[webkit-changes] [99109] trunk

Wed, 02 Nov 2011 15:35:26 -0700

Title: [99109] trunk
Revision
99109
Author
[email protected]
Date
2011-11-02 15:35:16 -0700 (Wed, 02 Nov 2011)

Log Message

Infinite recursion in RenderSVGResourceContainer::markAllClientsForInvalidation
https://bugs.webkit.org/show_bug.cgi?id=71384

Reviewed by Darin Adler.

Source/WebCore:

Adding a reentrancy guard to RenderSVGResourceContainer to prevent infinite recursion when
resources reference one another and share ids.

Test: svg/custom/resource-invalidation-crash.svg

* rendering/svg/RenderSVGResourceContainer.cpp:
(WebCore::RenderSVGResourceContainer::RenderSVGResourceContainer):
(WebCore::RenderSVGResourceContainer::markAllClientsForInvalidation):
* rendering/svg/RenderSVGResourceContainer.h:

LayoutTests:

Fixes a stack overflow when SVG resources reference one another and share ids.

* svg/custom/resource-invalidation-crash-expected.png: Added.
* svg/custom/resource-invalidation-crash-expected.txt: Added.
* svg/custom/resource-invalidation-crash.svg: Added.

Modified Paths

Added Paths

Diff

Modified: trunk/LayoutTests/ChangeLog (99108 => 99109)


--- trunk/LayoutTests/ChangeLog	2011-11-02 22:32:26 UTC (rev 99108)
+++ trunk/LayoutTests/ChangeLog	2011-11-02 22:35:16 UTC (rev 99109)
@@ -1,3 +1,16 @@
+2011-11-02  Levi Weintraub  <[email protected]>
+
+        Infinite recursion in RenderSVGResourceContainer::markAllClientsForInvalidation
+        https://bugs.webkit.org/show_bug.cgi?id=71384
+
+        Reviewed by Darin Adler.
+
+        Fixes a stack overflow when SVG resources reference one another and share ids.
+
+        * svg/custom/resource-invalidation-crash-expected.png: Added.
+        * svg/custom/resource-invalidation-crash-expected.txt: Added.
+        * svg/custom/resource-invalidation-crash.svg: Added.
+
 2011-11-02  Jon Lee  <[email protected]>
 
         Expand DragController to provide more information about the dragging session

Added: trunk/LayoutTests/svg/custom/resource-invalidation-crash-expected.png (0 => 99109)


