Changeset 63300 in webkit


Ignore:
Timestamp:
Jul 14, 2010 2:39:25 AM (14 years ago)
Author:
Nikolas Zimmermann
Message:

2010-07-14 Nikolas Zimmermann <​nzimmermann@rim.com>

Reviewed by Eric Seidel.

SVG patterns and masks should not be able to reference themselves
​https://bugs.webkit.org/show_bug.cgi?id=32171

Don't apply pattern/mask resources, if they contain cyclic references. Gradients/Filters are not affected.
Clippers are already correcly handling this on their own, as well as markers (all which require subtle quirks, covered by existing tests).

Tests: svg/custom/recursive-filter.svg

svg/custom/recursive-gradient.svg
svg/custom/recursive-mask.svg
svg/custom/recursive-pattern.svg

  • rendering/RenderSVGResourceContainer.h: (WebCore::RenderSVGResourceContainer::RenderSVGResourceContainer): Stop using idForStyleResolution(), but use getIdAttribute(), no functional change though. (WebCore::RenderSVGResourceContainer::idChanged): Ditto. (WebCore::RenderSVGResourceContainer::childElementReferencesResource): To be implemented by classes inheriting from us. Defaults to false. (WebCore::RenderSVGResourceContainer::containsCyclicReference): Check whether this resource contains contains a child which references ourselves.
  • rendering/RenderSVGResourceMasker.cpp: (WebCore::RenderSVGResourceMasker::childElementReferencesResource): Check whether the masker child specifies mask=".." with the same URI than ourselves. (WebCore::RenderSVGResourceMasker::applyResource): Early exit if we contain a cylic reference.
  • rendering/RenderSVGResourceMasker.h:
  • rendering/RenderSVGResourcePattern.cpp: (WebCore::RenderSVGResourcePattern::childElementReferencesResource): Check whether the masker child specifies fill=".." with the same URI than ourselves. (WebCore::RenderSVGResourcePattern::applyResource): Early exit if we contain a cylic reference.
  • rendering/RenderSVGResourcePattern.h:
  • svg/SVGPaint.cpp: (WebCore::SVGPaint::matchesTargetURI): Add new helper function comparing a SVGPaint URI with a given reference id.
  • svg/SVGPaint.h:

2010-07-14 Nikolas Zimmermann <​nzimmermann@rim.com>

Reviewed by Eric Seidel.

SVG patterns and masks should not be able to reference themselves
​https://bugs.webkit.org/show_bug.cgi?id=32171

Add new layout tests covering recursion in pattern/mask/gradient/filter. Nothing crashing anymore.

  • platform/mac/svg/custom/recursive-filter-expected.checksum: Added.
  • platform/mac/svg/custom/recursive-filter-expected.png: Added.
  • platform/mac/svg/custom/recursive-filter-expected.txt: Added.
  • platform/mac/svg/custom/recursive-gradient-expected.checksum: Added.
  • platform/mac/svg/custom/recursive-gradient-expected.png: Added.
  • platform/mac/svg/custom/recursive-gradient-expected.txt: Added.
  • platform/mac/svg/custom/recursive-mask-expected.checksum: Added.
  • platform/mac/svg/custom/recursive-mask-expected.png: Added.
  • platform/mac/svg/custom/recursive-mask-expected.txt: Added.
  • platform/mac/svg/custom/recursive-pattern-expected.checksum: Added.
  • platform/mac/svg/custom/recursive-pattern-expected.png: Added.
  • platform/mac/svg/custom/recursive-pattern-expected.txt: Added.
  • svg/custom/recursive-filter.svg: Added.
  • svg/custom/recursive-gradient.svg: Added.
  • svg/custom/recursive-mask.svg: Added.
  • svg/custom/recursive-pattern.svg: Added.
Location:
trunk
Files:
16 added
9 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r63298 r63300  
     12010-07-14  Nikolas Zimmermann  <nzimmermann@rim.com>
     2
     3        Reviewed by Eric Seidel.
     4
     5        SVG patterns and masks should not be able to reference themselves
     6        https://bugs.webkit.org/show_bug.cgi?id=32171
     7
     8        Add new layout tests covering recursion in pattern/mask/gradient/filter. Nothing crashing anymore.
     9
     10        * platform/mac/svg/custom/recursive-filter-expected.checksum: Added.
     11        * platform/mac/svg/custom/recursive-filter-expected.png: Added.
     12        * platform/mac/svg/custom/recursive-filter-expected.txt: Added.
     13        * platform/mac/svg/custom/recursive-gradient-expected.checksum: Added.
     14        * platform/mac/svg/custom/recursive-gradient-expected.png: Added.
     15        * platform/mac/svg/custom/recursive-gradient-expected.txt: Added.
     16        * platform/mac/svg/custom/recursive-mask-expected.checksum: Added.
     17        * platform/mac/svg/custom/recursive-mask-expected.png: Added.
     18        * platform/mac/svg/custom/recursive-mask-expected.txt: Added.
     19        * platform/mac/svg/custom/recursive-pattern-expected.checksum: Added.
     20        * platform/mac/svg/custom/recursive-pattern-expected.png: Added.
     21        * platform/mac/svg/custom/recursive-pattern-expected.txt: Added.
     22        * svg/custom/recursive-filter.svg: Added.
     23        * svg/custom/recursive-gradient.svg: Added.
     24        * svg/custom/recursive-mask.svg: Added.
     25        * svg/custom/recursive-pattern.svg: Added.
     26
    1272010-07-14  Yuta Kitamura  <yutak@chromium.org>
    228

