Title: [88836] branches/chromium/742
- Revision
- 88836
- Author
- [email protected]
- Date
- 2011-06-14 11:42:00 -0700 (Tue, 14 Jun 2011)
Log Message
Merge 88549
BUG=85211
Review URL: http://codereview.chromium.org/7149024
Modified Paths
Added Paths
Diff
Copied: branches/chromium/742/LayoutTests/svg/dom/use-style-recalc-script-execute-crash-expected.txt (from rev 88549, trunk/LayoutTests/svg/dom/use-style-recalc-script-execute-crash-expected.txt) (0 => 88836)
--- branches/chromium/742/LayoutTests/svg/dom/use-style-recalc-script-execute-crash-expected.txt (rev 0)
+++ branches/chromium/742/LayoutTests/svg/dom/use-style-recalc-script-execute-crash-expected.txt 2011-06-14 18:42:00 UTC (rev 88836)
@@ -0,0 +1 @@
+Test passes if it does not crash and "script" inside "rect" does not execute.
Copied: branches/chromium/742/LayoutTests/svg/dom/use-style-recalc-script-execute-crash.html (from rev 88549, trunk/LayoutTests/svg/dom/use-style-recalc-script-execute-crash.html) (0 => 88836)
--- branches/chromium/742/LayoutTests/svg/dom/use-style-recalc-script-execute-crash.html (rev 0)
+++ branches/chromium/742/LayoutTests/svg/dom/use-style-recalc-script-execute-crash.html 2011-06-14 18:42:00 UTC (rev 88836)
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html>
+Test passes if it does not crash and "script" inside "rect" does not execute.
+<script>
+if (window.layoutTestController)
+ layoutTestController.dumpAsText();
+</script>
+<svg>
+<g>
+<use xlink:href=""
+<rect id="test">
+<script>
+document.body.innerHTML = "FAIL";
+</script>
+</rect>
+</g>
+</svg>
+</html>
+
Modified: branches/chromium/742/Source/WebCore/dom/ScriptElement.cpp (88835 => 88836)
--- branches/chromium/742/Source/WebCore/dom/ScriptElement.cpp 2011-06-14 18:32:36 UTC (rev 88835)
+++ branches/chromium/742/Source/WebCore/dom/ScriptElement.cpp 2011-06-14 18:42:00 UTC (rev 88836)
@@ -198,6 +198,14 @@
if (!m_element->document()->frame()->script()->canExecuteScripts(AboutToExecuteScript))
return false;
+ // FIXME: This is non-standard. Remove this after https://bugs.webkit.org/show_bug.cgi?id=62412.
+ Node* ancestor = m_element->parentNode();
+ while (ancestor) {
+ if (ancestor->isSVGShadowRoot())
+ return false;
+ ancestor = ancestor->parentNode();
+ }
+
if (!isScriptForEventSupported())
return false;
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
