Diff
Modified: branches/safari-534.51-branch/LayoutTests/ChangeLog (91536 => 91537)
--- branches/safari-534.51-branch/LayoutTests/ChangeLog 2011-07-22 00:21:36 UTC (rev 91536)
+++ branches/safari-534.51-branch/LayoutTests/ChangeLog 2011-07-22 00:23:39 UTC (rev 91537)
@@ -1,5 +1,20 @@
2011-07-21 Lucas Forschler <[email protected]>
+ Merged 90166.
+
+ 2011-06-30 Julien Chaffraix <[email protected]>
+
+ Reviewed by Nikolas Zimmermann.
+
+ Update SVG position values on SVG DOM updates
+ https://bugs.webkit.org/show_bug.cgi?id=62439
+
+ * svg/custom/crash-textPath-attributes-expected.txt: Added.
+ * svg/custom/crash-textPath-attributes.html: Added.
+ * svg/custom/resources/crash-textPath-attributes-iframe.svg: Added.
+
+2011-07-21 Lucas Forschler <[email protected]>
+
Merged 90156.
2011-06-30 Julien Chaffraix <[email protected]>
Copied: branches/safari-534.51-branch/LayoutTests/svg/custom/crash-textPath-attributes-expected.txt (from rev 90166, trunk/LayoutTests/svg/custom/crash-textPath-attributes-expected.txt) (0 => 91537)
--- branches/safari-534.51-branch/LayoutTests/svg/custom/crash-textPath-attributes-expected.txt (rev 0)
+++ branches/safari-534.51-branch/LayoutTests/svg/custom/crash-textPath-attributes-expected.txt 2011-07-22 00:23:39 UTC (rev 91537)
@@ -0,0 +1,4 @@
+
+Test for Update SVG position values on SVG DOM updates
+
+This test PASSES if he does not crash
Copied: branches/safari-534.51-branch/LayoutTests/svg/custom/crash-textPath-attributes.html (from rev 90166, trunk/LayoutTests/svg/custom/crash-textPath-attributes.html) (0 => 91537)
--- branches/safari-534.51-branch/LayoutTests/svg/custom/crash-textPath-attributes.html (rev 0)
+++ branches/safari-534.51-branch/LayoutTests/svg/custom/crash-textPath-attributes.html 2011-07-22 00:23:39 UTC (rev 91537)
@@ -0,0 +1,13 @@
+<iframe src="" _onload_="go(this)"></iframe>
+<script>
+ if (window.layoutTestController)
+ layoutTestController.dumpAsText();
+
+ function go(oIframe) {
+ var oSelection = oIframe.contentWindow.getSelection();
+ oSelection.selectAllChildren(oIframe.contentDocument);
+ oSelection.deleteFromDocument();
+ }
+</script>
+<p>Test for <a href="" SVG position values on SVG DOM updates</a></p>
+<p>This test PASSES if he does not crash</p>
Copied: branches/safari-534.51-branch/LayoutTests/svg/custom/resources/crash-textPath-attributes-iframe.svg (from rev 90166, trunk/LayoutTests/svg/custom/resources/crash-textPath-attributes-iframe.svg) (0 => 91537)
--- branches/safari-534.51-branch/LayoutTests/svg/custom/resources/crash-textPath-attributes-iframe.svg (rev 0)
+++ branches/safari-534.51-branch/LayoutTests/svg/custom/resources/crash-textPath-attributes-iframe.svg 2011-07-22 00:23:39 UTC (rev 91537)
@@ -0,0 +1,3 @@
+<!DOCTYPE svg>
+<?xml-stylesheet href=""
+<svg xmlns="http://www.w3.org/2000/svg"><text>x<tspan> <tspan
Modified: branches/safari-534.51-branch/Source/WebCore/ChangeLog (91536 => 91537)
--- branches/safari-534.51-branch/Source/WebCore/ChangeLog 2011-07-22 00:21:36 UTC (rev 91536)
+++ branches/safari-534.51-branch/Source/WebCore/ChangeLog 2011-07-22 00:23:39 UTC (rev 91537)
@@ -1,5 +1,31 @@
2011-07-21 Lucas Forschler <[email protected]>
+ Merged 90166.
+
+ 2011-06-30 Julien Chaffraix <[email protected]>
+
+ Reviewed by Nikolas Zimmermann.