--- trunk/LayoutTests/svg/custom/resource-invalidation-crash-expected.png	                        (rev 0)
+++ trunk/LayoutTests/svg/custom/resource-invalidation-crash-expected.png	2011-11-02 22:35:16 UTC (rev 99109)
@@ -0,0 +1,10 @@
+\x89PNG
+
+
+IHDR X\x9Av\x82p)tEXtchecksum853de00567d121bea0b7bece66a5d61c`7\xFF\xFB\xEEiCCPICC Profilex\x85T\xCFkA\xFE6n\xA9\xD0"Zk\xB2x\x90"IY\xABhE\xD46\xFDbk\xDB\xB6E\x90d3I\xD6n6\xEB\xEE&\xB5\xA5\x88\xE4\xE2\xD1*\xDEE\xED\xA1\xFF\x80z\xF0d/J\x85ZE(ޫ(b\xA1-\xF1\xCDnL\xB6\xA5\xEA\xC0\xCE~\xF3\xDE7\xEF}ov\xDF
+r\xD24\xF5\x80\xE4
+\xC7R\xA2il|Bj\xFC\x88\x8E\xA2	A4%U\xDB\xECN$A\x83s\xF9{\xE7\xD8z\x81[V\xC3{\xFBw\xB2w\xAD\x9AҶ\x9A\x84\xFD@\xE0G\x9A\xD9*\xB0\xEFq
+Y\x88<ߡ)\xC7t\xDF\xE3\xD8\xF2\xEC\x8F9Nyx\xC1\xB5+=\xC4Y"|@5-\xCEM\xB8S\xCD%\xD3@\x83H8\x94\xF5qR>\x9C׋\x94\xD7inf\xC6\xC8\xBDO\x90\xA6\xBB\xCC\xEE\xABb\xA1\x9CN\xF6\x90\xBD\x9D\xF4~N\xB3\xDE>\xC2!\xC2\xAD?F\xB8\x8D\x9E\xF5\x8C\xD5?\xE2a\xE1\xA4\xE6Ć=5\xF4\xF8`\xB7\xA9\xF85\xC2_M'\xA2Tq\xD9.
+\xF1\x98\xAE\xFDV\xF2J\x82p\x908\xCAda\x80sZHO\xD7Ln\xF8\xBA\x87}&\xD7\xAF\xE2wVQ\xE1y\x8Fg\xDE\xD4\xDD\xEFE\xDA\xAF0\x9A
+HPEa\x98\xB0P@\x86<14\xB2r?#\xAB\x93{2u$j\xBBtbD\xB1A{6\xDC=\xB7Q\xA4\xDD<\xFE("q\x94C\xB5\x92\xFCA\xFE*\xAF\xC9O\xE5y\xF9\xCB\\xB0\xD8V\x{1D4B5B}\x9A\xBA\xF2\xE0;\xC5噹\xD7\xD3\xC8\xE3sM^|\x95\xD4v\x93WG\x96\xACyz\xBC\x9A\xEC?\xECW\x971\xE6\x825\x8F\xC4s\xB0\xFB\xF1-_\x95̗)\x8C\xC5\xE3U\xF3\xEAK\x84uZ17ߟl;=\xE2.\xCF.\xB5\xD6s\xAD\x89\x8B7V\x9B\x97g\xFDjH\xFB\x93\xE6U\xF9O^\xF5\xF1\xFCg\xCD\xC4c\xE2)1&v\x8A\xE7!\x89\x97\xC5.\xF1\x92\xD8K\xAB\xE2`m\xC7\x9D\x95\x86)\xD2m\x91\xFA$\xD5``\x9A\xBC\xF5/]?[x\xBDF\xF5Q\x94\xCC\xD2T\x89\xF7\xC2*d4\x9D\xB9o\xFA\x8F\xDB\xC7\xFC\xE4\xF7\x8A\xE7\x9F(/l\xE0ș\xBAmSq\xEF\xA1e\xA5ns\xAE\xBF\xD1}\xF0\xB6nk\xA3~8\xFCX<\xAB\xADR5\x9F \xBCv\x87z\xE8)\x98Ӗ\x96\xCD9R\x87,\x9F\x93\xBA\xE9\xCAbR\xCCP\xDBCRR\xD7%\xD7eK\xB3\x99Ub\xE9vؙ\xD3n\xA19B\xF7ħJe\x93\xFA\xAF\xF1\xB0\xFD\xB0R\xF9\xF9\xACR\xD9~Nց\x97\xFAo\xC0\xBC\xFDE\xC0x\x8B\x89 IDATx\xEDױ
+ 1`\xFF\x9Db\x88\xAB\x9C^\xB2\xD2ܞw\xCB @\x80 @ 8\xC1\x86	 @\x80|\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2џ,\xA0IDAT @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\xE2 @\x80\xC8HFm\x88 @\x80\x81\xE9W\xACg̐IEND\xAEB`\x82
\ No newline at end of file

Added: trunk/LayoutTests/svg/custom/resource-invalidation-crash-expected.txt (0 => 99109)


--- trunk/LayoutTests/svg/custom/resource-invalidation-crash-expected.txt	                        (rev 0)
+++ trunk/LayoutTests/svg/custom/resource-invalidation-crash-expected.txt	2011-11-02 22:35:16 UTC (rev 99109)
@@ -0,0 +1,13 @@
+layer at (0,0) size 800x600
+  RenderView at (0,0) size 800x600
+layer at (0,0) size 800x600
+  RenderSVGRoot {svg} at (0,0) size 0x0
+    RenderSVGHiddenContainer {defs} at (0,0) size 0x0
+      RenderSVGResourcePattern {pattern} [id="a"] [patternUnits=objectBoundingBox] [patternContentUnits=userSpaceOnUse]
+      RenderSVGResourcePattern {pattern} [id="b"] [patternUnits=objectBoundingBox] [patternContentUnits=userSpaceOnUse]
+        RenderSVGPath {rect} at (0,0) size 0x0 [fill={[type=PATTERN] [id="a"]}] [x=0.00] [y=0.00] [width=0.00] [height=0.00]
+      RenderSVGResourcePattern {pattern} [id="a"] [patternUnits=objectBoundingBox] [patternContentUnits=userSpaceOnUse]
+      RenderSVGResourcePattern {pattern} [id="b"] [patternUnits=objectBoundingBox] [patternContentUnits=userSpaceOnUse]
+        RenderSVGPath {rect} at (0,0) size 0x0 [fill={[type=SOLID] [color=#000000]}] [x=0.00] [y=0.00] [width=0.00] [height=0.00]
+      RenderSVGResourcePattern {pattern} [id="a"] [patternUnits=objectBoundingBox] [patternContentUnits=userSpaceOnUse]
+      RenderSVGPath {rect} at (0,0) size 0x0 [fill={[type=PATTERN] [id="a"]}] [x=0.00] [y=0.00] [width=0.00] [height=0.00]

