Title: [161630] trunk
- Revision
- 161630
- Author
- an...@apple.com
- Date
- 2014-01-10 04:33:09 -0800 (Fri, 10 Jan 2014)
Log Message
Crash when mutating SVG text with transform
https://bugs.webkit.org/show_bug.cgi?id=126744
Reviewed by Dirk Schulze.
Source/WebCore:
Test: svg/custom/mutation-text-transform-crash.html
Text-transform property triggers subtreeTextDidChange when an SVG text renderer is
being added to the render tree. The function assumes the child is already fully in the tree
but in this case we are still in middle of adding it.
* rendering/svg/RenderSVGText.cpp:
(WebCore::RenderSVGText::subtreeTextDidChange):
Bail out if the changed RenderSVGInlineText can't be found from m_layoutAttributes.
This means that subtreeChildWasAdded hasn't been invoked yet for it and there is nothing
to update. The required updates will happen in subtreeChildWasAdded.
LayoutTests:
* svg/custom/mutation-text-transform-crash-expected.txt: Added.
* svg/custom/mutation-text-transform-crash.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (161629 => 161630)
--- trunk/LayoutTests/ChangeLog 2014-01-10 12:03:10 UTC (rev 161629)
+++ trunk/LayoutTests/ChangeLog 2014-01-10 12:33:09 UTC (rev 161630)
@@ -1,3 +1,13 @@
+2014-01-10 Antti Koivisto <an...@apple.com>
+
+ Crash when mutating SVG text with transform
+ https://bugs.webkit.org/show_bug.cgi?id=126744
+
+ Reviewed by Dirk Schulze.
+
+ * svg/custom/mutation-text-transform-crash-expected.txt: Added.
+ * svg/custom/mutation-text-transform-crash.html: Added.
+
2014-01-10 Frédéric Wang <fred.w...@free.fr>
[SVG] Accept HTML and MathML namespaces as valid requiredExtensions
Added: trunk/LayoutTests/svg/custom/mutation-text-transform-crash-expected.txt (0 => 161630)
--- trunk/LayoutTests/svg/custom/mutation-text-transform-crash-expected.txt (rev 0)
+++ trunk/LayoutTests/svg/custom/mutation-text-transform-crash-expected.txt 2014-01-10 12:33:09 UTC (rev 161630)
@@ -0,0 +1,2 @@
+PASS
+
Added: trunk/LayoutTests/svg/custom/mutation-text-transform-crash.html (0 => 161630)
--- trunk/LayoutTests/svg/custom/mutation-text-transform-crash.html (rev 0)
+++ trunk/LayoutTests/svg/custom/mutation-text-transform-crash.html 2014-01-10 12:33:09 UTC (rev 161630)
@@ -0,0 +1,23 @@
+<html>
+<!-- This test passes if there is no crash or assert -->
+<style>
+text { text-transform: uppercase; }
+</style>
+<script>
+function testCrash() {
+ document.body.offsetWidth;
+ var test = document.getElementById('test');
+ test.removeChild(test.firstChild);
+ var textNode = document.createTextNode("PASS");
+ test.appendChild(textNode);
+}
+
+if (window.testRunner)
+ testRunner.dumpAsText();
+</script>
+<body _onload_="testCrash()">
+<svg>
+ <text id="test" x="0" y="15">FAIL</text>
+</svg>
+</body>
+</html>
Modified: trunk/Source/WebCore/ChangeLog (161629 => 161630)
--- trunk/Source/WebCore/ChangeLog 2014-01-10 12:03:10 UTC (rev 161629)
+++ trunk/Source/WebCore/ChangeLog 2014-01-10 12:33:09 UTC (rev 161630)
@@ -1,3 +1,23 @@
+2014-01-10 Antti Koivisto <an...@apple.com>
+
+ Crash when mutating SVG text with transform
+ https://bugs.webkit.org/show_bug.cgi?id=126744
+
+ Reviewed by Dirk Schulze.
+
+ Test: svg/custom/mutation-text-transform-crash.html
+
+ Text-transform property triggers subtreeTextDidChange when an SVG text renderer is
+ being added to the render tree. The function assumes the child is already fully in the tree
+ but in this case we are still in middle of adding it.
+
+ * rendering/svg/RenderSVGText.cpp:
+ (WebCore::RenderSVGText::subtreeTextDidChange):
+
+ Bail out if the changed RenderSVGInlineText can't be found from m_layoutAttributes.
+ This means that subtreeChildWasAdded hasn't been invoked yet for it and there is nothing
+ to update. The required updates will happen in subtreeChildWasAdded.
+
2014-01-10 Frédéric Wang <fred.w...@free.fr>
[SVG] Accept HTML and MathML namespaces as valid requiredExtensions
Modified: trunk/Source/WebCore/rendering/svg/RenderSVGText.cpp (161629 => 161630)
--- trunk/Source/WebCore/rendering/svg/RenderSVGText.cpp 2014-01-10 12:03:10 UTC (rev 161629)
+++ trunk/Source/WebCore/rendering/svg/RenderSVGText.cpp 2014-01-10 12:33:09 UTC (rev 161630)
@@ -321,6 +321,11 @@
ASSERT(!m_layoutAttributesBuilder.numberOfTextPositioningElements());
return;
}
+ // Text transforms can cause text change to be signaled during addChild before m_layoutAttributes has been updated.
+ if (!m_layoutAttributes.contains(text->layoutAttributes())) {
+ ASSERT(!text->everHadLayout());
+ return;
+ }
// Always protect the cache before clearing text positioning elements when the cache will subsequently be rebuilt.
FontCachePurgePreventer fontCachePurgePreventer;
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes
