Title: [238524] trunk
Revision
238524
Author
[email protected]
Date
2018-11-26 14:48:08 -0800 (Mon, 26 Nov 2018)

Log Message

SVG use element inside a shadow tree cannot reference an element in the same tree
https://bugs.webkit.org/show_bug.cgi?id=174977
<rdar://problem/33665636>

Reviewed by Zalan Bujtas.

Source/WebCore:

Make fragment URL references used by SVGelements within a shadow tree to refer to other elements
in the same shadow tree. To do this, this patch makes targetElementFromIRIString take a TreeScope
instead of a Document, and updates its call sites.

This patch updates the most uses of targetElementFromIRIString except CSS cursor image, altGraph,
and glyphRef since the cursor image isn't really a SVG feature, and there aren't really real world
use cases in which altGraph and glyphRef are used within shadow trees.

Tests: fast/shadow-dom/svg-animate-href-change-in-shadow-tree.html
       fast/shadow-dom/svg-animate-href-in-shadow-tree.html
       fast/shadow-dom/svg-feimage-href-in-shadow-tree.html
       fast/shadow-dom/svg-linear-gradient-href-in-shadow-tree.html
       fast/shadow-dom/svg-mpath-href-change-in-shadow-tree.html
       fast/shadow-dom/svg-mpath-href-in-shadow-tree.html
       fast/shadow-dom/svg-radial-gradient-href-in-shadow-tree.html
       fast/shadow-dom/svg-text-path-href-change-in-shadow-tree.html
       fast/shadow-dom/svg-text-path-href-in-shadow-tree.html
       fast/shadow-dom/svg-thref-href-change-in-shadow-tree.html
       fast/shadow-dom/svg-thref-href-in-shadow-tree.html
       fast/shadow-dom/svg-use-href-change-in-shadow-tree.html
       fast/shadow-dom/svg-use-href-in-shadow-tree.html

* accessibility/AccessibilitySVGElement.cpp:
(WebCore::AccessibilitySVGElement::targetForUseElement const):
* css/CSSCursorImageValue.cpp:
* rendering/svg/RenderSVGTextPath.cpp:
(WebCore::RenderSVGTextPath::layoutPath const):
* svg/SVGAltGlyphElement.cpp:
(WebCore::SVGAltGlyphElement::hasValidGlyphElements const):
* svg/SVGFEImageElement.cpp:
(WebCore::SVGFEImageElement::buildPendingResource):
(WebCore::SVGFEImageElement::build):
* svg/SVGGlyphRefElement.cpp:
(WebCore::SVGGlyphRefElement::hasValidGlyphElement const):
* svg/SVGLinearGradientElement.cpp:
(WebCore::SVGLinearGradientElement::collectGradientAttributes):
* svg/SVGMPathElement.cpp:
(WebCore::SVGMPathElement::buildPendingResource):
(WebCore::SVGMPathElement::pathElement):
* svg/SVGRadialGradientElement.cpp:
(WebCore::SVGRadialGradientElement::collectGradientAttributes):
* svg/SVGTRefElement.cpp:
(WebCore::SVGTRefElement::buildPendingResource):
* svg/SVGTextPathElement.cpp:
(WebCore::SVGTextPathElement::buildPendingResource):
* svg/SVGURIReference.cpp:
(WebCore::SVGURIReference::targetElementFromIRIString):
* svg/SVGURIReference.h:
* svg/SVGUseElement.cpp:
(WebCore::SVGUseElement::updateShadowTree):
(WebCore::SVGUseElement::findTarget const):
* svg/animation/SVGSMILElement.cpp:
(WebCore::SVGSMILElement::buildPendingResource):
(WebCore::SVGSMILElement::insertedIntoAncestor):
* svg/graphics/filters/SVGFEImage.cpp:
(WebCore::FEImage::FEImage):
(WebCore::FEImage::createWithIRIReference):
(WebCore::FEImage::referencedRenderer const):
* svg/graphics/filters/SVGFEImage.h:

LayoutTests:

Added tests for specifying a fragment URL to refer to other elements within shadow trees.

This patch doesn't add a test for updating a fragment URL of linearGradient and radialGradient
since it doesn't work at all even outside shadow trees. See webkit.org/b/191934.

* fast/shadow-dom/svg-animate-href-change-in-shadow-tree-expected.html: Added.
* fast/shadow-dom/svg-animate-href-change-in-shadow-tree.html: Added.
* fast/shadow-dom/svg-animate-href-in-shadow-tree-expected.html: Added.
* fast/shadow-dom/svg-animate-href-in-shadow-tree.html: Added.
* fast/shadow-dom/svg-feimage-href-in-shadow-tree-expected.html: Added.
* fast/shadow-dom/svg-feimage-href-in-shadow-tree.html: Added.
* fast/shadow-dom/svg-linear-gradient-href-in-shadow-tree-expected.html: Added.
* fast/shadow-dom/svg-linear-gradient-href-in-shadow-tree.html: Added.
* fast/shadow-dom/svg-mpath-href-change-in-shadow-tree-expected.html: Added.
* fast/shadow-dom/svg-mpath-href-change-in-shadow-tree.html: Added.
* fast/shadow-dom/svg-mpath-href-in-shadow-tree-expected.html: Added.
* fast/shadow-dom/svg-mpath-href-in-shadow-tree.html: Added.
* fast/shadow-dom/svg-radial-gradient-href-in-shadow-tree-expected.html: Added.
* fast/shadow-dom/svg-radial-gradient-href-in-shadow-tree.html: Added.
* fast/shadow-dom/svg-text-path-href-change-in-shadow-tree-expected.html: Added.
* fast/shadow-dom/svg-text-path-href-change-in-shadow-tree.html: Added.
* fast/shadow-dom/svg-text-path-href-in-shadow-tree-expected.html: Added.
* fast/shadow-dom/svg-text-path-href-in-shadow-tree.html: Added.
* fast/shadow-dom/svg-thref-href-change-in-shadow-tree-expected.html: Added.
* fast/shadow-dom/svg-thref-href-change-in-shadow-tree.html: Added.
* fast/shadow-dom/svg-thref-href-in-shadow-tree-expected.html: Added.
* fast/shadow-dom/svg-thref-href-in-shadow-tree.html: Added.
* fast/shadow-dom/svg-use-href-change-in-shadow-tree-expected.html: Added.
* fast/shadow-dom/svg-use-href-change-in-shadow-tree.html: Added.
* fast/shadow-dom/svg-use-href-in-shadow-tree-expected.html: Added.
* fast/shadow-dom/svg-use-href-in-shadow-tree.html: Added.

Modified Paths

Added Paths

Diff

Modified: trunk/LayoutTests/ChangeLog (238523 => 238524)


--- trunk/LayoutTests/ChangeLog	2018-11-26 22:22:07 UTC (rev 238523)
+++ trunk/LayoutTests/ChangeLog	2018-11-26 22:48:08 UTC (rev 238524)
@@ -1,3 +1,43 @@
+2018-11-24  Ryosuke Niwa  <[email protected]>
+
+        SVG use element inside a shadow tree cannot reference an element in the same tree
+        https://bugs.webkit.org/show_bug.cgi?id=174977
+        <rdar://problem/33665636>
+
+        Reviewed by Zalan Bujtas.
+
+        Added tests for specifying a fragment URL to refer to other elements within shadow trees.
+
+        This patch doesn't add a test for updating a fragment URL of linearGradient and radialGradient
+        since it doesn't work at all even outside shadow trees. See webkit.org/b/191934.
+
+        * fast/shadow-dom/svg-animate-href-change-in-shadow-tree-expected.html: Added.
+        * fast/shadow-dom/svg-animate-href-change-in-shadow-tree.html: Added.
+        * fast/shadow-dom/svg-animate-href-in-shadow-tree-expected.html: Added.
+        * fast/shadow-dom/svg-animate-href-in-shadow-tree.html: Added.
+        * fast/shadow-dom/svg-feimage-href-in-shadow-tree-expected.html: Added.
+        * fast/shadow-dom/svg-feimage-href-in-shadow-tree.html: Added.
+        * fast/shadow-dom/svg-linear-gradient-href-in-shadow-tree-expected.html: Added.
+        * fast/shadow-dom/svg-linear-gradient-href-in-shadow-tree.html: Added.
+        * fast/shadow-dom/svg-mpath-href-change-in-shadow-tree-expected.html: Added.
+        * fast/shadow-dom/svg-mpath-href-change-in-shadow-tree.html: Added.
+        * fast/shadow-dom/svg-mpath-href-in-shadow-tree-expected.html: Added.
+        * fast/shadow-dom/svg-mpath-href-in-shadow-tree.html: Added.
+        * fast/shadow-dom/svg-radial-gradient-href-in-shadow-tree-expected.html: Added.
+        * fast/shadow-dom/svg-radial-gradient-href-in-shadow-tree.html: Added.
+        * fast/shadow-dom/svg-text-path-href-change-in-shadow-tree-expected.html: Added.
+        * fast/shadow-dom/svg-text-path-href-change-in-shadow-tree.html: Added.
+        * fast/shadow-dom/svg-text-path-href-in-shadow-tree-expected.html: Added.
+        * fast/shadow-dom/svg-text-path-href-in-shadow-tree.html: Added.
+        * fast/shadow-dom/svg-thref-href-change-in-shadow-tree-expected.html: Added.
+        * fast/shadow-dom/svg-thref-href-change-in-shadow-tree.html: Added.
+        * fast/shadow-dom/svg-thref-href-in-shadow-tree-expected.html: Added.
+        * fast/shadow-dom/svg-thref-href-in-shadow-tree.html: Added.
+        * fast/shadow-dom/svg-use-href-change-in-shadow-tree-expected.html: Added.
+        * fast/shadow-dom/svg-use-href-change-in-shadow-tree.html: Added.
+        * fast/shadow-dom/svg-use-href-in-shadow-tree-expected.html: Added.
+        * fast/shadow-dom/svg-use-href-in-shadow-tree.html: Added.
+
 2018-11-26  Daniel Bates  <[email protected]>
 
         Caret disappears at end of password field when caps lock indicator is shown; password field

Added: trunk/LayoutTests/fast/shadow-dom/svg-animate-href-change-in-shadow-tree-expected.html (0 => 238524)


--- trunk/LayoutTests/fast/shadow-dom/svg-animate-href-change-in-shadow-tree-expected.html	                        (rev 0)
+++ trunk/LayoutTests/fast/shadow-dom/svg-animate-href-change-in-shadow-tree-expected.html	2018-11-26 22:48:08 UTC (rev 238524)
@@ -0,0 +1,7 @@
+<!DOCTYPE html>
+<html>
+<body>
+    <p>Test passes if you see a single 100px by 100px green box below.</p>
+    <div style="width: 100px; height: 100px; background: green;"></div>
+</body>
+</html>

Added: trunk/LayoutTests/fast/shadow-dom/svg-animate-href-change-in-shadow-tree.html (0 => 238524)


--- trunk/LayoutTests/fast/shadow-dom/svg-animate-href-change-in-shadow-tree.html	                        (rev 0)
+++ trunk/LayoutTests/fast/shadow-dom/svg-animate-href-change-in-shadow-tree.html	2018-11-26 22:48:08 UTC (rev 238524)
@@ -0,0 +1,45 @@
+<!DOCTYPE html>
+<html>
+<body>
+<p>Test passes if you see a single 100px by 100px green box below.</p>
+<div id="host" style="width: 100px; height: 100px;"></div>
+<svg>
+    <defs>
+        <rect id="rect" width="50" height="100" fill="red" />
+    </defs>
+</svg>
+<template>
+    <svg viewbox="0 0 100 100" xmlns:xlink="http://www.w3.org/1999/xlink">
+        <rect width="50" height="100" fill="green" />
+        <rect id="rect1" x="-100" width="25" height="100" fill="red" />
+        <rect id="rect2" x="-100" width="50" height="100" fill="green" />
+        <animate attributeName="x" from="0" to="50" dur="0.01s" fill="freeze" xlink:href="" />
+    </svg>
+</template>
+<script>
+
+if (window.testRunner)
+    testRunner.waitUntilDone();
+
+const shadowRoot = host;//host.attachShadow({mode: 'closed'});
+shadowRoot.appendChild(document.querySelector('template').content.cloneNode(true));
+
+function waitForAnimation() {
+    return new Promise((resolve) => {
+         // 0.01s is 10ms. Wait for twice that time to be safe.
+        requestAnimationFrame(() => setTimeout(resolve, 20));
+    })
+}
+
+window._onload_ = async () => {
+    await waitForAnimation();
+    shadowRoot.querySelector('animate').setAttributeNS('http://www.w3.org/1999/xlink', 'href', '#rect2');
+    shadowRoot.querySelector('animate').beginElement();
+    await waitForAnimation();
+    if (window.testRunner)
+        requestAnimationFrame(() => testRunner.notifyDone());
+}
+
+</script>
+</body>
+</html>

Added: trunk/LayoutTests/fast/shadow-dom/svg-animate-href-in-shadow-tree-expected.html (0 => 238524)


--- trunk/LayoutTests/fast/shadow-dom/svg-animate-href-in-shadow-tree-expected.html	                        (rev 0)
+++ trunk/LayoutTests/fast/shadow-dom/svg-animate-href-in-shadow-tree-expected.html	2018-11-26 22:48:08 UTC (rev 238524)
@@ -0,0 +1,7 @@
+<!DOCTYPE html>
+<html>
+<body>
+    <p>Test passes if you see a single 100px by 100px green box below.</p>
+    <div style="width: 100px; height: 100px; background: green;"></div>
+</body>
+</html>

Added: trunk/LayoutTests/fast/shadow-dom/svg-animate-href-in-shadow-tree.html (0 => 238524)


--- trunk/LayoutTests/fast/shadow-dom/svg-animate-href-in-shadow-tree.html	                        (rev 0)
+++ trunk/LayoutTests/fast/shadow-dom/svg-animate-href-in-shadow-tree.html	2018-11-26 22:48:08 UTC (rev 238524)
@@ -0,0 +1,37 @@
+<!DOCTYPE html>
+<html>
+<body>
+<p>Test passes if you see a single 100px by 100px green box below.</p>
+<div id="host" style="width: 100px; height: 100px;"></div>
+<svg>
+    <defs>
+        <rect id="rect" width="50" height="100" fill="red" />
+    </defs>
+</svg>
+<template>
+    <svg viewbox="0 0 100 100" xmlns:xlink="http://www.w3.org/1999/xlink">
+        <rect width="50" height="100" fill="green" />
+        <rect id="rect" width="50" height="100" fill="green" />
+        <animate attributeName="x" from="0" to="50" dur="0.01s" fill="freeze" xlink:href="" />
+    </svg>
+</template>
+<script>
+
+if (window.testRunner)
+    testRunner.waitUntilDone();
+
+const shadowRoot = host.attachShadow({mode: 'closed'});
+shadowRoot.appendChild(document.querySelector('template').content.cloneNode(true));
+
+window._onload_ = () => {
+    requestAnimationFrame(() => {
+        setTimeout(() => {
+            if (window.testRunner)
+                requestAnimationFrame(() => testRunner.notifyDone());
+        }, 20); // 0.01s is 10ms. Wait for twice that time to be safe.
+    });
+}
+
+</script>
+</body>
+</html>

Added: trunk/LayoutTests/fast/shadow-dom/svg-feimage-href-in-shadow-tree-expected.html (0 => 238524)


--- trunk/LayoutTests/fast/shadow-dom/svg-feimage-href-in-shadow-tree-expected.html	                        (rev 0)
+++ trunk/LayoutTests/fast/shadow-dom/svg-feimage-href-in-shadow-tree-expected.html	2018-11-26 22:48:08 UTC (rev 238524)
@@ -0,0 +1,7 @@
+<!DOCTYPE html>
+<html>
+<body>
+    <p>Test passes if you see a single 100px by 100px green box below.</p>
+    <div style="width: 100px; height: 100px; background: green;"></div>
+</body>
+</html>