  • trunk/WebCore/ChangeLog

    r63291 r63300  
     12010-07-14  Nikolas Zimmermann  <nzimmermann@rim.com>
     2
     3        Reviewed by Eric Seidel.
     4
     5        SVG patterns and masks should not be able to reference themselves
     6        https://bugs.webkit.org/show_bug.cgi?id=32171
     7
     8        Don't apply pattern/mask resources, if they contain cyclic references. Gradients/Filters are not affected.
     9        Clippers are already correcly handling this on their own, as well as markers (all which require subtle quirks, covered by existing tests).
     10
     11        Tests: svg/custom/recursive-filter.svg
     12               svg/custom/recursive-gradient.svg
     13               svg/custom/recursive-mask.svg
     14               svg/custom/recursive-pattern.svg
     15
     16        * rendering/RenderSVGResourceContainer.h:
     17        (WebCore::RenderSVGResourceContainer::RenderSVGResourceContainer): Stop using idForStyleResolution(), but use getIdAttribute(), no functional change though.
     18        (WebCore::RenderSVGResourceContainer::idChanged): Ditto.
     19        (WebCore::RenderSVGResourceContainer::childElementReferencesResource): To be implemented by classes inheriting from us. Defaults to false.
     20        (WebCore::RenderSVGResourceContainer::containsCyclicReference): Check whether this resource contains contains a child which references ourselves.
     21        * rendering/RenderSVGResourceMasker.cpp:
     22        (WebCore::RenderSVGResourceMasker::childElementReferencesResource): Check whether the masker child specifies mask=".." with the same URI than ourselves.
     23        (WebCore::RenderSVGResourceMasker::applyResource): Early exit if we contain a cylic reference.
     24        * rendering/RenderSVGResourceMasker.h:
     25        * rendering/RenderSVGResourcePattern.cpp:
     26        (WebCore::RenderSVGResourcePattern::childElementReferencesResource): Check whether the masker child specifies fill=".." with the same URI than ourselves.
     27        (WebCore::RenderSVGResourcePattern::applyResource): Early exit if we contain a cylic reference.
     28        * rendering/RenderSVGResourcePattern.h:
     29        * svg/SVGPaint.cpp:
     30        (WebCore::SVGPaint::matchesTargetURI): Add new helper function comparing a SVGPaint URI with a given reference id.
     31        * svg/SVGPaint.h:
     32
    1332010-07-14  Eric Seidel  <eric@webkit.org>
    234

  • trunk/WebCore/rendering/RenderSVGResourceContainer.h

    r61094 r63300  
    3636        : RenderSVGHiddenContainer(node)
    3737        , RenderSVGResource()
    38         // FIXME: Should probably be using getIdAttribute rather than idForStyleResolution.
    39         , m_id(node->hasID() ? node->idForStyleResolution() : nullAtom)
     38        , m_id(node->hasID() ? node->getIdAttribute() : nullAtom)
    4039    {
    4140        ASSERT(node->document());
    … …  
    5857        // Remove old id, that is guaranteed to be present in cache
    5958        extensions->removeResource(m_id);
    60 
    61         // FIXME: Should probably be using getIdAttribute rather than idForStyleResolution.
    62         m_id = node()->hasID() ? static_cast<Element*>(node())->idForStyleResolution() : nullAtom;
     59        m_id = static_cast<Element*>(node())->getIdAttribute();
    6360
    6461        // It's possible that an element is referencing us with the new id, and has to be notified that we're existing now
    … …  
    8582
    8683    virtual RenderSVGResourceContainer* toRenderSVGResourceContainer() { return this; }
    87    
     84    virtual bool childElementReferencesResource(const SVGRenderStyle*, const String&) const { return false; }
     85
    8886    static AffineTransform transformOnNonScalingStroke(RenderObject* object, const AffineTransform resourceTransform)
    8987    {
    … …  
    9593        transform.multiply(element->getScreenCTM());
    9694        return transform;
     95    }
     96
     97    bool containsCyclicReference(const Node* startNode) const
     98    {
     99        Document* document = startNode->document();
     100        ASSERT(document);
     101   
     102        for (Node* node = startNode->firstChild(); node; node = node->nextSibling()) {
     103            if (!node->isSVGElement())
     104                continue;
     105   
     106            RenderObject* renderer = node->renderer();
     107            if (!renderer)
     108                continue;
     109   
     110            RenderStyle* style = renderer->style();
     111            if (!style)
     112                continue;
     113   
     114            const SVGRenderStyle* svgStyle = style->svgStyle();
     115            ASSERT(svgStyle);
     116   
     117            // Let the class inheriting from us decide whether the child element references ourselves.
     118            if (childElementReferencesResource(svgStyle, m_id))
     119                return true;
     120   
     121            if (node->hasChildNodes()) {
     122                if (containsCyclicReference(node))
     123                    return true;
     124            }
     125        }
     126   
     127        return false;
    97128    }
    98129

