Changeset 62514 in webkit

Timestamp:

Jul 5, 2010 7:03:30 PM (14 years ago)

Author:

commit-queue@webkit.org

Message:

2010-07-05 Fady Samuel <​fsamuel@chromium.org>

Reviewed by Darin Adler.

Fixed a svg crash when setting class of an svg ellipse object.

Altering the CSS class of an attached SVG element causes WebKit to crash
​https://bugs.webkit.org/show_bug.cgi?id=40857

• platform/chromium-linux/svg/css/svg-ellipse-render-crash-expected.txt: Added.
• svg/css/svg-ellipse-render-crash.html: Added.

2010-07-05 Fady Samuel <​fsamuel@chromium.org>

Reviewed by Darin Adler.

Fixed a svg crash when setting class of an svg ellipse object.

Altering the CSS class of an attached SVG element causes WebKit to crash
​https://bugs.webkit.org/show_bug.cgi?id=40857

Test: svg/css/svg-ellipse-render-crash.html

• dom/StyledElement.cpp: (WebCore::StyledElement::classAttributeChanged):

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/platform/chromium-linux/svg/css/svg-ellipse-render-crash-expected.txt (added)
• LayoutTests/svg/css/svg-ellipse-render-crash.html (added)
• WebCore/ChangeLog (modified) (1 diff)
• WebCore/dom/StyledElement.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2010-07-05  Fady Samuel  <fsamuel@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Fixed a svg crash when setting class of an svg ellipse object.
+
+        Altering the CSS class of an attached SVG element causes WebKit to crash
+        https://bugs.webkit.org/show_bug.cgi?id=40857
+
+        * platform/chromium-linux/svg/css/svg-ellipse-render-crash-expected.txt: Added.
+        * svg/css/svg-ellipse-render-crash.html: Added.
+
 2010-07-05  Dan Bernstein  <mitz@apple.com>
 

trunk/WebCore/ChangeLog

@@ +1 @@
+2010-07-05  Fady Samuel  <fsamuel@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Fixed a svg crash when setting class of an svg ellipse object.
+
+        Altering the CSS class of an attached SVG element causes WebKit to crash
+        https://bugs.webkit.org/show_bug.cgi?id=40857
+
+        Test: svg/css/svg-ellipse-render-crash.html
+
+        * dom/StyledElement.cpp:
+        (WebCore::StyledElement::classAttributeChanged):
+
 2010-07-05  Dan Bernstein  <mitz@apple.com>
 

trunk/WebCore/dom/StyledElement.cpp

@@ -216 +216 @@
             break;
     }
-    setHasClass(i < length);
-    if (namedAttrMap) {
-        if (i < length)
-            mappedAttributes()->setClass(newClassString);
-        else
-            mappedAttributes()->clearClass();
+    bool hasClass = i < length;
+    setHasClass(hasClass);
+    if (hasClass)
+        attributes()->setClass(newClassString);
+    else {
+        if (namedAttrMap)    
+            namedAttrMap->clearClass();
     }
     setNeedsStyleRecalc();