviewed by Nikolas Zimmermann.

feMerge crahses if feMergeNodes attribute in is empty
​https://bugs.webkit.org/show_bug.cgi?id=32489

The previous test only checked if feMerge works on empty node
without a last effect. In this case we get a source image and
everything works fine. This test also covers the case if there
is a last effect.

  • platform/mac/svg/custom/empty-merge-expected.checksum:
  • platform/mac/svg/custom/empty-merge-expected.png:
  • platform/mac/svg/custom/empty-merge-expected.txt:
  • svg/custom/empty-merge.svg:

2009-12-16 Dirk Schulze <​krit@webkit.org>

Reviewed by Nikolas Zimmermann.

feMerge crahses if feMergeNodes attribute in is empty
​https://bugs.webkit.org/show_bug.cgi?id=32489

SVGFEMergeElement only stored pointers to all effects of it's nodes
in a list. But it should store the RefPtr otherwise the effects get
dereferenced and WebKit crashes.
I also made a short clean-up in SVGFilterBuilder. No change in
functionality.

Test: I updated svg/custom/empty-merge.svg to cover this problem.

  • svg/SVGFEMergeElement.cpp: (WebCore::SVGFEMergeElement::build):
  • svg/graphics/filters/SVGFEMerge.cpp: (WebCore::FEMerge::FEMerge): (WebCore::FEMerge::create): (WebCore::FEMerge::mergeInputs): (WebCore::FEMerge::setMergeInputs):
  • svg/graphics/filters/SVGFEMerge.h:
  • svg/graphics/filters/SVGFilterBuilder.cpp: (WebCore::SVGFilterBuilder::add):
Location:
trunk
Files:
10 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r52202 r52219  
     12009-12-16  Dirk Schulze  <krit@webkit.org>
     2
     3        Reviewed by Nikolas Zimmermann.
     4
     5        feMerge crahses if feMergeNodes attribute in is empty
     6        https://bugs.webkit.org/show_bug.cgi?id=32489
     7
     8        The previous test only checked if feMerge works on empty node
     9        without a last effect. In this case we get a source image and
     10        everything works fine. This test also covers the case if there
     11        is a last effect.
     12
     13        * platform/mac/svg/custom/empty-merge-expected.checksum:
     14        * platform/mac/svg/custom/empty-merge-expected.png:
     15        * platform/mac/svg/custom/empty-merge-expected.txt:
     16        * svg/custom/empty-merge.svg:
     17
    1182009-12-16  Dirk Schulze  <krit@webkit.org>
    219

  • trunk/LayoutTests/platform/mac/svg/custom/empty-merge-expected.checksum

    r51800 r52219  
    1 2fd864fa7542ee18457a298ded77cec1
     143d38b779dd3330bfb490ba26a4bff71

  • trunk/LayoutTests/platform/mac/svg/custom/empty-merge-expected.txt

    r51800 r52219  
    1 KCanvasResource {id="MyFilter" [type=FILTER]  [bounding box=at (0,0) size 100x100] [bounding box mode=0]}
     1KCanvasResource {id="MyFilter1" [type=FILTER]  [bounding box=at (-10.00%,-10.00%) size 120.00%x120.00%]}
     2KCanvasResource {id="MyFilter2" [type=FILTER]  [bounding box=at (-10.00%,-10.00%) size 120.00%x120.00%]}
    23layer at (0,0) size 800x600
    34  RenderView at (0,0) size 800x600
    45layer at (0,0) size 800x600
    5   RenderSVGRoot {svg} at (-0.50,-0.50) size 102x102
     6  RenderSVGRoot {svg} at (10,10) size 220x100
    67    RenderSVGHiddenContainer {defs} at (0,0) size 0x0
    7     RenderPath {rect} at (0.50,0.50) size 101x101 [stroke={[type=SOLID] [color=#0000FF]}] [fill={[type=SOLID] [color=#888888]}] [data="M1.00,1.00 L101.00,1.00 L101.00,101.00 L1.00,101.00 Z"]
    8     RenderSVGContainer {g} at (-0.50,-0.50) size 101x101 [filter=MyFilter]
    9       RenderPath {rect} at (-0.50,-0.50) size 101x101 [stroke={[type=SOLID] [color=#0000FF]}] [fill={[type=SOLID] [color=#008000]}] [data="M0.00,0.00 L100.00,0.00 L100.00,100.00 L0.00,100.00 Z"]
     8    RenderPath {rect} at (10,10) size 100x100 [fill={[type=SOLID] [color=#008000]}] [filter=MyFilter1] [data="M10.00,10.00 L110.00,10.00 L110.00,110.00 L10.00,110.00 Z"]
     9    RenderPath {rect} at (130,10) size 100x100 [fill={[type=SOLID] [color=#008000]}] [filter=MyFilter2] [data="M130.00,10.00 L230.00,10.00 L230.00,110.00 L130.00,110.00 Z"]

  • trunk/LayoutTests/svg/custom/empty-merge.svg

    r16557 r52219  
    1 <?xml version="1.0"?>
    2 <!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN"
    3               "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
    41<svg xmlns="http://www.w3.org/2000/svg" version="1.1">
    5   <title>TestCase for empty feMerge component</title>
    6   <defs>
    7     <filter id="MyFilter" filterUnits="userSpaceOnUse" x="0" y="0" width="100" height="100">
    8       <feMerge>
    9         <feMergeNode/>
    10       </feMerge>
    11     </filter>
    12   </defs>
    13   <rect x="1" y="1" width="100" height="100" fill="#888888" stroke="blue" />
    14   <g filter="url(#MyFilter)" >
    15     <rect fill="green" stroke="blue" x="0" y="0" width="100" height="100"/>
    16   </g>
     2<!-- TestCase for empty feMerge component. You should see 2 green rects -->
     3<defs>
     4<filter id="MyFilter1">
     5    <feMerge>
     6    <feMergeNode/>
     7    </feMerge>
     8</filter>
     9<filter id="MyFilter2">
     10    <feOffset/>
     11    <feMerge>
     12    <feMergeNode/>
     13    </feMerge>
     14</filter>
     15</defs>
     16<rect fill="green" x="10" y="10" width="100" height="100" filter="url(#MyFilter1)"/>
     17<rect fill="green" x="130" y="10" width="100" height="100" filter="url(#MyFilter2)"/>
    1718</svg>