  • trunk/WebCore/rendering/RenderSVGResourceMasker.cpp

    r62118 r63300  
    8585}
    8686
     87bool RenderSVGResourceMasker::childElementReferencesResource(const SVGRenderStyle* style, const String& referenceId) const
     88{
     89    if (!style->hasMasker())
     90        return false;
     91
     92    return style->maskerResource() == referenceId;
     93}
     94
    8795bool RenderSVGResourceMasker::applyResource(RenderObject* object, RenderStyle*, GraphicsContext*& context, unsigned short resourceMode)
    8896{
    … …  
    102110        SVGMaskElement* maskElement = static_cast<SVGMaskElement*>(node());
    103111        if (!maskElement)
     112            return false;
     113
     114        // Early exit, if this resource contains a child which references ourselves.
     115        if (containsCyclicReference(node()))
    104116            return false;
    105117

  • trunk/WebCore/rendering/RenderSVGResourceMasker.h

    r60541 r63300  
    7070    void calculateMaskContentRepaintRect();
    7171
     72    virtual bool childElementReferencesResource(const SVGRenderStyle*, const String&) const;
     73
    7274    FloatRect m_maskBoundaries;
    7375    HashMap<RenderObject*, MaskerData*> m_masker;

  • trunk/WebCore/rendering/RenderSVGResourcePattern.cpp

    r62118 r63300  
    7070}
    7171
     72bool RenderSVGResourcePattern::childElementReferencesResource(const SVGRenderStyle* style, const String& referenceId) const
     73{
     74    if (style->hasFill()) {
     75        if (style->fillPaint()->matchesTargetURI(referenceId))
     76            return true;
     77    }
     78
     79    if (style->hasStroke()) {
     80        if (style->strokePaint()->matchesTargetURI(referenceId))
     81            return true;
     82    }
     83
     84    return false;
     85}
     86
    7287bool RenderSVGResourcePattern::applyResource(RenderObject* object, RenderStyle* style, GraphicsContext*& context, unsigned short resourceMode)
    7388{
    … …  
    92107    PatternData* patternData = m_pattern.get(object);
    93108    if (!patternData->pattern) {
     109        // Early exit, if this resource contains a child which references ourselves.
     110        if (containsCyclicReference(node()))
     111            return false;
    94112
    95113        // Create tile image

  • trunk/WebCore/rendering/RenderSVGResourcePattern.h

    r60760 r63300  
    6868                                                          const AffineTransform& viewBoxCTM, const FloatRect& patternBoundaries) const;
    6969
     70    virtual bool childElementReferencesResource(const SVGRenderStyle*, const String&) const;
     71
    7072    HashMap<RenderObject*, PatternData*> m_pattern;
    7173};

  • trunk/WebCore/svg/SVGPaint.cpp

    r61324 r63300  
    11/*
    2     Copyright (C) 2004, 2005 Nikolas Zimmermann <wildfox@kde.org>
     2    Copyright (C) 2004, 2005 Nikolas Zimmermann <zimmermann@kde.org>
    33                  2004, 2005, 2006, 2007 Rob Buis <buis@kde.org>
     4    Copyright (C) Research In Motion Limited 2010. All rights reserved.
    45
    56    This library is free software; you can redistribute it and/or
    … …  
    2021
    2122#include "config.h"
     23
    2224#if ENABLE(SVG)
    2325#include "SVGPaint.h"
     26#include "SVGURIReference.h"
    2427
    2528namespace WebCore {
    … …  
    109112}
    110113
     114bool SVGPaint::matchesTargetURI(const String& referenceId)
     115{
     116    if (m_paintType != SVG_PAINTTYPE_URI && m_paintType != SVG_PAINTTYPE_URI_RGBCOLOR)
     117        return false;
     118
     119    return referenceId == SVGURIReference::getTarget(m_uri);
    111120}
    112121
    113 // vim:ts=4:noet
     122}
     123
    114124#endif // ENABLE(SVG)
    115 

  • trunk/WebCore/svg/SVGPaint.h

    r34627 r63300  
    11/*
    2     Copyright (C) 2004, 2005 Nikolas Zimmermann <wildfox@kde.org>
     2    Copyright (C) 2004, 2005 Nikolas Zimmermann <zimmermann@kde.org>
    33                  2004, 2005, 2006, 2007 Rob Buis <buis@kde.org>
    44    Copyright (C) 2006 Samuel Weinig (sam.weinig@gmial.com)
    … …  
    7979        static SVGPaint* defaultStroke();
    8080
     81        bool matchesTargetURI(const String& referenceId);
     82
    8183    private:
    8284        SVGPaint();
    … …  
    9799#endif // ENABLE(SVG)
    98100#endif // SVGPaint_h
    99 
    100 // vim:ts=4:noet
Note: See TracChangeset for help on using the changeset viewer.