Added: trunk/LayoutTests/fast/shadow-dom/svg-feimage-href-in-shadow-tree.html (0 => 238524)


--- trunk/LayoutTests/fast/shadow-dom/svg-feimage-href-in-shadow-tree.html	                        (rev 0)
+++ trunk/LayoutTests/fast/shadow-dom/svg-feimage-href-in-shadow-tree.html	2018-11-26 22:48:08 UTC (rev 238524)
@@ -0,0 +1,29 @@
+<!DOCTYPE html>
+<html>
+<body>
+<p>Test passes if you see a single 100px by 100px green box below.</p>
+<div id="host" style="width: 100px; height: 100px;"></div>
+<svg>
+    <defs>
+        <rect id="rect" width="100" height="100" fill="red" />
+    </defs>
+</svg>
+<template>
+    <svg viewbox="0 0 100 100">
+        <defs>
+            <rect id="rect" width="100" height="100" fill="green" />
+            <filter id="image">
+                <feImage href="" />
+            </filter>
+        </defs>
+        <rect id="rect" width="100" height="100" style="filter:url(#image)">
+    </svg>
+</template>
+<script>
+
+const shadowRoot = host.attachShadow({mode: 'closed'});
+shadowRoot.appendChild(document.querySelector('template').content.cloneNode(true));
+
+</script>
+</body>
+</html>

Added: trunk/LayoutTests/fast/shadow-dom/svg-linear-gradient-href-in-shadow-tree-expected.html (0 => 238524)


--- trunk/LayoutTests/fast/shadow-dom/svg-linear-gradient-href-in-shadow-tree-expected.html	                        (rev 0)
+++ trunk/LayoutTests/fast/shadow-dom/svg-linear-gradient-href-in-shadow-tree-expected.html	2018-11-26 22:48:08 UTC (rev 238524)
@@ -0,0 +1,7 @@
+<!DOCTYPE html>
+<html>
+<body>
+    <p>Test passes if you see a single 100px by 100px green box below.</p>
+    <div style="width: 100px; height: 100px; background: green;"></div>
+</body>
+</html>

Added: trunk/LayoutTests/fast/shadow-dom/svg-linear-gradient-href-in-shadow-tree.html (0 => 238524)


--- trunk/LayoutTests/fast/shadow-dom/svg-linear-gradient-href-in-shadow-tree.html	                        (rev 0)
+++ trunk/LayoutTests/fast/shadow-dom/svg-linear-gradient-href-in-shadow-tree.html	2018-11-26 22:48:08 UTC (rev 238524)
@@ -0,0 +1,27 @@
+<!DOCTYPE html>
+<html>
+<body>
+<p>Test passes if you see a single 100px by 100px green box below.</p>
+<div id="host" style="width: 100px; height: 100px;"></div>
+<svg>
+    <linearGradient id="gradient">
+        <stop offset="0%" stop-color="red" />
+    </linearGradient>
+</svg>
+<template>
+    <svg viewbox="0 0 100 100">
+        <linearGradient id="gradient">
+            <stop offset="0%" stop-color="green" />
+        </linearGradient>
+        <linearGradient id="gradientUse" fill="red" href=""
+        <rect id="rect" width="100" height="100" fill="url(#gradientUse)">
+    </svg>
+</template>
+<script>
+
+const shadowRoot = host.attachShadow({mode: 'closed'});
+shadowRoot.appendChild(document.querySelector('template').content.cloneNode(true));
+
+</script>
+</body>
+</html>

Added: trunk/LayoutTests/fast/shadow-dom/svg-mpath-href-change-in-shadow-tree-expected.html (0 => 238524)


--- trunk/LayoutTests/fast/shadow-dom/svg-mpath-href-change-in-shadow-tree-expected.html	                        (rev 0)
+++ trunk/LayoutTests/fast/shadow-dom/svg-mpath-href-change-in-shadow-tree-expected.html	2018-11-26 22:48:08 UTC (rev 238524)
@@ -0,0 +1,7 @@
+<!DOCTYPE html>
+<html>
+<body>
+    <p>Test passes if you see a single 100px by 100px green box below.</p>
+    <div style="width: 100px; height: 100px; background: green;"></div>
+</body>
+</html>

Added: trunk/LayoutTests/fast/shadow-dom/svg-mpath-href-change-in-shadow-tree.html (0 => 238524)


--- trunk/LayoutTests/fast/shadow-dom/svg-mpath-href-change-in-shadow-tree.html	                        (rev 0)
+++ trunk/LayoutTests/fast/shadow-dom/svg-mpath-href-change-in-shadow-tree.html	2018-11-26 22:48:08 UTC (rev 238524)
@@ -0,0 +1,46 @@
+<!DOCTYPE html>
+<html>
+<body>
+<p>Test passes if you see a single 100px by 100px green box below.</p>
+<div id="host" style="width: 100px; height: 100px;"></div>
+<template>
+    <svg viewbox="0 0 100 100">
+        <rect id="rect" x="50" y="0" width="50" height="100" fill="red"></rect>
+        <path id="path1" d="M0,0 L25,0" />
+        <path id="path2" d="M0,0 L50,0" />
+        <rect id="rect" width="50" height="100" fill="green" />
+        <g>
+            <rect id="rect" x="0" width="50" height="100" fill="green" />
+            <animateMotion dur="0.01s" calcMode="linear" fill="freeze">
+                <mpath href="" />
+            </animateMotion>
+        </g>
+    </svg>
+</template>
+<script>
+
+if (window.testRunner)
+    testRunner.waitUntilDone();
+
+const shadowRoot = host.attachShadow({mode: 'closed'});
+shadowRoot.appendChild(document.querySelector('template').content.cloneNode(true));
+
+function waitForAnimation() {
+    return new Promise((resolve) => {
+         // 0.01s is 10ms. Wait for twice that time to be safe.
+        requestAnimationFrame(() => setTimeout(resolve, 20));
+    })
+}
+
+window._onload_ = async () => {
+    await waitForAnimation();
+    shadowRoot.querySelector('mpath').setAttribute('href', '#path2');
+    shadowRoot.querySelector('animateMotion').beginElement();
+    await waitForAnimation();
+    if (window.testRunner)
+        requestAnimationFrame(() => testRunner.notifyDone());
+}
+
+</script>
+</body>
+</html>

Added: trunk/LayoutTests/fast/shadow-dom/svg-mpath-href-in-shadow-tree-expected.html (0 => 238524)


--- trunk/LayoutTests/fast/shadow-dom/svg-mpath-href-in-shadow-tree-expected.html	                        (rev 0)
+++ trunk/LayoutTests/fast/shadow-dom/svg-mpath-href-in-shadow-tree-expected.html	2018-11-26 22:48:08 UTC (rev 238524)
@@ -0,0 +1,7 @@
+<!DOCTYPE html>
+<html>
+<body>
+    <p>Test passes if you see a single 100px by 100px green box below.</p>
+    <div style="width: 100px; height: 100px; background: green;"></div>
+</body>
+</html>

Added: trunk/LayoutTests/fast/shadow-dom/svg-mpath-href-in-shadow-tree.html (0 => 238524)


