Changeset 73820 in webkit


Ignore:
Timestamp:
Dec 10, 2010 5:23:26 PM (13 years ago)
Author:
commit-queue@webkit.org
Message:

2010-12-10 Cosmin Truta <​ctruta@chromium.org>

Reviewed by Eric Seidel.

Crash while processing ill-formed <textPath> ouside of <text>
​https://bugs.webkit.org/show_bug.cgi?id=47759

Ensure that ill-formed text content child elements do not crash.

  • svg/custom/invalid-text-content.svg: Added.
  • svg/custom/invalid-text-content-expected.checksum: Added.
  • svg/custom/invalid-text-content-expected.png: Added.
  • svg/custom/invalid-text-content-expected.txt: Added.

2010-12-10 Cosmin Truta <​ctruta@chromium.org>

Reviewed by Eric Seidel.

Crash while processing ill-formed <textPath> ouside of <text>
​https://bugs.webkit.org/show_bug.cgi?id=47759

Renderers within a <text> subtree are created only when their corresponding elements
satisfy the content model.

Test: svg/custom/invalid-text-content.svg

  • svg/SVGTRefElement.cpp: (WebCore::SVGTRefElement::childShouldCreateRenderer): Fixed to comply with the content model. (WebCore::SVGTRefElement::rendererIsNeeded): Added.
  • svg/SVGTRefElement.h:
  • svg/SVGTSpanElement.cpp: (WebCore::SVGTSpanElement::childShouldCreateRenderer): Fixed to comply with the content model. (WebCore::SVGTSpanElement::rendererIsNeeded): Added.
  • svg/SVGTSpanElement.h: Changed indentation.
  • svg/SVGTextElement.cpp: (WebCore::SVGTextElement::childShouldCreateRenderer): Reformatted.
  • svg/SVGTextPathElement.cpp: (WebCore::SVGTextPathElement::childShouldCreateRenderer): Fixed to comply with the content model. (WebCore::SVGTextPathElement::rendererIsNeeded): Added.
  • svg/SVGTextPathElement.h:
Location:
trunk
Files:
4 added
9 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r73817 r73820  
     12010-12-10  Cosmin Truta  <ctruta@chromium.org>
     2
     3        Reviewed by Eric Seidel.
     4
     5        Crash while processing ill-formed <textPath> ouside of <text>
     6        https://bugs.webkit.org/show_bug.cgi?id=47759
     7
     8        Ensure that ill-formed text content child elements do not crash.
     9
     10        * svg/custom/invalid-text-content.svg: Added.
     11        * svg/custom/invalid-text-content-expected.checksum: Added.
     12        * svg/custom/invalid-text-content-expected.png: Added.
     13        * svg/custom/invalid-text-content-expected.txt: Added.
     14
    1152010-12-10  Adam Barth  <abarth@webkit.org>
    216

  • trunk/WebCore/ChangeLog

    r73819 r73820  
     12010-12-10  Cosmin Truta  <ctruta@chromium.org>
     2
     3        Reviewed by Eric Seidel.
     4
     5        Crash while processing ill-formed <textPath> ouside of <text>
     6        https://bugs.webkit.org/show_bug.cgi?id=47759
     7
     8        Renderers within a <text> subtree are created only when their corresponding elements
     9        satisfy the content model.
     10
     11        Test: svg/custom/invalid-text-content.svg
     12
     13        * svg/SVGTRefElement.cpp:
     14        (WebCore::SVGTRefElement::childShouldCreateRenderer): Fixed to comply with the content model.
     15        (WebCore::SVGTRefElement::rendererIsNeeded): Added.
     16        * svg/SVGTRefElement.h:
     17        * svg/SVGTSpanElement.cpp:
     18        (WebCore::SVGTSpanElement::childShouldCreateRenderer): Fixed to comply with the content model.
     19        (WebCore::SVGTSpanElement::rendererIsNeeded): Added.
     20        * svg/SVGTSpanElement.h: Changed indentation.
     21        * svg/SVGTextElement.cpp:
     22        (WebCore::SVGTextElement::childShouldCreateRenderer): Reformatted.
     23        * svg/SVGTextPathElement.cpp:
     24        (WebCore::SVGTextPathElement::childShouldCreateRenderer): Fixed to comply with the content model.
     25        (WebCore::SVGTextPathElement::rendererIsNeeded): Added.
     26        * svg/SVGTextPathElement.h:
     27
    1282010-12-10  Zhenyao Mo  <zmo@google.com>
    229

  • trunk/WebCore/svg/SVGTRefElement.cpp

    r73130 r73820  
    8585}
    8686
    87 bool SVGTRefElement::childShouldCreateRenderer(Node* child) const
    88 {
    89     if (child->isTextNode() || child->hasTagName(SVGNames::tspanTag) ||
    90         child->hasTagName(SVGNames::trefTag))
    91         return true;
    92     return false;
    93 }
    94 
    9587RenderObject* SVGTRefElement::createRenderer(RenderArena* arena, RenderStyle*)
    9688{
    … …  
    9890}
    9991
     92bool SVGTRefElement::childShouldCreateRenderer(Node* child) const
     93{
     94    if (child->isTextNode())
     95        return true;
     96
     97    return false;
     98}
     99
     100bool SVGTRefElement::rendererIsNeeded(RenderStyle* style)
     101{
     102    if (parentNode()
     103        && (parentNode()->hasTagName(SVGNames::aTag)
     104#if ENABLE(SVG_FONTS)
     105            || parentNode()->hasTagName(SVGNames::altGlyphTag)
     106#endif
     107            || parentNode()->hasTagName(SVGNames::textTag)
     108            || parentNode()->hasTagName(SVGNames::textPathTag)
     109            || parentNode()->hasTagName(SVGNames::tspanTag)))
     110        return StyledElement::rendererIsNeeded(style);
     111
     112    return false;
     113}
     114
    100115}
    101116