Added: trunk/LayoutTests/svg/custom/resource-invalidation-crash.svg (0 => 99109)


--- trunk/LayoutTests/svg/custom/resource-invalidation-crash.svg	                        (rev 0)
+++ trunk/LayoutTests/svg/custom/resource-invalidation-crash.svg	2011-11-02 22:35:16 UTC (rev 99109)
@@ -0,0 +1,19 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
+<defs>
+
+    <pattern id="a" />
+    <pattern id="b" >
+        <rect  fill="url(#a)"/>
+    </pattern>
+
+    <pattern id="a" xlink:href=""
+    <pattern id="b" >
+        <rect  fill="url(#a)"/>
+    </pattern>
+
+    <pattern id="a" xlink:href=""
+        <rect  fill="url(#a)"/>
+
+</defs>
+
+</svg>

Modified: trunk/Source/WebCore/ChangeLog (99108 => 99109)


--- trunk/Source/WebCore/ChangeLog	2011-11-02 22:32:26 UTC (rev 99108)
+++ trunk/Source/WebCore/ChangeLog	2011-11-02 22:35:16 UTC (rev 99109)
@@ -1,3 +1,20 @@
+2011-11-02  Levi Weintraub  <[email protected]>
+
+        Infinite recursion in RenderSVGResourceContainer::markAllClientsForInvalidation
+        https://bugs.webkit.org/show_bug.cgi?id=71384
+
+        Reviewed by Darin Adler.
+
+        Adding a reentrancy guard to RenderSVGResourceContainer to prevent infinite recursion when
+        resources reference one another and share ids.
+
+        Test: svg/custom/resource-invalidation-crash.svg
+
+        * rendering/svg/RenderSVGResourceContainer.cpp:
+        (WebCore::RenderSVGResourceContainer::RenderSVGResourceContainer):
+        (WebCore::RenderSVGResourceContainer::markAllClientsForInvalidation):
+        * rendering/svg/RenderSVGResourceContainer.h:
+
 2011-11-02  Jon Lee  <[email protected]>
 
         Expand DragController to provide more information about the dragging session

Modified: trunk/Source/WebCore/rendering/svg/RenderSVGResourceContainer.cpp (99108 => 99109)


--- trunk/Source/WebCore/rendering/svg/RenderSVGResourceContainer.cpp	2011-11-02 22:32:26 UTC (rev 99108)
+++ trunk/Source/WebCore/rendering/svg/RenderSVGResourceContainer.cpp	2011-11-02 22:35:16 UTC (rev 99109)
@@ -38,6 +38,7 @@
     : RenderSVGHiddenContainer(node)
     , m_id(node->hasID() ? node->getIdAttribute() : nullAtom)
     , m_registered(false)
+    , m_isInvalidating(false)
 {
 }
 
@@ -87,9 +88,10 @@
 
 void RenderSVGResourceContainer::markAllClientsForInvalidation(InvalidationMode mode)
 {
-    if (m_clients.isEmpty())
+    if (m_clients.isEmpty() || m_isInvalidating)
         return;
 
+    m_isInvalidating = true;
     bool needsLayout = mode == LayoutAndBoundariesInvalidation;
     bool markForInvalidation = mode != ParentOnlyInvalidation;
 
@@ -118,6 +120,7 @@
             current = current->parent();
         }
     }
+    m_isInvalidating = false;
 }
 
 void RenderSVGResourceContainer::markClientForInvalidation(RenderObject* client, InvalidationMode mode)

Modified: trunk/Source/WebCore/rendering/svg/RenderSVGResourceContainer.h (99108 => 99109)


--- trunk/Source/WebCore/rendering/svg/RenderSVGResourceContainer.h	2011-11-02 22:32:26 UTC (rev 99108)
+++ trunk/Source/WebCore/rendering/svg/RenderSVGResourceContainer.h	2011-11-02 22:35:16 UTC (rev 99109)
@@ -64,7 +64,8 @@
     void registerResource();
 
     AtomicString m_id;
-    bool m_registered;
+    bool m_registered : 1;
+    bool m_isInvalidating : 1;
     HashSet<RenderObject*> m_clients;
 };
 

_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes

Reply via email to