--- trunk/LayoutTests/fast/shadow-dom/svg-mpath-href-in-shadow-tree.html	                        (rev 0)
+++ trunk/LayoutTests/fast/shadow-dom/svg-mpath-href-in-shadow-tree.html	2018-11-26 22:48:08 UTC (rev 238524)
@@ -0,0 +1,43 @@
+<!DOCTYPE html>
+<html>
+<body>
+<p>Test passes if you see a single 100px by 100px green box below.</p>
+<div id="host" style="width: 100px; height: 100px;"></div>
+<svg>
+    <defs>
+        <path id="path" d="M0,0 L25,0" />
+    </defs>
+</svg>
+<template>
+    <svg viewbox="0 0 100 100">
+        <rect id="rect" x="50" y="0" width="50" height="100" fill="red"></rect>
+        <path id="path" d="M0,0 L50,0" />
+        <rect id="rect" width="50" height="100" fill="green" />
+        <g>
+            <rect id="rect" x="0" width="50" height="100" fill="green" />
+            <animateMotion dur="0.01s" calcMode="linear" fill="freeze">
+                <mpath href="" />
+            </animateMotion>
+        </g>
+    </svg>
+</template>
+<script>
+
+if (window.testRunner)
+    testRunner.waitUntilDone();
+
+const shadowRoot = host.attachShadow({mode: 'closed'});
+shadowRoot.appendChild(document.querySelector('template').content.cloneNode(true));
+
+window._onload_ = () => {
+    requestAnimationFrame(() => {
+        setTimeout(() => {
+            if (window.testRunner)
+                requestAnimationFrame(() => testRunner.notifyDone());
+        }, 20); // 0.01s is 10ms. Wait for twice that time to be safe.
+    });
+}
+
+</script>
+</body>
+</html>

Added: trunk/LayoutTests/fast/shadow-dom/svg-radial-gradient-href-in-shadow-tree-expected.html (0 => 238524)


--- trunk/LayoutTests/fast/shadow-dom/svg-radial-gradient-href-in-shadow-tree-expected.html	                        (rev 0)
+++ trunk/LayoutTests/fast/shadow-dom/svg-radial-gradient-href-in-shadow-tree-expected.html	2018-11-26 22:48:08 UTC (rev 238524)
@@ -0,0 +1,7 @@
+<!DOCTYPE html>
+<html>
+<body>
+    <p>Test passes if you see a single 100px by 100px green box below.</p>
+    <div style="width: 100px; height: 100px; background: green;"></div>
+</body>
+</html>

Added: trunk/LayoutTests/fast/shadow-dom/svg-radial-gradient-href-in-shadow-tree.html (0 => 238524)


--- trunk/LayoutTests/fast/shadow-dom/svg-radial-gradient-href-in-shadow-tree.html	                        (rev 0)
+++ trunk/LayoutTests/fast/shadow-dom/svg-radial-gradient-href-in-shadow-tree.html	2018-11-26 22:48:08 UTC (rev 238524)
@@ -0,0 +1,27 @@
+<!DOCTYPE html>
+<html>
+<body>
+<p>Test passes if you see a single 100px by 100px green box below.</p>
+<div id="host" style="width: 100px; height: 100px;"></div>
+<svg>
+    <radialGradient id="gradient">
+        <stop offset="0%" stop-color="red" />
+    </radialGradient>
+</svg>
+<template>
+    <svg viewbox="0 0 100 100">
+        <radialGradient id="gradient">
+            <stop offset="0%" stop-color="green" />
+        </radialGradient>
+        <radialGradient id="gradientUse" fill="red" href=""
+        <rect id="rect" width="100" height="100" fill="url(#gradientUse)">
+    </svg>
+</template>
+<script>
+
+const shadowRoot = host.attachShadow({mode: 'closed'});
+shadowRoot.appendChild(document.querySelector('template').content.cloneNode(true));
+
+</script>
+</body>
+</html>

Added: trunk/LayoutTests/fast/shadow-dom/svg-text-path-href-change-in-shadow-tree-expected.html (0 => 238524)


--- trunk/LayoutTests/fast/shadow-dom/svg-text-path-href-change-in-shadow-tree-expected.html	                        (rev 0)
+++ trunk/LayoutTests/fast/shadow-dom/svg-text-path-href-change-in-shadow-tree-expected.html	2018-11-26 22:48:08 UTC (rev 238524)
@@ -0,0 +1,7 @@
+<!DOCTYPE html>
+<html>
+<body>
+    <p>Test passes if you see a single 100px by 100px green box below.</p>
+    <div style="width: 100px; height: 100px; background: green;"></div>
+</body>
+</html>

Added: trunk/LayoutTests/fast/shadow-dom/svg-text-path-href-change-in-shadow-tree.html (0 => 238524)


--- trunk/LayoutTests/fast/shadow-dom/svg-text-path-href-change-in-shadow-tree.html	                        (rev 0)
+++ trunk/LayoutTests/fast/shadow-dom/svg-text-path-href-change-in-shadow-tree.html	2018-11-26 22:48:08 UTC (rev 238524)
@@ -0,0 +1,41 @@
+<!DOCTYPE html>
+<html>
+<body>
+<p>Test passes if you see a single 100px by 100px green box below.</p>
+<div id="host" style="width: 100px; height: 100px;"></div>
+<svg>
+    <defs>
+        <path id="path1" d="M0,30 L100,30 Z">
+    </defs>
+</svg>
+<template>
+    <svg style="width: 100px; height: 100px;" viewbox="0 0 100 100" xmlns:xlink="http://www.w3.org/1999/xlink">
+        <defs>
+            <path id="path1" d="M0,50 L100,50 Z" />
+            <path id="path2" d="M0,-5 L100,-5 Z" />
+        </defs>
+        <rect x="0" y="0" width="100" height="100" fill="green"></rect>
+        <text>
+            <textPath href=""
+        </text>
+    </svg>
+</template>
+<script>
+
+if (window.testRunner)
+    testRunner.waitUntilDone();
+
+const shadowRoot = host.attachShadow({mode: 'closed'});
+shadowRoot.appendChild(document.querySelector('template').content.cloneNode(true));
+
+window._onload_ = () => {
+    requestAnimationFrame(() => {
+        shadowRoot.querySelector('textPath').setAttribute('href', '#path2');
+        if (window.testRunner)
+            requestAnimationFrame(() => testRunner.notifyDone());
+    });
+}
+
+</script>
+</body>
+</html>

Added: trunk/LayoutTests/fast/shadow-dom/svg-text-path-href-in-shadow-tree-expected.html (0 => 238524)


--- trunk/LayoutTests/fast/shadow-dom/svg-text-path-href-in-shadow-tree-expected.html	                        (rev 0)
+++ trunk/LayoutTests/fast/shadow-dom/svg-text-path-href-in-shadow-tree-expected.html	2018-11-26 22:48:08 UTC (rev 238524)
@@ -0,0 +1,7 @@
+<!DOCTYPE html>
+<html>
+<body>
+    <p>Test passes if you see a single 100px by 100px green box below.</p>
+    <div style="width: 100px; height: 100px; background: green;"></div>
+</body>
+</html>

Added: trunk/LayoutTests/fast/shadow-dom/svg-text-path-href-in-shadow-tree.html (0 => 238524)


--- trunk/LayoutTests/fast/shadow-dom/svg-text-path-href-in-shadow-tree.html	                        (rev 0)
+++ trunk/LayoutTests/fast/shadow-dom/svg-text-path-href-in-shadow-tree.html	2018-11-26 22:48:08 UTC (rev 238524)
@@ -0,0 +1,29 @@
+<!DOCTYPE html>
+<html>
+<body>
+<p>Test passes if you see a single 100px by 100px green box below.</p>
+<div id="host" style="width: 100px; height: 100px;"></div>
+<svg>
+    <defs>
+        <path id="path" fill="red" stroke="red" d="M0,50 L100,50 Z">
+    </defs>
+</svg>
+<template>
+    <svg viewbox="0 0 100 100" xmlns:xlink="http://www.w3.org/1999/xlink">
+        <defs>
+            <path id="path" fill="green" d="M0,-5 L100,-5 Z">
+        </defs>
+        <rect x="0" y="0" width="100" height="100" fill="green"></rect>
+        <text>
+            <textPath xlink:href=""
+        </text>
+    </svg>
+</template>
+<script>
+
+const shadowRoot = host.attachShadow({mode: 'closed'});
+shadowRoot.appendChild(document.querySelector('template').content.cloneNode(true));
+
+</script>
+</body>
+</html>

Added: trunk/LayoutTests/fast/shadow-dom/svg-thref-href-change-in-shadow-tree-expected.html (0 => 238524)


