Changeset 63300 in webkit
- Timestamp:
- Jul 14, 2010 2:39:25 AM (14 years ago)
- Location:
- trunk
- Files:
-
- 16 added
- 9 edited
Legend:
- Unmodified
- Added
- Removed
-
trunk/LayoutTests/ChangeLog
r63298 r63300 1 2010-07-14 Nikolas Zimmermann <nzimmermann@rim.com> 2 3 Reviewed by Eric Seidel. 4 5 SVG patterns and masks should not be able to reference themselves 6 https://bugs.webkit.org/show_bug.cgi?id=32171 7 8 Add new layout tests covering recursion in pattern/mask/gradient/filter. Nothing crashing anymore. 9 10 * platform/mac/svg/custom/recursive-filter-expected.checksum: Added. 11 * platform/mac/svg/custom/recursive-filter-expected.png: Added. 12 * platform/mac/svg/custom/recursive-filter-expected.txt: Added. 13 * platform/mac/svg/custom/recursive-gradient-expected.checksum: Added. 14 * platform/mac/svg/custom/recursive-gradient-expected.png: Added. 15 * platform/mac/svg/custom/recursive-gradient-expected.txt: Added. 16 * platform/mac/svg/custom/recursive-mask-expected.checksum: Added. 17 * platform/mac/svg/custom/recursive-mask-expected.png: Added. 18 * platform/mac/svg/custom/recursive-mask-expected.txt: Added. 19 * platform/mac/svg/custom/recursive-pattern-expected.checksum: Added. 20 * platform/mac/svg/custom/recursive-pattern-expected.png: Added. 21 * platform/mac/svg/custom/recursive-pattern-expected.txt: Added. 22 * svg/custom/recursive-filter.svg: Added. 23 * svg/custom/recursive-gradient.svg: Added. 24 * svg/custom/recursive-mask.svg: Added. 25 * svg/custom/recursive-pattern.svg: Added. 26 1 27 2010-07-14 Yuta Kitamura <yutak@chromium.org> 2 28 -
trunk/WebCore/ChangeLog
r63291 r63300 1 2010-07-14 Nikolas Zimmermann <nzimmermann@rim.com> 2 3 Reviewed by Eric Seidel. 4 5 SVG patterns and masks should not be able to reference themselves 6 https://bugs.webkit.org/show_bug.cgi?id=32171 7 8 Don't apply pattern/mask resources, if they contain cyclic references. Gradients/Filters are not affected. 9 Clippers are already correcly handling this on their own, as well as markers (all which require subtle quirks, covered by existing tests). 10 11 Tests: svg/custom/recursive-filter.svg 12 svg/custom/recursive-gradient.svg 13 svg/custom/recursive-mask.svg 14 svg/custom/recursive-pattern.svg 15 16 * rendering/RenderSVGResourceContainer.h: 17 (WebCore::RenderSVGResourceContainer::RenderSVGResourceContainer): Stop using idForStyleResolution(), but use getIdAttribute(), no functional change though. 18 (WebCore::RenderSVGResourceContainer::idChanged): Ditto. 19 (WebCore::RenderSVGResourceContainer::childElementReferencesResource): To be implemented by classes inheriting from us. Defaults to false. 20 (WebCore::RenderSVGResourceContainer::containsCyclicReference): Check whether this resource contains contains a child which references ourselves. 21 * rendering/RenderSVGResourceMasker.cpp: 22 (WebCore::RenderSVGResourceMasker::childElementReferencesResource): Check whether the masker child specifies mask=".." with the same URI than ourselves. 23 (WebCore::RenderSVGResourceMasker::applyResource): Early exit if we contain a cylic reference. 24 * rendering/RenderSVGResourceMasker.h: 25 * rendering/RenderSVGResourcePattern.cpp: 26 (WebCore::RenderSVGResourcePattern::childElementReferencesResource): Check whether the masker child specifies fill=".." with the same URI than ourselves. 27 (WebCore::RenderSVGResourcePattern::applyResource): Early exit if we contain a cylic reference. 28 * rendering/RenderSVGResourcePattern.h: 29 * svg/SVGPaint.cpp: 30 (WebCore::SVGPaint::matchesTargetURI): Add new helper function comparing a SVGPaint URI with a given reference id. 31 * svg/SVGPaint.h: 32 1 33 2010-07-14 Eric Seidel <eric@webkit.org> 2 34 -
trunk/WebCore/rendering/RenderSVGResourceContainer.h
r61094 r63300 36 36 : RenderSVGHiddenContainer(node) 37 37 , RenderSVGResource() 38 // FIXME: Should probably be using getIdAttribute rather than idForStyleResolution. 39 , m_id(node->hasID() ? node->idForStyleResolution() : nullAtom) 38 , m_id(node->hasID() ? node->getIdAttribute() : nullAtom) 40 39 { 41 40 ASSERT(node->document()); … … 58 57 // Remove old id, that is guaranteed to be present in cache 59 58 extensions->removeResource(m_id); 60 61 // FIXME: Should probably be using getIdAttribute rather than idForStyleResolution. 