  • trunk/WebCore/svg/SVGTRefElement.h

    r73130 r73820  
    4242    virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
    4343    virtual bool childShouldCreateRenderer(Node*) const;
     44    virtual bool rendererIsNeeded(RenderStyle*);
    4445
    4546    void updateReferencedText();

  • trunk/WebCore/svg/SVGTSpanElement.cpp

    r69922 r73820  
    4040}
    4141
     42RenderObject* SVGTSpanElement::createRenderer(RenderArena* arena, RenderStyle*)
     43{
     44    return new (arena) RenderSVGTSpan(this);
     45}
     46
    4247bool SVGTSpanElement::childShouldCreateRenderer(Node* child) const
    4348{
    4449    if (child->isTextNode()
     50        || child->hasTagName(SVGNames::aTag)
    4551#if ENABLE(SVG_FONTS)
    4652        || child->hasTagName(SVGNames::altGlyphTag)
    4753#endif
    48         || child->hasTagName(SVGNames::tspanTag)
    4954        || child->hasTagName(SVGNames::trefTag)
    50         || child->hasTagName(SVGNames::aTag)
    51         || child->hasTagName(SVGNames::textPathTag))
     55        || child->hasTagName(SVGNames::tspanTag))
    5256        return true;
    5357
    … …  
    5559}
    5660
    57 RenderObject* SVGTSpanElement::createRenderer(RenderArena* arena, RenderStyle*)
     61bool SVGTSpanElement::rendererIsNeeded(RenderStyle* style)
    5862{
    59     return new (arena) RenderSVGTSpan(this);
     63    if (parentNode()
     64        && (parentNode()->hasTagName(SVGNames::aTag)
     65#if ENABLE(SVG_FONTS)
     66            || parentNode()->hasTagName(SVGNames::altGlyphTag)
     67#endif
     68            || parentNode()->hasTagName(SVGNames::textTag)
     69            || parentNode()->hasTagName(SVGNames::textPathTag)
     70            || parentNode()->hasTagName(SVGNames::tspanTag)))
     71        return StyledElement::rendererIsNeeded(style);
     72
     73    return false;
    6074}
    6175

  • trunk/WebCore/svg/SVGTSpanElement.h

    r66362 r73820  
    2727namespace WebCore {
    2828
    29     class SVGTSpanElement : public SVGTextPositioningElement {
    30     public:
    31         static PassRefPtr<SVGTSpanElement> create(const QualifiedName&, Document*);
     29class SVGTSpanElement : public SVGTextPositioningElement {
     30public:
     31    static PassRefPtr<SVGTSpanElement> create(const QualifiedName&, Document*);
    3232
    33     private:
    34         SVGTSpanElement(const QualifiedName&, Document*);
    35                
    36         virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
    37         virtual bool childShouldCreateRenderer(Node*) const;
    38     };
     33private:
     34    SVGTSpanElement(const QualifiedName&, Document*);
     35           
     36    virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
     37    virtual bool childShouldCreateRenderer(Node*) const;
     38    virtual bool rendererIsNeeded(RenderStyle*);
     39};
    3940
    4041} // namespace WebCore

  • trunk/WebCore/svg/SVGTextElement.cpp

    r73258 r73820  
    108108{
    109109    if (child->isTextNode()
     110        || child->hasTagName(SVGNames::aTag)
    110111#if ENABLE(SVG_FONTS)
    111112        || child->hasTagName(SVGNames::altGlyphTag)
    112113#endif
    113         || child->hasTagName(SVGNames::tspanTag) || child->hasTagName(SVGNames::trefTag) || child->hasTagName(SVGNames::aTag) || child->hasTagName(SVGNames::textPathTag))
     114        || child->hasTagName(SVGNames::textPathTag)
     115        || child->hasTagName(SVGNames::trefTag)
     116        || child->hasTagName(SVGNames::tspanTag))
    114117        return true;
     118
    115119    return false;
    116120}

  • trunk/WebCore/svg/SVGTextPathElement.cpp

    r73258 r73820  
    119119{
    120120    if (child->isTextNode()
    121 #if ENABLE(SVG_FONTS)
    122         || child->hasTagName(SVGNames::altGlyphTag)
    123 #endif
     121        || child->hasTagName(SVGNames::aTag)
    124122        || child->hasTagName(SVGNames::trefTag)
    125         || child->hasTagName(SVGNames::tspanTag)
    126         || child->hasTagName(SVGNames::aTag)
    127         || child->hasTagName(SVGNames::textPathTag))
     123        || child->hasTagName(SVGNames::tspanTag))
    128124        return true;
     125
     126    return false;
     127}
     128
     129bool SVGTextPathElement::rendererIsNeeded(RenderStyle* style)
     130{
     131    if (parentNode()
     132        && (parentNode()->hasTagName(SVGNames::aTag)
     133            || parentNode()->hasTagName(SVGNames::textTag)))
     134        return StyledElement::rendererIsNeeded(style);
    129135
    130136    return false;

  • trunk/WebCore/svg/SVGTextPathElement.h

    r73130 r73820  
    6363    virtual void svgAttributeChanged(const QualifiedName&);
    6464    virtual void synchronizeProperty(const QualifiedName&);
     65
    6566    virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
    66 
    6767    virtual bool childShouldCreateRenderer(Node*) const;
     68    virtual bool rendererIsNeeded(RenderStyle*);
    6869
    6970    virtual bool selfHasRelativeLengths() const;
Note: See TracChangeset for help on using the changeset viewer.