--- trunk/LayoutTests/fast/shadow-dom/svg-thref-href-change-in-shadow-tree-expected.html	                        (rev 0)
+++ trunk/LayoutTests/fast/shadow-dom/svg-thref-href-change-in-shadow-tree-expected.html	2018-11-26 22:48:08 UTC (rev 238524)
@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<html>
+<body>
+<p>Test passes if you see a single 100px by 100px green box below with "PASS" in the middle.</p>
+<div id="host" style="width: 100px; height: 100px;">
+    <svg viewbox="0 0 100 100">
+        <rect x="0" y="0" width="100" height="100" fill="green"></rect>
+        <text alignment-baseline="middle" y="50">PASS</text>
+    </svg>
+</div>
+</body>
+</html>

Added: trunk/LayoutTests/fast/shadow-dom/svg-thref-href-change-in-shadow-tree.html (0 => 238524)


--- trunk/LayoutTests/fast/shadow-dom/svg-thref-href-change-in-shadow-tree.html	                        (rev 0)
+++ trunk/LayoutTests/fast/shadow-dom/svg-thref-href-change-in-shadow-tree.html	2018-11-26 22:48:08 UTC (rev 238524)
@@ -0,0 +1,41 @@
+<!DOCTYPE html>
+<html>
+<body>
+<p>Test passes if you see a single 100px by 100px green box below with "PASS" in the middle.</p>
+<div id="host" style="width: 100px; height: 100px;"></div>
+<svg>
+    <defs>
+        <text id="text">FAIL FAIL FAIL</text>
+    </defs>
+</svg>
+<template>
+    <svg viewbox="0 0 100 100" xmlns:xlink="http://www.w3.org/1999/xlink">
+        <defs>
+            <text id="text1">FAIL FAIL</text>
+            <text id="text2">PASS</text>
+        </defs>
+        <rect x="0" y="0" width="100" height="100" fill="green"></rect>
+        <text x="0" y="0">
+            <tref alignment-baseline="middle" y="50" xlink:href=""
+        </text>
+    </svg>
+</template>
+<script>
+
+if (window.testRunner)
+    testRunner.waitUntilDone();
+
+const shadowRoot = host.attachShadow({mode: 'closed'});
+shadowRoot.appendChild(document.querySelector('template').content.cloneNode(true));
+
+window._onload_ = () => {
+    requestAnimationFrame(() => {
+        shadowRoot.querySelector('tref').setAttribute('href', '#text2');
+        if (window.testRunner)
+            requestAnimationFrame(() => testRunner.notifyDone());
+    });
+}
+
+</script>
+</body>
+</html>

Added: trunk/LayoutTests/fast/shadow-dom/svg-thref-href-in-shadow-tree-expected.html (0 => 238524)


--- trunk/LayoutTests/fast/shadow-dom/svg-thref-href-in-shadow-tree-expected.html	                        (rev 0)
+++ trunk/LayoutTests/fast/shadow-dom/svg-thref-href-in-shadow-tree-expected.html	2018-11-26 22:48:08 UTC (rev 238524)
@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<html>
+<body>
+<p>Test passes if you see a single 100px by 100px green box below with "PASS" in the middle.</p>
+<div id="host" style="width: 100px; height: 100px;">
+    <svg viewbox="0 0 100 100">
+        <rect x="0" y="0" width="100" height="100" fill="green"></rect>
+        <text alignment-baseline="middle" y="50">PASS</text>
+    </svg>
+</div>
+</body>
+</html>

Added: trunk/LayoutTests/fast/shadow-dom/svg-thref-href-in-shadow-tree.html (0 => 238524)


--- trunk/LayoutTests/fast/shadow-dom/svg-thref-href-in-shadow-tree.html	                        (rev 0)
+++ trunk/LayoutTests/fast/shadow-dom/svg-thref-href-in-shadow-tree.html	2018-11-26 22:48:08 UTC (rev 238524)
@@ -0,0 +1,29 @@
+<!DOCTYPE html>
+<html>
+<body>
+<p>Test passes if you see a single 100px by 100px green box below with "PASS" in the middle.</p>
+<div id="host" style="width: 100px; height: 100px;"></div>
+<svg>
+    <defs>
+        <text id="text">FAIL FAIL FAIL</text>
+    </defs>
+</svg>
+<template>
+    <svg viewbox="0 0 100 100" xmlns:xlink="http://www.w3.org/1999/xlink">
+        <defs>
+            <text id="text">PASS</text>
+        </defs>
+        <rect x="0" y="0" width="100" height="100" fill="green"></rect>
+        <text x="0" y="0">
+            <tref alignment-baseline="middle" y="50" xlink:href=""
+        </text>
+    </svg>
+</template>
+<script>
+
+const shadowRoot = host.attachShadow({mode: 'closed'});
+shadowRoot.appendChild(document.querySelector('template').content.cloneNode(true));
+
+</script>
+</body>
+</html>

Added: trunk/LayoutTests/fast/shadow-dom/svg-use-href-change-in-shadow-tree-expected.html (0 => 238524)


--- trunk/LayoutTests/fast/shadow-dom/svg-use-href-change-in-shadow-tree-expected.html	                        (rev 0)
+++ trunk/LayoutTests/fast/shadow-dom/svg-use-href-change-in-shadow-tree-expected.html	2018-11-26 22:48:08 UTC (rev 238524)
@@ -0,0 +1,7 @@
+<!DOCTYPE html>
+<html>
+<body>
+    <p>Test passes if you see a single 100px by 100px green box below.</p>
+    <div style="width: 100px; height: 100px; background: green;"></div>
+</body>
+</html>

Added: trunk/LayoutTests/fast/shadow-dom/svg-use-href-change-in-shadow-tree.html (0 => 238524)


--- trunk/LayoutTests/fast/shadow-dom/svg-use-href-change-in-shadow-tree.html	                        (rev 0)
+++ trunk/LayoutTests/fast/shadow-dom/svg-use-href-change-in-shadow-tree.html	2018-11-26 22:48:08 UTC (rev 238524)
@@ -0,0 +1,45 @@
+<!DOCTYPE html>
+<html>
+<body>
+<p>Test passes if you see a single 100px by 100px green box below.</p>
+<div id="host" style="width: 100px; height: 100px;"></div>
+<svg>
+    <defs>
+        <rect id="rect1" width="100" height="50" fill="red">
+    </defs>
+</svg>
+<template>
+    <svg viewbox="0 0 100 100">
+        <defs>
+            <rect id="rect1" width="100" height="50" fill="red">
+            <rect id="rect2" width="100" height="50" fill="green">
+        </defs>
+        <g id="rectGroup">
+            <use href=""
+                <rect width="100" height="25" fill="red">
+            </use>
+        </g>
+        <use href="" y="50">
+            <rect width="50" height="50" fill="red">
+        </use>
+    </svg>
+</template>
+<script>
+
+if (window.testRunner)
+    testRunner.waitUntilDone();
+
+const shadowRoot = host.attachShadow({mode: 'closed'});
+shadowRoot.appendChild(document.querySelector('template').content.cloneNode(true));
+
+window._onload_ = () => {
+    requestAnimationFrame(() => {
+        shadowRoot.querySelector('use').setAttribute('href', '#rect2');
+        if (window.testRunner)
+            requestAnimationFrame(() => testRunner.notifyDone());
+    });
+}
+
+</script>
+</body>
+</html>

Added: trunk/LayoutTests/fast/shadow-dom/svg-use-href-in-shadow-tree-expected.html (0 => 238524)


--- trunk/LayoutTests/fast/shadow-dom/svg-use-href-in-shadow-tree-expected.html	                        (rev 0)
+++ trunk/LayoutTests/fast/shadow-dom/svg-use-href-in-shadow-tree-expected.html	2018-11-26 22:48:08 UTC (rev 238524)
@@ -0,0 +1,7 @@
+<!DOCTYPE html>
+<html>
+<body>
+    <p>Test passes if you see a single 100px by 100px green box below.</p>
+    <div style="width: 100px; height: 100px; background: green;"></div>
+</body>
+</html>

