Diff
Modified: branches/safari-534.51-branch/LayoutTests/ChangeLog (91535 => 91536)
--- branches/safari-534.51-branch/LayoutTests/ChangeLog 2011-07-22 00:18:42 UTC (rev 91535)
+++ branches/safari-534.51-branch/LayoutTests/ChangeLog 2011-07-22 00:21:36 UTC (rev 91536)
@@ -1,5 +1,25 @@
2011-07-21 Lucas Forschler <[email protected]>
+ Merged 90156.
+
+ 2011-06-30 Julien Chaffraix <[email protected]>
+
+ Reviewed by Nikolas Zimmermann.
+
+ Assertion failure in RenderSVGInlineText::characterStartsNewTextChunk
+ https://bugs.webkit.org/show_bug.cgi?id=63076
+
+ * svg/custom/crash-text-in-textpath-expected.txt: Added.
+ * svg/custom/crash-text-in-textpath.svg: Added.
+ Original crashing test case.
+
+ * svg/custom/text-node-in-text-invalidated-expected.txt: Added.
+ * svg/custom/text-node-in-text-invalidated.svg: Added.
+ This test case was not crashing. However it is good to make sure this change
+ did not regress that.
+
+2011-07-21 Lucas Forschler <[email protected]>
+
Merged 90130.
2011-06-29 Abhishek Arya <[email protected]>
Copied: branches/safari-534.51-branch/LayoutTests/svg/custom/crash-text-in-textpath-expected.txt (from rev 90156, trunk/LayoutTests/svg/custom/crash-text-in-textpath-expected.txt) (0 => 91536)
--- branches/safari-534.51-branch/LayoutTests/svg/custom/crash-text-in-textpath-expected.txt (rev 0)
+++ branches/safari-534.51-branch/LayoutTests/svg/custom/crash-text-in-textpath-expected.txt 2011-07-22 00:21:36 UTC (rev 91536)
@@ -0,0 +1,3 @@
+foo
+Test for bug 63076: Assertion failure in RenderSVGInlineText::characterStartsNewTextChunk
+This test passes if it does not crash
Copied: branches/safari-534.51-branch/LayoutTests/svg/custom/crash-text-in-textpath.svg (from rev 90156, trunk/LayoutTests/svg/custom/crash-text-in-textpath.svg) (0 => 91536)
--- branches/safari-534.51-branch/LayoutTests/svg/custom/crash-text-in-textpath.svg (rev 0)
+++ branches/safari-534.51-branch/LayoutTests/svg/custom/crash-text-in-textpath.svg 2011-07-22 00:21:36 UTC (rev 91536)
@@ -0,0 +1,20 @@
+<svg version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
+<text>
+ <textPath id="textPath">
+ <script>
+ if (window.layoutTestController)
+ layoutTestController.dumpAsText();
+
+ // This triggers a layout before adding the #text node.
+ document.getElementById('textPath').scrollIntoView('foo');
+ </script>
+ foo
+ <script>
+ // This triggers a layout after adding the #text node to fire the ASSERT.
+ document.getElementById('textPath').scrollIntoView('foo');
+ </script>
+ </textPath>
+</text>
+<text x="10" y="50">Test for bug <a xlink:href="" Assertion failure in RenderSVGInlineText::characterStartsNewTextChunk</text>
+<text x="10" y="100">This test passes if it does not crash</text>
+</svg>
Copied: branches/safari-534.51-branch/LayoutTests/svg/custom/text-node-in-text-invalidated-expected.txt (from rev 90156, trunk/LayoutTests/svg/custom/text-node-in-text-invalidated-expected.txt) (0 => 91536)
--- branches/safari-534.51-branch/LayoutTests/svg/custom/text-node-in-text-invalidated-expected.txt (rev 0)
+++ branches/safari-534.51-branch/LayoutTests/svg/custom/text-node-in-text-invalidated-expected.txt 2011-07-22 00:21:36 UTC (rev 91536)
@@ -0,0 +1,3 @@
+foo bar
+Test for bug 63076: Assertion failure in RenderSVGInlineText::characterStartsNewTextChunk
+This test passes if it does not crash
Copied: branches/safari-534.51-branch/LayoutTests/svg/custom/text-node-in-text-invalidated.svg (from rev 90156, trunk/LayoutTests/svg/custom/text-node-in-text-invalidated.svg) (0 => 91536)
--- branches/safari-534.51-branch/LayoutTests/svg/custom/text-node-in-text-invalidated.svg (rev 0)
+++ branches/safari-534.51-branch/LayoutTests/svg/custom/text-node-in-text-invalidated.svg 2011-07-22 00:21:36 UTC (rev 91536)
@@ -0,0 +1,20 @@
+<svg version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
+<text id="text">
+ bar
+ <script>
+ if (window.layoutTestController)
+ layoutTestController.dumpAsText();
+
+ // This triggers a layout before adding the #text node.
