Changeset 57779 in webkit

Timestamp:

Apr 17, 2010 6:37:55 AM (14 years ago)

Author:

jchaffraix@webkit.org

Message:

Crash while handling SVG font in the wrong namespace imported with @font-face
​https://bugs.webkit.org/show_bug.cgi?id=18862

Reviewed by Darin Adler.

WebCore:

Test: fast/invalid/invalidSVGFont.html

• loader/CachedFont.cpp:

(WebCore::CachedFont::getSVGFontById): Make sure we really get an SVGFontElement by using
getElementsByNameNS: the element factory chooses which element to create based on both
localName and namespace.

LayoutTests:

Test that load an SVG document not in the SVG namespace with @font-face does not
lead to a crash.

• fast/invalid/invalidSVGFont-expected.txt: Added.
• fast/invalid/invalidSVGFont.html: Added.
• fast/invalid/resources/svgFontWrongNamespace.svg: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/invalid/invalidSVGFont-expected.txt (added)
• LayoutTests/fast/invalid/invalidSVGFont.html (added)
• LayoutTests/fast/invalid/resources/svgFontWrongNamespace.svg (added)
• WebCore/ChangeLog (modified) (1 diff)
• WebCore/loader/CachedFont.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2010-04-17  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Crash while handling SVG font in the wrong namespace imported with @font-face
+        https://bugs.webkit.org/show_bug.cgi?id=18862
+
+        Test that load an SVG document not in the SVG namespace with @font-face does not
+        lead to a crash.
+
+        * fast/invalid/invalidSVGFont-expected.txt: Added.
+        * fast/invalid/invalidSVGFont.html: Added.
+        * fast/invalid/resources/svgFontWrongNamespace.svg: Added.
+
 2010-04-16  Sheriff Bot  <webkit.review.bot@gmail.com>
 

trunk/WebCore/ChangeLog

@@ +1 @@
+2010-04-17  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Crash while handling SVG font in the wrong namespace imported with @font-face
+        https://bugs.webkit.org/show_bug.cgi?id=18862
+
+        Test: fast/invalid/invalidSVGFont.html
+
+        * loader/CachedFont.cpp:
+        (WebCore::CachedFont::getSVGFontById): Make sure we really get an SVGFontElement by using
+        getElementsByNameNS: the element factory chooses which element to create based on both
+        localName and namespace.
+
 2010-04-16  Sheriff Bot  <webkit.review.bot@gmail.com>
 

trunk/WebCore/loader/CachedFont.cpp

@@ -158 +158 @@
 {
     ASSERT(m_isSVGFont);
-    RefPtr<NodeList> list = m_externalSVGDocument->getElementsByTagName(SVGNames::fontTag.localName());
+    RefPtr<NodeList> list = m_externalSVGDocument->getElementsByTagNameNS(SVGNames::fontTag.namespaceURI(), SVGNames::fontTag.localName());
     if (!list)
         return 0;