Added: trunk/LayoutTests/fast/shadow-dom/svg-use-href-in-shadow-tree.html (0 => 238524)


--- trunk/LayoutTests/fast/shadow-dom/svg-use-href-in-shadow-tree.html	                        (rev 0)
+++ trunk/LayoutTests/fast/shadow-dom/svg-use-href-in-shadow-tree.html	2018-11-26 22:48:08 UTC (rev 238524)
@@ -0,0 +1,28 @@
+<!DOCTYPE html>
+<html>
+<body>
+<p>Test passes if you see a single 100px by 100px green box below.</p>
+<div id="host" style="width: 100px; height: 100px;"></div>
+<svg>
+    <defs>
+        <rect id="rect" width="100" height="100" fill="red">
+    </defs>
+</svg>
+<template>
+    <svg viewbox="0 0 100 100">
+        <defs>
+            <rect id="rect" width="100" height="100" fill="green">
+        </defs>
+        <use href=""
+            <rect id="rect" width="50" height="50" fill="red">
+        </use>
+    </svg>
+</template>
+<script>
+
+const shadowRoot = host.attachShadow({mode: 'closed'});
+shadowRoot.appendChild(document.querySelector('template').content.cloneNode(true)); 
+
+</script>
+</body>
+</html>

Modified: trunk/Source/WebCore/ChangeLog (238523 => 238524)


--- trunk/Source/WebCore/ChangeLog	2018-11-26 22:22:07 UTC (rev 238523)
+++ trunk/Source/WebCore/ChangeLog	2018-11-26 22:48:08 UTC (rev 238524)
@@ -1,3 +1,71 @@
+2018-11-24  Ryosuke Niwa  <[email protected]>
+
+        SVG use element inside a shadow tree cannot reference an element in the same tree
+        https://bugs.webkit.org/show_bug.cgi?id=174977
+        <rdar://problem/33665636>
+
+        Reviewed by Zalan Bujtas.
+
+        Make fragment URL references used by SVGelements within a shadow tree to refer to other elements
+        in the same shadow tree. To do this, this patch makes targetElementFromIRIString take a TreeScope
+        instead of a Document, and updates its call sites.
+
+        This patch updates the most uses of targetElementFromIRIString except CSS cursor image, altGraph,
+        and glyphRef since the cursor image isn't really a SVG feature, and there aren't really real world
+        use cases in which altGraph and glyphRef are used within shadow trees.
+
+        Tests: fast/shadow-dom/svg-animate-href-change-in-shadow-tree.html
+               fast/shadow-dom/svg-animate-href-in-shadow-tree.html
+               fast/shadow-dom/svg-feimage-href-in-shadow-tree.html
+               fast/shadow-dom/svg-linear-gradient-href-in-shadow-tree.html
+               fast/shadow-dom/svg-mpath-href-change-in-shadow-tree.html
+               fast/shadow-dom/svg-mpath-href-in-shadow-tree.html
+               fast/shadow-dom/svg-radial-gradient-href-in-shadow-tree.html
+               fast/shadow-dom/svg-text-path-href-change-in-shadow-tree.html
+               fast/shadow-dom/svg-text-path-href-in-shadow-tree.html
+               fast/shadow-dom/svg-thref-href-change-in-shadow-tree.html
+               fast/shadow-dom/svg-thref-href-in-shadow-tree.html
+               fast/shadow-dom/svg-use-href-change-in-shadow-tree.html
+               fast/shadow-dom/svg-use-href-in-shadow-tree.html
+
+        * accessibility/AccessibilitySVGElement.cpp:
+        (WebCore::AccessibilitySVGElement::targetForUseElement const):
+        * css/CSSCursorImageValue.cpp:
+        * rendering/svg/RenderSVGTextPath.cpp:
+        (WebCore::RenderSVGTextPath::layoutPath const):
+        * svg/SVGAltGlyphElement.cpp:
+        (WebCore::SVGAltGlyphElement::hasValidGlyphElements const):
+        * svg/SVGFEImageElement.cpp:
+        (WebCore::SVGFEImageElement::buildPendingResource):
+        (WebCore::SVGFEImageElement::build):
+        * svg/SVGGlyphRefElement.cpp:
+        (WebCore::SVGGlyphRefElement::hasValidGlyphElement const):
+        * svg/SVGLinearGradientElement.cpp:
+        (WebCore::SVGLinearGradientElement::collectGradientAttributes):
+        * svg/SVGMPathElement.cpp:
+        (WebCore::SVGMPathElement::buildPendingResource):
+        (WebCore::SVGMPathElement::pathElement):
+        * svg/SVGRadialGradientElement.cpp:
+        (WebCore::SVGRadialGradientElement::collectGradientAttributes):
+        * svg/SVGTRefElement.cpp:
+        (WebCore::SVGTRefElement::buildPendingResource):
+        * svg/SVGTextPathElement.cpp:
+        (WebCore::SVGTextPathElement::buildPendingResource):
+        * svg/SVGURIReference.cpp:
+        (WebCore::SVGURIReference::targetElementFromIRIString):
+        * svg/SVGURIReference.h:
+        * svg/SVGUseElement.cpp:
+        (WebCore::SVGUseElement::updateShadowTree):
+        (WebCore::SVGUseElement::findTarget const):
+        * svg/animation/SVGSMILElement.cpp:
+        (WebCore::SVGSMILElement::buildPendingResource):
+        (WebCore::SVGSMILElement::insertedIntoAncestor):
+        * svg/graphics/filters/SVGFEImage.cpp:
+        (WebCore::FEImage::FEImage):
+        (WebCore::FEImage::createWithIRIReference):
+        (WebCore::FEImage::referencedRenderer const):
+        * svg/graphics/filters/SVGFEImage.h:
+
 2018-11-26  Truitt Savell  <[email protected]>
 
         Unreviewed, rolling out r238357.

Modified: trunk/Source/WebCore/accessibility/AccessibilitySVGElement.cpp (238523 => 238524)


--- trunk/Source/WebCore/accessibility/AccessibilitySVGElement.cpp	2018-11-26 22:22:07 UTC (rev 238523)
+++ trunk/Source/WebCore/accessibility/AccessibilitySVGElement.cpp	2018-11-26 22:48:08 UTC (rev 238524)
@@ -65,7 +65,7 @@
     if (href.isEmpty())
         href = ""
 
-    auto target = SVGURIReference::targetElementFromIRIString(href, use.document());
+    auto target = SVGURIReference::targetElementFromIRIString(href, use.treeScope());
     if (!target.element)
         return nullptr;
     return axObjectCache()->getOrCreate(target.element.get());

Modified: trunk/Source/WebCore/css/CSSCursorImageValue.cpp (238523 => 238524)


--- trunk/Source/WebCore/css/CSSCursorImageValue.cpp	2018-11-26 22:22:07 UTC (rev 238523)
+++ trunk/Source/WebCore/css/CSSCursorImageValue.cpp	2018-11-26 22:48:08 UTC (rev 238524)
@@ -64,6 +64,7 @@
     return result.toString();
 }
 
+// FIXME: Should this function take a TreeScope instead?
 SVGCursorElement* CSSCursorImageValue::updateCursorElement(const Document& document)
 {
     if (!m_originalURL.hasFragmentIdentifier())

Modified: trunk/Source/WebCore/rendering/svg/RenderSVGTextPath.cpp (238523 => 238524)


--- trunk/Source/WebCore/rendering/svg/RenderSVGTextPath.cpp	2018-11-26 22:22:07 UTC (rev 238523)
+++ trunk/Source/WebCore/rendering/svg/RenderSVGTextPath.cpp	2018-11-26 22:48:08 UTC (rev 238524)
@@ -46,7 +46,7 @@
 
 Path RenderSVGTextPath::layoutPath() const
 {
-    auto target = SVGURIReference::targetElementFromIRIString(textPathElement().href(), document());
+    auto target = SVGURIReference::targetElementFromIRIString(textPathElement().href(), textPathElement().treeScope());
     if (!is<SVGPathElement>(target.element))
         return Path();
 

