Title: [94058] branches/chromium/835
- Revision
- 94058
- Author
- [email protected]
- Date
- 2011-08-30 01:04:34 -0700 (Tue, 30 Aug 2011)
Log Message
Merge 92809 - Crash when clicking an SVG <a> link to the local document
https://bugs.webkit.org/show_bug.cgi?id=66019
<rdar://problem/9933311>
Reviewed by Rob Buis.
Source/WebCore:
Check if the target element of an internal link is valid before
making use of it.
Test: svg/custom/click-internal-anchor-with-use-crash.xhtml
* svg/SVGAElement.cpp:
(WebCore::SVGAElement::defaultEventHandler):
LayoutTests:
Add a test which programmatically clicks a link referring to "#",
and should crash between r89745 and this commit.
* svg/custom/click-internal-anchor-with-use-crash-expected.txt: Added.
* svg/custom/click-internal-anchor-with-use-crash.xhtml: Added.
[email protected]
Review URL: http://codereview.chromium.org/7807001
Modified Paths
Added Paths
Diff
Copied: branches/chromium/835/LayoutTests/svg/custom/click-internal-anchor-with-use-crash-expected.txt (from rev 92809, trunk/LayoutTests/svg/custom/click-internal-anchor-with-use-crash-expected.txt) (0 => 94058)
--- branches/chromium/835/LayoutTests/svg/custom/click-internal-anchor-with-use-crash-expected.txt (rev 0)
+++ branches/chromium/835/LayoutTests/svg/custom/click-internal-anchor-with-use-crash-expected.txt 2011-08-30 08:04:34 UTC (rev 94058)
@@ -0,0 +1,2 @@
+PASS if no crash
+
Copied: branches/chromium/835/LayoutTests/svg/custom/click-internal-anchor-with-use-crash.xhtml (from rev 92809, trunk/LayoutTests/svg/custom/click-internal-anchor-with-use-crash.xhtml) (0 => 94058)
--- branches/chromium/835/LayoutTests/svg/custom/click-internal-anchor-with-use-crash.xhtml (rev 0)
+++ branches/chromium/835/LayoutTests/svg/custom/click-internal-anchor-with-use-crash.xhtml 2011-08-30 08:04:34 UTC (rev 94058)
@@ -0,0 +1,27 @@
+<?xml version="1.0" encoding="utf-8"?>
+<html>
+ <svg xmlns="http://www.w3.org/2000/svg" _onload_="onLoad()" xmlns:xlink="http://www.w3.org/1999/xlink">
+ <script type="text/_javascript_">
+ function onLoad()
+ {
+ clickLink(document.getElementById("link"));
+
+ if (window.layoutTestController)
+ layoutTestController.dumpAsText();
+ }
+
+ function clickLink(link)
+ {
+ var event = document.createEvent("MouseEvents");
+ event.initMouseEvent("click", true, true, window,
+ 0, 0, 0, 0, 0,
+ false, false, false, false,
+ 0, null);
+ link.dispatchEvent(event);
+ }
+ </script>
+ <a id="link" xlink:href=""
+ <text x="50" y="50">PASS if no crash</text>
+ </a>
+ </svg>
+</html>
Modified: branches/chromium/835/Source/WebCore/svg/SVGAElement.cpp (94057 => 94058)
--- branches/chromium/835/Source/WebCore/svg/SVGAElement.cpp 2011-08-30 08:02:59 UTC (rev 94057)
+++ branches/chromium/835/Source/WebCore/svg/SVGAElement.cpp 2011-08-30 08:04:34 UTC (rev 94058)
@@ -170,7 +170,7 @@
return;
}
// Only allow navigation to internal <view> anchors.
- if (!targetElement->hasTagName(SVGNames::viewTag))
+ if (targetElement && !targetElement->hasTagName(SVGNames::viewTag))
return;
}
#endif
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