+
+ Update SVG position values on SVG DOM updates
+ https://bugs.webkit.org/show_bug.cgi?id=62439
+
+ Test: svg/custom/crash-textPath-attributes.html
+
+ * rendering/svg/RenderSVGInline.cpp:
+ (WebCore::RenderSVGInline::destroy): Notify our containing RenderSVGText that it needs
+ to update its positioning information.
+
+ * rendering/svg/SVGInlineFlowBox.cpp:
+ (WebCore::SVGInlineFlowBox::calculateBoundaries): Check the type of the InlineBox
+ like the rest of the code (fixes an ASSERT_NOT_REACHED in InlineBox::calculateBoudaries).
+
+ * rendering/svg/SVGTextLayoutAttributesBuilder.cpp:
+ (WebCore::SVGTextLayoutAttributesBuilder::buildLayoutAttributesForTextSubtree): Clear
+ our cached layout attributes every time we invalidate them. This avoids keeping stale
+ attribute that have a backpointer to a RenderObject.
+
+2011-07-21 Lucas Forschler <[email protected]>
+
Merged 90156.
2011-06-30 Julien Chaffraix <[email protected]>
Modified: branches/safari-534.51-branch/Source/WebCore/rendering/svg/RenderSVGInline.cpp (91536 => 91537)
--- branches/safari-534.51-branch/Source/WebCore/rendering/svg/RenderSVGInline.cpp 2011-07-22 00:21:36 UTC (rev 91536)
+++ branches/safari-534.51-branch/Source/WebCore/rendering/svg/RenderSVGInline.cpp 2011-07-22 00:23:39 UTC (rev 91537)
@@ -95,6 +95,9 @@
void RenderSVGInline::destroy()
{
+ if (RenderSVGText* textRenderer = RenderSVGText::locateRenderSVGTextAncestor(this))
+ textRenderer->setNeedsPositioningValuesUpdate();
+
SVGResourcesCache::clientDestroyed(this);
RenderInline::destroy();
}
Modified: branches/safari-534.51-branch/Source/WebCore/rendering/svg/SVGInlineFlowBox.cpp (91536 => 91537)
--- branches/safari-534.51-branch/Source/WebCore/rendering/svg/SVGInlineFlowBox.cpp 2011-07-22 00:21:36 UTC (rev 91536)
+++ branches/safari-534.51-branch/Source/WebCore/rendering/svg/SVGInlineFlowBox.cpp 2011-07-22 00:23:39 UTC (rev 91537)
@@ -74,8 +74,11 @@
IntRect SVGInlineFlowBox::calculateBoundaries() const
{
IntRect childRect;
- for (InlineBox* child = firstChild(); child; child = child->nextOnLine())
+ for (InlineBox* child = firstChild(); child; child = child->nextOnLine()) {
+ if (!child->isSVGInlineTextBox() && !child->isSVGInlineFlowBox())
+ continue;
childRect.unite(child->calculateBoundaries());
+ }
return childRect;
}
Modified: branches/safari-534.51-branch/Source/WebCore/rendering/svg/SVGTextLayoutAttributesBuilder.cpp (91536 => 91537)
--- branches/safari-534.51-branch/Source/WebCore/rendering/svg/SVGTextLayoutAttributesBuilder.cpp 2011-07-22 00:21:36 UTC (rev 91536)
+++ branches/safari-534.51-branch/Source/WebCore/rendering/svg/SVGTextLayoutAttributesBuilder.cpp 2011-07-22 00:23:39 UTC (rev 91537)
@@ -39,7 +39,11 @@
{
ASSERT(textRoot);
- // Build list of x/y/dx/dy/rotate values for each subtree element that may define these values (tspan/textPath etc).
+ // We always clear our current attribute as we don't want to keep any stale ones that could survive DOM modification.
+ Vector<SVGTextLayoutAttributes>& allAttributes = textRoot->layoutAttributes();
+ allAttributes.clear();
+
+ // Build list of x/y/dx/dy/rotate values for each subtree element that may define these values (tspan/textPath etc).
unsigned atCharacter = 0;
UChar lastCharacter = '\0';
collectTextPositioningElements(textRoot, atCharacter, lastCharacter);
@@ -51,8 +55,6 @@
buildLayoutAttributesForAllCharacters(textRoot, atCharacter);
// Propagate layout attributes to each RenderSVGInlineText object, and the whole list to the RenderSVGText root.
- Vector<SVGTextLayoutAttributes>& allAttributes = textRoot->layoutAttributes();
- allAttributes.clear();
atCharacter = 0;
lastCharacter = '\0';
propagateLayoutAttributes(textRoot, allAttributes, atCharacter, lastCharacter);