Modified: trunk/Source/WebCore/svg/SVGAltGlyphElement.cpp (238523 => 238524)


--- trunk/Source/WebCore/svg/SVGAltGlyphElement.cpp	2018-11-26 22:22:07 UTC (rev 238523)
+++ trunk/Source/WebCore/svg/SVGAltGlyphElement.cpp	2018-11-26 22:48:08 UTC (rev 238524)
@@ -81,6 +81,7 @@
 
 bool SVGAltGlyphElement::hasValidGlyphElements(Vector<String>& glyphNames) const
 {
+    // No need to support altGlyph referencing another node inside a shadow tree.
     auto target = targetElementFromIRIString(getAttribute(SVGNames::hrefAttr, XLinkNames::hrefAttr), document());
 
     if (is<SVGGlyphElement>(target.element)) {

Modified: trunk/Source/WebCore/svg/SVGFEImageElement.cpp (238523 => 238524)


--- trunk/Source/WebCore/svg/SVGFEImageElement.cpp	2018-11-26 22:22:07 UTC (rev 238523)
+++ trunk/Source/WebCore/svg/SVGFEImageElement.cpp	2018-11-26 22:48:08 UTC (rev 238524)
@@ -94,7 +94,7 @@
     if (!isConnected())
         return;
 
-    auto target = SVGURIReference::targetElementFromIRIString(href(), document());
+    auto target = SVGURIReference::targetElementFromIRIString(href(), treeScope());
     if (!target.element) {
         if (target.identifier.isEmpty())
             requestImageResource();
@@ -189,7 +189,7 @@
 {
     if (m_cachedImage)
         return FEImage::createWithImage(filter, m_cachedImage->imageForRenderer(renderer()), preserveAspectRatio());
-    return FEImage::createWithIRIReference(filter, document(), href(), preserveAspectRatio());
+    return FEImage::createWithIRIReference(filter, treeScope(), href(), preserveAspectRatio());
 }
 
 void SVGFEImageElement::addSubresourceAttributeURLs(ListHashSet<URL>& urls) const

Modified: trunk/Source/WebCore/svg/SVGGlyphRefElement.cpp (238523 => 238524)


--- trunk/Source/WebCore/svg/SVGGlyphRefElement.cpp	2018-11-26 22:22:07 UTC (rev 238523)
+++ trunk/Source/WebCore/svg/SVGGlyphRefElement.cpp	2018-11-26 22:48:08 UTC (rev 238524)
@@ -50,6 +50,7 @@
 {
     // FIXME: We only support xlink:href so far.
     // https://bugs.webkit.org/show_bug.cgi?id=64787
+    // No need to support glyphRef referencing another node inside a shadow tree.
     auto target = targetElementFromIRIString(getAttribute(SVGNames::hrefAttr, XLinkNames::hrefAttr), document());
     glyphName = target.identifier;
     return is<SVGGlyphElement>(target.element);

Modified: trunk/Source/WebCore/svg/SVGLinearGradientElement.cpp (238523 => 238524)


--- trunk/Source/WebCore/svg/SVGLinearGradientElement.cpp	2018-11-26 22:22:07 UTC (rev 238523)
+++ trunk/Source/WebCore/svg/SVGLinearGradientElement.cpp	2018-11-26 22:48:08 UTC (rev 238524)
@@ -149,7 +149,7 @@
 
     while (true) {
         // Respect xlink:href, take attributes from referenced element
-        auto target = SVGURIReference::targetElementFromIRIString(current->href(), document());
+        auto target = SVGURIReference::targetElementFromIRIString(current->href(), treeScope());
         if (is<SVGGradientElement>(target.element)) {
             current = downcast<SVGGradientElement>(*target.element);
 

Modified: trunk/Source/WebCore/svg/SVGMPathElement.cpp (238523 => 238524)


--- trunk/Source/WebCore/svg/SVGMPathElement.cpp	2018-11-26 22:22:07 UTC (rev 238523)
+++ trunk/Source/WebCore/svg/SVGMPathElement.cpp	2018-11-26 22:48:08 UTC (rev 238524)
@@ -55,7 +55,7 @@
     if (!isConnected())
         return;
 
-    auto target = SVGURIReference::targetElementFromIRIString(href(), document());
+    auto target = SVGURIReference::targetElementFromIRIString(href(), treeScope());
     if (!target.element) {
         // Do not register as pending if we are already pending this resource.
         if (document().accessSVGExtensions().isPendingResource(this, target.identifier))
@@ -121,7 +121,7 @@
 
 RefPtr<SVGPathElement> SVGMPathElement::pathElement()
 {
-    auto target = targetElementFromIRIString(href(), document());
+    auto target = targetElementFromIRIString(href(), treeScope());
     if (is<SVGPathElement>(target.element))
         return downcast<SVGPathElement>(target.element.get());
     return nullptr;

Modified: trunk/Source/WebCore/svg/SVGRadialGradientElement.cpp (238523 => 238524)


--- trunk/Source/WebCore/svg/SVGRadialGradientElement.cpp	2018-11-26 22:22:07 UTC (rev 238523)
+++ trunk/Source/WebCore/svg/SVGRadialGradientElement.cpp	2018-11-26 22:48:08 UTC (rev 238524)
@@ -161,7 +161,7 @@
 
     while (true) {
         // Respect xlink:href, take attributes from referenced element
-        auto target = SVGURIReference::targetElementFromIRIString(current->href(), document());
+        auto target = SVGURIReference::targetElementFromIRIString(current->href(), treeScope());
         if (is<SVGGradientElement>(target.element)) {
             current = downcast<SVGGradientElement>(target.element.get());
 

Modified: trunk/Source/WebCore/svg/SVGTRefElement.cpp (238523 => 238524)


--- trunk/Source/WebCore/svg/SVGTRefElement.cpp	2018-11-26 22:22:07 UTC (rev 238523)
+++ trunk/Source/WebCore/svg/SVGTRefElement.cpp	2018-11-26 22:48:08 UTC (rev 238524)
@@ -230,7 +230,7 @@
     if (!isConnected())
         return;
 
-    auto target = SVGURIReference::targetElementFromIRIString(href(), document());
+    auto target = SVGURIReference::targetElementFromIRIString(href(), treeScope());
     if (!target.element) {
         if (target.identifier.isEmpty())
             return;

Modified: trunk/Source/WebCore/svg/SVGTextPathElement.cpp (238523 => 238524)


--- trunk/Source/WebCore/svg/SVGTextPathElement.cpp	2018-11-26 22:22:07 UTC (rev 238523)
+++ trunk/Source/WebCore/svg/SVGTextPathElement.cpp	2018-11-26 22:48:08 UTC (rev 238524)
@@ -143,7 +143,7 @@
     if (!isConnected())
         return;
 
-    auto target = SVGURIReference::targetElementFromIRIString(href(), document());
+    auto target = SVGURIReference::targetElementFromIRIString(href(), treeScope());
     if (!target.element) {
         // Do not register as pending if we are already pending this resource.
         if (document().accessSVGExtensions().isPendingResource(this, target.identifier))

Modified: trunk/Source/WebCore/svg/SVGURIReference.cpp (238523 => 238524)


--- trunk/Source/WebCore/svg/SVGURIReference.cpp	2018-11-26 22:22:07 UTC (rev 238523)
+++ trunk/Source/WebCore/svg/SVGURIReference.cpp	2018-11-26 22:48:08 UTC (rev 238524)
@@ -87,7 +87,7 @@
     return emptyString();
 }
 
-auto SVGURIReference::targetElementFromIRIString(const String& iri, const Document& document, RefPtr<Document> externalDocument) -> TargetElementResult
+auto SVGURIReference::targetElementFromIRIString(const String& iri, const TreeScope& treeScope, RefPtr<Document> externalDocument) -> TargetElementResult
 {
     // If there's no fragment identifier contained within the IRI string, we can't lookup an element.
     size_t startOfFragmentIdentifier = iri.find('#');
@@ -99,6 +99,7 @@
     if (id.isEmpty())
         return { };
 