  • trunk/WebCore/ChangeLog

    r52217 r52219  
     12009-12-16  Dirk Schulze  <krit@webkit.org>
     2
     3        Reviewed by Nikolas Zimmermann.
     4
     5        feMerge crahses if feMergeNodes attribute in is empty
     6        https://bugs.webkit.org/show_bug.cgi?id=32489
     7
     8        SVGFEMergeElement only stored pointers to all effects of it's nodes
     9        in a list. But it should store the RefPtr otherwise the effects get
     10        dereferenced and WebKit crashes.
     11        I also made a short clean-up in SVGFilterBuilder. No change in
     12        functionality.
     13
     14        Test: I updated svg/custom/empty-merge.svg to cover this problem.
     15
     16        * svg/SVGFEMergeElement.cpp:
     17        (WebCore::SVGFEMergeElement::build):
     18        * svg/graphics/filters/SVGFEMerge.cpp:
     19        (WebCore::FEMerge::FEMerge):
     20        (WebCore::FEMerge::create):
     21        (WebCore::FEMerge::mergeInputs):
     22        (WebCore::FEMerge::setMergeInputs):
     23        * svg/graphics/filters/SVGFEMerge.h:
     24        * svg/graphics/filters/SVGFilterBuilder.cpp:
     25        (WebCore::SVGFilterBuilder::add):
     26
    1272009-12-16  Brian Weinstein  <bweinstein@apple.com>
    228

  • trunk/WebCore/svg/SVGFEMergeElement.cpp

    r50583 r52219  
    4040bool SVGFEMergeElement::build(SVGResourceFilter* filterResource)
    4141{
    42     Vector<FilterEffect*> mergeInputs;
     42    Vector<RefPtr<FilterEffect> > mergeInputs;
    4343    for (Node* n = firstChild(); n != 0; n = n->nextSibling()) {
    4444        if (n->hasTagName(SVGNames::feMergeNodeTag)) {

  • trunk/WebCore/svg/graphics/filters/SVGFEMerge.cpp

    r51310 r52219  
    3131namespace WebCore {
    3232
    33 FEMerge::FEMerge(const Vector<FilterEffect*>& mergeInputs)
     33FEMerge::FEMerge(const Vector<RefPtr<FilterEffect> >& mergeInputs)
    3434    : FilterEffect()
    3535    , m_mergeInputs(mergeInputs)
    … …  
    3737}
    3838
    39 PassRefPtr<FEMerge> FEMerge::create(const Vector<FilterEffect*>& mergeInputs)
     39PassRefPtr<FEMerge> FEMerge::create(const Vector<RefPtr<FilterEffect> >& mergeInputs)
    4040{
    4141    return adoptRef(new FEMerge(mergeInputs));
    4242}
    4343
    44 const Vector<FilterEffect*>& FEMerge::mergeInputs() const
     44const Vector<RefPtr<FilterEffect> >& FEMerge::mergeInputs() const
    4545{
    4646    return m_mergeInputs;
    4747}
    4848
    49 void FEMerge::setMergeInputs(const Vector<FilterEffect*>& mergeInputs)
     49void FEMerge::setMergeInputs(const Vector<RefPtr<FilterEffect> >& mergeInputs)
    5050{
    5151    m_mergeInputs = mergeInputs;

  • trunk/WebCore/svg/graphics/filters/SVGFEMerge.h

    r44839 r52219  
    3232    class FEMerge : public FilterEffect {
    3333    public:
    34         static PassRefPtr<FEMerge> create(const Vector<FilterEffect*>&);
     34        static PassRefPtr<FEMerge> create(const Vector<RefPtr<FilterEffect> >&);
    3535
    36         const Vector<FilterEffect*>& mergeInputs() const;
    37         void setMergeInputs(const Vector<FilterEffect*>& mergeInputs);
     36        const Vector<RefPtr<FilterEffect> >& mergeInputs() const;
     37        void setMergeInputs(const Vector<RefPtr<FilterEffect> >& mergeInputs);
    3838
    3939        virtual FloatRect uniteChildEffectSubregions(Filter*);
    … …  
    4343
    4444    private:
    45         FEMerge(const Vector<FilterEffect*>&);
     45        FEMerge(const Vector<RefPtr<FilterEffect> >&);
    4646
    47         Vector<FilterEffect*> m_mergeInputs;
     47        Vector<RefPtr<FilterEffect> > m_mergeInputs;
    4848    };
    4949

  • trunk/WebCore/svg/graphics/filters/SVGFilterBuilder.cpp

    r44338 r52219  
    4343{
    4444    if (id.isEmpty()) {
    45         m_lastEffect = effect.get();
     45        m_lastEffect = effect;
    4646        return;
    4747    }
    … …  
    5050        return;
    5151
    52     m_lastEffect = effect.get();
     52    m_lastEffect = effect;
    5353    m_namedEffects.set(id, m_lastEffect);
    5454}
Note: See TracChangeset for help on using the changeset viewer.