Changeset 84899 in webkit

Timestamp:

Apr 26, 2011 2:57:11 AM (13 years ago)

Author:

leo.yang@torchmobile.com.cn

Message:

2011-04-26 Leo Yang <​leo.yang@torchmobile.com.cn>

Reviewed by Nikolas Zimmermann.

ASSERT failure in SVGUseElement
​https://bugs.webkit.org/show_bug.cgi?id=59313

Test case to verify webkit doesn't crash when a <use> element
is pending on resource and the document is not well-formed.
Test passes if no crash occurs in debug mode.

• svg/custom/use-crash-in-non-wellformed-document-expected.txt: Added.
• svg/custom/use-crash-in-non-wellformed-document.svg: Added.

2011-04-26 Leo Yang <​leo.yang@torchmobile.com.cn>

Reviewed by Nikolas Zimmermann.

ASSERT failure in SVGUseElement
​https://bugs.webkit.org/show_bug.cgi?id=59313

In SVGUseElement::insertedIntoDocument(), ASSERT(!m_isPendingResource)
was wrong because the document may not be well-formed.

This patch asserts the element is not pending on resource or the
document is not well-formed.

Test: svg/custom/use-crash-in-non-wellformed-document.svg

• svg/SVGUseElement.cpp: (WebCore::isWellFormedDocument): (WebCore::SVGUseElement::insertedIntoDocument):

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/svg/custom/use-crash-in-non-wellformed-document-expected.txt (added)
• LayoutTests/svg/custom/use-crash-in-non-wellformed-document.svg (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/svg/SVGUseElement.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2011-04-26  Leo Yang  <leo.yang@torchmobile.com.cn>
+
+        Reviewed by Nikolas Zimmermann.
+
+        ASSERT failure in SVGUseElement
+        https://bugs.webkit.org/show_bug.cgi?id=59313
+
+        Test case to verify webkit doesn't crash when a <use> element
+        is pending on resource and the document is not well-formed.
+        Test passes if no crash occurs in debug mode.
+
+        * svg/custom/use-crash-in-non-wellformed-document-expected.txt: Added.
+        * svg/custom/use-crash-in-non-wellformed-document.svg: Added.
+
 2011-04-26  Chang Shu  <cshu@webkit.org>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2011-04-26  Leo Yang  <leo.yang@torchmobile.com.cn>
+
+        Reviewed by Nikolas Zimmermann.
+
+        ASSERT failure in SVGUseElement
+        https://bugs.webkit.org/show_bug.cgi?id=59313
+
+        In SVGUseElement::insertedIntoDocument(), ASSERT(!m_isPendingResource)
+        was wrong because the document may not be well-formed.
+
+        This patch asserts the element is not pending on resource or the
+        document is not well-formed.
+
+        Test: svg/custom/use-crash-in-non-wellformed-document.svg
+
+        * svg/SVGUseElement.cpp:
+        (WebCore::isWellFormedDocument):
+        (WebCore::SVGUseElement::insertedIntoDocument):
+
 2011-04-26  Mikhail Naganov  <mnaganov@chromium.org>
 

trunk/Source/WebCore/svg/SVGUseElement.cpp

@@ -128 +128 @@
 }
 
+static inline bool isWellFormedDocument(Document* document)
+{
+    if (document->isSVGDocument() || document->isXHTMLDocument())
+        return static_cast<XMLDocumentParser*>(document->parser())->wellFormed();
+    return true;
+}
+
 void SVGUseElement::insertedIntoDocument()
 {
     // This functions exists to assure assumptions made in the code regarding SVGElementInstance creation/destruction are satisfied.
     SVGStyledTransformableElement::insertedIntoDocument();
-    ASSERT(!m_targetElementInstance || ((document()->isSVGDocument() || document()->isXHTMLDocument()) && !static_cast<XMLDocumentParser*>(document()->parser())->wellFormed()));
-    ASSERT(!m_isPendingResource);
+    ASSERT(!m_targetElementInstance || !isWellFormedDocument(document()));
+    ASSERT(!m_isPendingResource || !isWellFormedDocument(document()));
 }