+ document.getElementById('text').scrollIntoView('foo');
+
+ var text = document.getElementById('text');
+ text.insertBefore(document.createTextNode('foo'), text.firstChild);
+
+ // This triggers a layout after adding the #text node to fire the ASSERT.
+ document.getElementById('text').scrollIntoView('foo');
+ </script>
+</text>
+<text x="10" y="50">Test for bug <a xlink:href="" Assertion failure in RenderSVGInlineText::characterStartsNewTextChunk</text>
+<text x="10" y="100">This test passes if it does not crash</text>
+</svg>
Modified: branches/safari-534.51-branch/Source/WebCore/ChangeLog (91535 => 91536)
--- branches/safari-534.51-branch/Source/WebCore/ChangeLog 2011-07-22 00:18:42 UTC (rev 91535)
+++ branches/safari-534.51-branch/Source/WebCore/ChangeLog 2011-07-22 00:21:36 UTC (rev 91536)
@@ -1,5 +1,38 @@
2011-07-21 Lucas Forschler <[email protected]>
+ Merged 90156.
+
+ 2011-06-30 Julien Chaffraix <[email protected]>
+
+ Reviewed by Nikolas Zimmermann.
+
+ Assertion failure in RenderSVGInlineText::characterStartsNewTextChunk
+ https://bugs.webkit.org/show_bug.cgi?id=63076
+
+ Tests: svg/custom/crash-text-in-textpath.svg
+ svg/custom/text-node-in-text-invalidated.svg
+
+ The problem was that we did not call setNeedsPositionUpdate on RenderSVGText. When
+ doing our layout, we would not update the attributes on our SVGRenderInlineText as
+ we would not lay it out.
+
+ This was caused by childrenChanged being overridden on SVGTextPositioningElement but
+ not on SVGTextPathElement.
+
+ As both classes shared the same mother class, it made sense to move the logic here.
+ There should be no other side effects as SVGTextPathElement and SVGTextPositioningElement
+ are the only classes deriving from SVGTextContentElement.
+
+ * svg/SVGTextContentElement.cpp:
+ (WebCore::SVGTextContentElement::childrenChanged): Moved this method from SVGTextPositioningElement.
+ * svg/SVGTextContentElement.h:
+ * svg/SVGTextPositioningElement.cpp:
+ (WebCore::SVGTextPositioningElement::svgAttributeChanged): Updated after updatePositioningValuesInRenderer
+ removal, replaced by RenderSVGText::locateRenderSVGTextAncestor.
+ * svg/SVGTextPositioningElement.h:
+
+2011-07-21 Lucas Forschler <[email protected]>
+
Merged 90130.
