Changeset 53589 in webkit

Timestamp:

Jan 20, 2010 6:10:20 PM (14 years ago)

Author:

Nikolas Zimmermann

Message:

2010-01-20 Nikolas Zimmermann <​nzimmermann@rim.com>

Reviewed by Oliver Hunt.

Crash on dispatching SVG mouse events
​https://bugs.webkit.org/show_bug.cgi?id=33841

Return early SVGUseElement::instanceForShadowTreeElement if m_targetElementInstance is zero.
This only happens if the SVGUseElement has just been removed from the document and EventHandler
tries to dispatch a mouseout event to the corresponding SVGElementInstance. This is not testable
using DRT unfortunately, so we have to add another manual testcase for that.

Tests: manual-tests/use-crash-on-mouse-hover.svg

• manual-tests/svg-crash-hovering-use.svg: Added.
• svg/SVGUseElement.cpp: (WebCore::SVGUseElement::instanceForShadowTreeElement): Add ASSERT(!inDocument()) when returning 0 here if m_targetElementInstance is 0.

Location:

trunk/WebCore

Files:

• ChangeLog (modified) (1 diff)
• manual-tests/svg-crash-hovering-use.svg (added)
• svg/SVGUseElement.cpp (modified) (1 diff)

trunk/WebCore/ChangeLog

@@ +1 @@
+2010-01-20  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Oliver Hunt.
+
+        Crash on dispatching SVG mouse events
+        https://bugs.webkit.org/show_bug.cgi?id=33841
+
+        Return early SVGUseElement::instanceForShadowTreeElement if m_targetElementInstance is zero.
+        This only happens if the SVGUseElement has just been removed from the document and EventHandler
+        tries to dispatch a mouseout event to the corresponding SVGElementInstance. This is not testable
+        using DRT unfortunately, so we have to add another manual testcase for that.
+
+        Tests: manual-tests/use-crash-on-mouse-hover.svg
+
+        * manual-tests/svg-crash-hovering-use.svg: Added.
+        * svg/SVGUseElement.cpp:
+        (WebCore::SVGUseElement::instanceForShadowTreeElement): Add ASSERT(!inDocument()) when returning 0 here if m_targetElementInstance is 0.
+
 2010-01-20  Ilya Tikhonovsky  <loislo@chromium.org>
 

trunk/WebCore/svg/SVGUseElement.cpp

@@ -858 +858 @@
 SVGElementInstance* SVGUseElement::instanceForShadowTreeElement(Node* element) const
 {
+    if (!m_targetElementInstance) {
+        ASSERT(!inDocument());
+        return 0;
+    }
+
     return instanceForShadowTreeElement(element, m_targetElementInstance.get());
 }