+    auto& document = treeScope.documentScope();
     auto url = ""
     if (externalDocument) {
         // Enforce that the referenced url matches the url of the document that we've loaded for it!
@@ -110,7 +111,7 @@
     if (isExternalURIReference(iri, document))
         return { nullptr, WTFMove(id) };
 
-    return { document.getElementById(id), WTFMove(id) };
+    return { treeScope.getElementById(id), WTFMove(id) };
 }
 
 }

Modified: trunk/Source/WebCore/svg/SVGURIReference.h (238523 => 238524)


--- trunk/Source/WebCore/svg/SVGURIReference.h	2018-11-26 22:22:07 UTC (rev 238523)
+++ trunk/Source/WebCore/svg/SVGURIReference.h	2018-11-26 22:48:08 UTC (rev 238524)
@@ -46,7 +46,7 @@
         RefPtr<Element> element;
         String identifier;
     };
-    static TargetElementResult targetElementFromIRIString(const String&, const Document&, RefPtr<Document> externalDocument = nullptr);
+    static TargetElementResult targetElementFromIRIString(const String&, const TreeScope&, RefPtr<Document> externalDocument = nullptr);
 
     static bool isExternalURIReference(const String& uri, const Document& document)
     {

Modified: trunk/Source/WebCore/svg/SVGUseElement.cpp (238523 => 238524)


--- trunk/Source/WebCore/svg/SVGUseElement.cpp	2018-11-26 22:22:07 UTC (rev 238523)
+++ trunk/Source/WebCore/svg/SVGUseElement.cpp	2018-11-26 22:48:08 UTC (rev 238524)
@@ -237,10 +237,6 @@
         return;
     document().removeSVGUseElement(*this);
 
-    // FIXME: Enable SVG use elements in shadow trees.
-    if (isInShadowTree())
-        return;
-
     String targetID;
     auto* target = findTarget(&targetID);
     if (!target) {
@@ -410,7 +406,7 @@
     auto* correspondingElement = this->correspondingElement();
     auto& original = correspondingElement ? downcast<SVGUseElement>(*correspondingElement) : *this;
 
-    auto targetResult = targetElementFromIRIString(original.href(), original.document(), original.externalDocument());
+    auto targetResult = targetElementFromIRIString(original.href(), original.treeScope(), original.externalDocument());
     if (targetID) {
         *targetID = WTFMove(targetResult.identifier);
         // If the reference is external, don't return the target ID to the caller.

Modified: trunk/Source/WebCore/svg/animation/SVGSMILElement.cpp (238523 => 238524)


--- trunk/Source/WebCore/svg/animation/SVGSMILElement.cpp	2018-11-26 22:22:07 UTC (rev 238523)
+++ trunk/Source/WebCore/svg/animation/SVGSMILElement.cpp	2018-11-26 22:48:08 UTC (rev 238524)
@@ -40,6 +40,7 @@
 #include "SVGParserUtilities.h"
 #include "SVGSVGElement.h"
 #include "SVGURIReference.h"
+#include "SVGUseElement.h"
 #include "XLinkNames.h"
 #include <wtf/IsoMallocInlines.h>
 #include <wtf/MathExtras.h>
@@ -184,7 +185,7 @@
     if (href.isEmpty())
         target = parentElement();
     else {
-        auto result = SVGURIReference::targetElementFromIRIString(href.string(), document());
+        auto result = SVGURIReference::targetElementFromIRIString(href.string(), treeScope());
         target = WTFMove(result.element);
         id = WTFMove(result.identifier);
     }
@@ -265,7 +266,7 @@
         return InsertedIntoAncestorResult::Done;
 
     // Verify we are not in <use> instance tree.
-    ASSERT(!isInShadowTree());
+    ASSERT(!isInShadowTree() || !is<SVGUseElement>(shadowHost()));
 
     updateAttributeName();
 

Modified: trunk/Source/WebCore/svg/graphics/filters/SVGFEImage.cpp (238523 => 238524)


--- trunk/Source/WebCore/svg/graphics/filters/SVGFEImage.cpp	2018-11-26 22:22:07 UTC (rev 238523)
+++ trunk/Source/WebCore/svg/graphics/filters/SVGFEImage.cpp	2018-11-26 22:48:08 UTC (rev 238524)
@@ -38,14 +38,13 @@
 FEImage::FEImage(Filter& filter, RefPtr<Image> image, const SVGPreserveAspectRatioValue& preserveAspectRatio)
     : FilterEffect(filter)
     , m_image(image)
-    , m_document(nullptr)
     , m_preserveAspectRatio(preserveAspectRatio)
 {
 }
 
-FEImage::FEImage(Filter& filter, Document& document, const String& href, const SVGPreserveAspectRatioValue& preserveAspectRatio)
+FEImage::FEImage(Filter& filter, TreeScope& treeScope, const String& href, const SVGPreserveAspectRatioValue& preserveAspectRatio)
     : FilterEffect(filter)
-    , m_document(&document)
+    , m_treeScope(&treeScope)
     , m_href(href)
     , m_preserveAspectRatio(preserveAspectRatio)
 {
@@ -56,9 +55,9 @@
     return adoptRef(*new FEImage(filter, image, preserveAspectRatio));
 }
 
-Ref<FEImage> FEImage::createWithIRIReference(Filter& filter, Document& document, const String& href, const SVGPreserveAspectRatioValue& preserveAspectRatio)
+Ref<FEImage> FEImage::createWithIRIReference(Filter& filter, TreeScope& treeScope, const String& href, const SVGPreserveAspectRatioValue& preserveAspectRatio)
 {
-    return adoptRef(*new FEImage(filter, document, href, preserveAspectRatio));
+    return adoptRef(*new FEImage(filter, treeScope, href, preserveAspectRatio));
 }
 
 void FEImage::determineAbsolutePaintRect()
@@ -80,9 +79,9 @@
 
 RenderElement* FEImage::referencedRenderer() const
 {
-    if (!m_document)
+    if (!m_treeScope)
         return nullptr;
-    auto target = SVGURIReference::targetElementFromIRIString(m_href, *m_document);
+    auto target = SVGURIReference::targetElementFromIRIString(m_href, *m_treeScope);
     if (!is<SVGElement>(target.element))
         return nullptr;
     return target.element->renderer();

Modified: trunk/Source/WebCore/svg/graphics/filters/SVGFEImage.h (238523 => 238524)


--- trunk/Source/WebCore/svg/graphics/filters/SVGFEImage.h	2018-11-26 22:22:07 UTC (rev 238523)
+++ trunk/Source/WebCore/svg/graphics/filters/SVGFEImage.h	2018-11-26 22:48:08 UTC (rev 238524)
@@ -34,12 +34,12 @@
 class FEImage final : public FilterEffect {
 public:
     static Ref<FEImage> createWithImage(Filter&, RefPtr<Image>, const SVGPreserveAspectRatioValue&);
-    static Ref<FEImage> createWithIRIReference(Filter&, Document&, const String&, const SVGPreserveAspectRatioValue&);
+    static Ref<FEImage> createWithIRIReference(Filter&, TreeScope&, const String&, const SVGPreserveAspectRatioValue&);
 
 private:
     virtual ~FEImage() = default;
     FEImage(Filter&, RefPtr<Image>, const SVGPreserveAspectRatioValue&);
-    FEImage(Filter&, Document&, const String&, const SVGPreserveAspectRatioValue&);
+    FEImage(Filter&, TreeScope&, const String&, const SVGPreserveAspectRatioValue&);
 
     const char* filterName() const final { return "FEImage"; }
 
@@ -53,8 +53,8 @@
 
     RefPtr<Image> m_image;
 
-    // m_document will never be a dangling reference. See https://bugs.webkit.org/show_bug.cgi?id=99243
-    Document* m_document;
+    // m_treeScope will never be a dangling reference. See https://bugs.webkit.org/show_bug.cgi?id=99243
+    TreeScope* m_treeScope { nullptr };
     String m_href;
     SVGPreserveAspectRatioValue m_preserveAspectRatio;
 };
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes

Reply via email to