2011-06-30 Abhishek Arya <[email protected]>
Modified: branches/safari-534.51-branch/Source/WebCore/svg/SVGTextContentElement.cpp (91535 => 91536)
--- branches/safari-534.51-branch/Source/WebCore/svg/SVGTextContentElement.cpp 2011-07-22 00:18:42 UTC (rev 91535)
+++ branches/safari-534.51-branch/Source/WebCore/svg/SVGTextContentElement.cpp 2011-07-22 00:21:36 UTC (rev 91536)
@@ -29,6 +29,7 @@
#include "FrameSelection.h"
#include "RenderObject.h"
#include "RenderSVGResource.h"
+#include "RenderSVGText.h"
#include "SVGDocumentExtensions.h"
#include "SVGNames.h"
#include "SVGTextQuery.h"
@@ -292,6 +293,17 @@
return static_cast<SVGTextContentElement*>(node);
}
+void SVGTextContentElement::childrenChanged(bool changedByParser, Node* beforeChange, Node* afterChange, int childCountDelta)
+{
+ SVGStyledElement::childrenChanged(changedByParser, beforeChange, afterChange, childCountDelta);
+
+ if (changedByParser || !renderer())
+ return;
+
+ if (RenderSVGText* textRenderer = RenderSVGText::locateRenderSVGTextAncestor(renderer()))
+ textRenderer->setNeedsPositioningValuesUpdate();
}
+}
+
#endif // ENABLE(SVG)
Modified: branches/safari-534.51-branch/Source/WebCore/svg/SVGTextContentElement.h (91535 => 91536)
--- branches/safari-534.51-branch/Source/WebCore/svg/SVGTextContentElement.h 2011-07-22 00:18:42 UTC (rev 91535)
+++ branches/safari-534.51-branch/Source/WebCore/svg/SVGTextContentElement.h 2011-07-22 00:21:36 UTC (rev 91536)
@@ -71,6 +71,7 @@
void fillPassedAttributeToPropertyTypeMap(AttributeToPropertyTypeMap&);
virtual bool selfHasRelativeLengths() const;
+ virtual void childrenChanged(bool changedByParser = false, Node* beforeChange = 0, Node* afterChange = 0, int childCountDelta = 0);
private:
virtual bool isTextContent() const { return true; }
Modified: branches/safari-534.51-branch/Source/WebCore/svg/SVGTextPositioningElement.cpp (91535 => 91536)
--- branches/safari-534.51-branch/Source/WebCore/svg/SVGTextPositioningElement.cpp 2011-07-22 00:18:42 UTC (rev 91535)
+++ branches/safari-534.51-branch/Source/WebCore/svg/SVGTextPositioningElement.cpp 2011-07-22 00:21:36 UTC (rev 91536)
@@ -75,30 +75,6 @@
SVGTextContentElement::parseMappedAttribute(attr);
}
-static inline void updatePositioningValuesInRenderer(RenderObject* renderer)
-{
- RenderSVGText* textRenderer = 0;
-
- if (renderer->isSVGText())
- textRenderer = toRenderSVGText(renderer);
- else {
- // Locate RenderSVGText parent renderer.
- RenderObject* parent = renderer->parent();
- while (parent && !parent->isSVGText())
- parent = parent->parent();
-
- if (parent) {
- ASSERT(parent->isSVGText());
- textRenderer = toRenderSVGText(parent);
- }
- }
-
- if (!textRenderer)
- return;
-
- textRenderer->setNeedsPositioningValuesUpdate();
-}
-
void SVGTextPositioningElement::svgAttributeChanged(const QualifiedName& attrName)
{
SVGTextContentElement::svgAttributeChanged(attrName);
@@ -116,23 +92,13 @@
return;
if (updateRelativeLengths || attrName == SVGNames::rotateAttr) {
- updatePositioningValuesInRenderer(renderer);
+ if (RenderSVGText* textRenderer = RenderSVGText::locateRenderSVGTextAncestor(renderer))
+ textRenderer->setNeedsPositioningValuesUpdate();
RenderSVGResource::markForLayoutAndParentResourceInvalidation(renderer);
return;
}
}
-void SVGTextPositioningElement::childrenChanged(bool changedByParser, Node* beforeChange, Node* afterChange, int childCountDelta)
-{
- SVGTextContentElement::childrenChanged(changedByParser, beforeChange, afterChange, childCountDelta);
-
- if (changedByParser)
- return;
-
- if (RenderObject* object = renderer())
- updatePositioningValuesInRenderer(object);
-}
-
void SVGTextPositioningElement::synchronizeProperty(const QualifiedName& attrName)
{
SVGTextContentElement::synchronizeProperty(attrName);
Modified: branches/safari-534.51-branch/Source/WebCore/svg/SVGTextPositioningElement.h (91535 => 91536)
--- branches/safari-534.51-branch/Source/WebCore/svg/SVGTextPositioningElement.h 2011-07-22 00:18:42 UTC (rev 91535)
+++ branches/safari-534.51-branch/Source/WebCore/svg/SVGTextPositioningElement.h 2011-07-22 00:21:36 UTC (rev 91536)
@@ -36,7 +36,6 @@
SVGTextPositioningElement(const QualifiedName&, Document*);
virtual void parseMappedAttribute(Attribute*);
- virtual void childrenChanged(bool changedByParser = false, Node* beforeChange = 0, Node* afterChange = 0, int childCountDelta = 0);
virtual void svgAttributeChanged(const QualifiedName&);
virtual void synchronizeProperty(const QualifiedName&);
void fillPassedAttributeToPropertyTypeMap(AttributeToPropertyTypeMap&);