62 m_id = node()->hasID() ? static_cast<Element*>(node())->idForStyleResolution() : nullAtom; 59 m_id = static_cast<Element*>(node())->getIdAttribute(); 63 60 64 61 // It's possible that an element is referencing us with the new id, and has to be notified that we're existing now … … 85 82 86 83 virtual RenderSVGResourceContainer* toRenderSVGResourceContainer() { return this; } 87 84 virtual bool childElementReferencesResource(const SVGRenderStyle*, const String&) const { return false; } 85 88 86 static AffineTransform transformOnNonScalingStroke(RenderObject* object, const AffineTransform resourceTransform) 89 87 { … … 95 93 transform.multiply(element->getScreenCTM()); 96 94 return transform; 95 } 96 97 bool containsCyclicReference(const Node* startNode) const 98 { 99 Document* document = startNode->document(); 100 ASSERT(document); 101 102 for (Node* node = startNode->firstChild(); node; node = node->nextSibling()) { 103 if (!node->isSVGElement()) 104 continue; 105 106 RenderObject* renderer = node->renderer(); 107 if (!renderer) 108 continue; 109 110 RenderStyle* style = renderer->style(); 111 if (!style) 112 continue; 113 114 const SVGRenderStyle* svgStyle = style->svgStyle(); 115 ASSERT(svgStyle); 116 117 // Let the class inheriting from us decide whether the child element references ourselves. 118 if (childElementReferencesResource(svgStyle, m_id)) 119 return true; 120 121 if (node->hasChildNodes()) { 122 if (containsCyclicReference(node)) 123 return true; 124 } 125 } 126 127 return false; 97 128 } 98 129 -
trunk/WebCore/rendering/RenderSVGResourceMasker.cpp
r62118 r63300 85 85 } 86 86 87 bool RenderSVGResourceMasker::childElementReferencesResource(const SVGRenderStyle* style, const String& referenceId) const 88 { 89 if (!style->hasMasker()) 90 return false; 91 92 return style->maskerResource() == referenceId; 93 } 94 87 95 bool RenderSVGResourceMasker::applyResource(RenderObject* object, RenderStyle*, GraphicsContext*& context, unsigned short resourceMode) 88 96 { … … 102 110 SVGMaskElement* maskElement = static_cast<SVGMaskElement*>(node()); 103 111 if (!maskElement) 112 return false; 113 114 // Early exit, if this resource contains a child which references ourselves. 115 if (containsCyclicReference(node())) 104 116 return false; 105 117 -
trunk/WebCore/rendering/RenderSVGResourceMasker.h
r60541 r63300 70 70 void calculateMaskContentRepaintRect(); 71 71 72 virtual bool childElementReferencesResource(const SVGRenderStyle*, const String&) const; 73 72 74 FloatRect m_maskBoundaries; 73 75 HashMap<RenderObject*, MaskerData*> m_masker; -
trunk/WebCore/rendering/RenderSVGResourcePattern.cpp
r62118 r63300 70 70 } 71 71 72 bool RenderSVGResourcePattern::childElementReferencesResource(const SVGRenderStyle* style, const String& referenceId) const 73 { 74 if (style->hasFill()) { 75 if (style->fillPaint()->matchesTargetURI(referenceId)) 76 return true; 77 } 78 79 if (style->hasStroke()) { 80 if (style->strokePaint()->matchesTargetURI(referenceId)) 81 return true; 82 } 83 84 return false; 85 } 86 72 87 bool RenderSVGResourcePattern::applyResource(RenderObject* object, RenderStyle* style, GraphicsContext*& context, unsigned short resourceMode) 73 88 { … … 92 107 PatternData* patternData = m_pattern.get(object); 93 108 if (!patternData->pattern) { 109 // Early exit, if this resource contains a child which references ourselves. 110 if (containsCyclicReference(node())) 111 return false; 94 112 95 113 // Create tile image -
trunk/WebCore/rendering/RenderSVGResourcePattern.h
r60760 r63300 68 68 const AffineTransform& viewBoxCTM, const FloatRect& patternBoundaries) const; 69 69 70 virtual bool childElementReferencesResource(const SVGRenderStyle*, const String&) const; 71 70 72 HashMap<RenderObject*, PatternData*> m_pattern; 71 73 }; -
trunk/WebCore/svg/SVGPaint.cpp
r61324 r63300 1 1 /* 2 Copyright (C) 2004, 2005 Nikolas Zimmermann < wildfox@kde.org>2 Copyright (C) 2004, 2005 Nikolas Zimmermann <zimmermann@kde.org> 3 3 2004, 2005, 2006, 2007 Rob Buis <buis@kde.org> 4 Copyright (C) Research In Motion Limited 2010. All rights reserved. 4 5 5 6 This library is free software; you can redistribute it and/or … … 20 21 21 22 #include "config.h" 23 22 24 #if ENABLE(SVG) 23 25 #include "SVGPaint.h" 26 #include "SVGURIReference.h" 24 27 25 28 namespace WebCore { … … 109 112 } 110 113 114 bool SVGPaint::matchesTargetURI(const String& referenceId) 115 { 116 if (m_paintType != SVG_PAINTTYPE_URI && m_paintType != SVG_PAINTTYPE_URI_RGBCOLOR) 117 return false; 118 119 return referenceId == SVGURIReference::getTarget(m_uri); 111 120 } 112 121 113 // vim:ts=4:noet 122 } 123 114 124 #endif // ENABLE(SVG) 115 -
trunk/WebCore/svg/SVGPaint.h
r34627 r63300 1 1 /* 2 Copyright (C) 2004, 2005 Nikolas Zimmermann < wildfox@kde.org>2 Copyright (C) 2004, 2005 Nikolas Zimmermann <zimmermann@kde.org> 3 3 2004, 2005, 2006, 2007 Rob Buis <buis@kde.org> 4 4 Copyright (C) 2006 Samuel Weinig (sam.weinig@gmial.com) … … 79 79 static SVGPaint* defaultStroke(); 80 80 81 bool matchesTargetURI(const String& referenceId); 82 81 83 private: 82 84 SVGPaint(); … … 97 99 #endif // ENABLE(SVG) 98 100 #endif // SVGPaint_h 99 100 // vim:ts=4:noet
Note: See TracChangeset
for help on using the changeset viewer.