Title: [243845] trunk
- Revision
- 243845
- Author
- [email protected]
- Date
- 2019-04-03 19:09:50 -0700 (Wed, 03 Apr 2019)
Log Message
REGRESSION (r220717): Assertion fires when animating an SVG rounded corner rect till it collapses
https://bugs.webkit.org/show_bug.cgi?id=196518
Patch by Said Abou-Hallawa <[email protected]> on 2019-04-03
Reviewed by Simon Fraser.
Source/WebCore:
r220717 made RenderSVGRect clear its m_path in updateShapeFromElement().
RenderSVGRect tries to optimize its layout and drawing if the rectangle
is not rounded. So it uses the flag m_usePathFallback to know whether to
use m_path or m_innerStrokeRect and m_outerStrokeRect. If the rectangle
is rounded but its boundingSize is empty, m_path will be cleared,
m_innerStrokeRect and m_outerStrokeRect will be recalculated but
m_usePathFallback will not be reset to false. Therefore when calling
RenderSVGRect::isEmpty(), it will call RenderSVGShape::isEmpty() which
will assert since m_path is null.
Test: svg/animations/animate-rounded-corner-rect-zero-height.svg
* rendering/svg/RenderSVGRect.cpp:
(WebCore::RenderSVGRect::updateShapeFromElement):
Reset m_usePathFallback to false once clearPath() is called.
LayoutTests:
* svg/animations/animate-rounded-corner-rect-zero-height-expected.txt: Added.
* svg/animations/animate-rounded-corner-rect-zero-height.svg: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (243844 => 243845)
--- trunk/LayoutTests/ChangeLog 2019-04-04 02:01:07 UTC (rev 243844)
+++ trunk/LayoutTests/ChangeLog 2019-04-04 02:09:50 UTC (rev 243845)
@@ -1,3 +1,13 @@
+2019-04-03 Said Abou-Hallawa <[email protected]>
+
+ REGRESSION (r220717): Assertion fires when animating an SVG rounded corner rect till it collapses
+ https://bugs.webkit.org/show_bug.cgi?id=196518
+
+ Reviewed by Simon Fraser.
+
+ * svg/animations/animate-rounded-corner-rect-zero-height-expected.txt: Added.
+ * svg/animations/animate-rounded-corner-rect-zero-height.svg: Added.
+
2019-04-03 Myles C. Maxfield <[email protected]>
-apple-trailing-word is needed for browser detection
Added: trunk/LayoutTests/svg/animations/animate-rounded-corner-rect-zero-height-expected.txt (0 => 243845)
--- trunk/LayoutTests/svg/animations/animate-rounded-corner-rect-zero-height-expected.txt (rev 0)
+++ trunk/LayoutTests/svg/animations/animate-rounded-corner-rect-zero-height-expected.txt 2019-04-04 02:09:50 UTC (rev 243845)
@@ -0,0 +1,2 @@
+Test passes if it does not assert in debug builds.
+
Added: trunk/LayoutTests/svg/animations/animate-rounded-corner-rect-zero-height.svg (0 => 243845)
--- trunk/LayoutTests/svg/animations/animate-rounded-corner-rect-zero-height.svg (rev 0)
+++ trunk/LayoutTests/svg/animations/animate-rounded-corner-rect-zero-height.svg 2019-04-04 02:09:50 UTC (rev 243845)
@@ -0,0 +1,15 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+ <text x="0" y="120">Test passes if it does not assert in debug builds.</text>
+ <rect fill="green" x="10" y="10" width="100" height="100" rx="1" ry="1">
+ <animate attributeName="height" fill="freeze" dur="20ms" from="50" to="0"/>
+ </rect>
+ <script>
+ if (window.testRunner) {
+ testRunner.dumpAsText();
+ testRunner.waitUntilDone();
+ setTimeout(() => {
+ testRunner.notifyDone();
+ }, 20);
+ }
+ </script>
+</svg>
Modified: trunk/Source/WebCore/ChangeLog (243844 => 243845)
--- trunk/Source/WebCore/ChangeLog 2019-04-04 02:01:07 UTC (rev 243844)
+++ trunk/Source/WebCore/ChangeLog 2019-04-04 02:09:50 UTC (rev 243845)
@@ -1,3 +1,27 @@
+2019-04-03 Said Abou-Hallawa <[email protected]>
+
+ REGRESSION (r220717): Assertion fires when animating an SVG rounded corner rect till it collapses
+ https://bugs.webkit.org/show_bug.cgi?id=196518
+
+ Reviewed by Simon Fraser.
+
+ r220717 made RenderSVGRect clear its m_path in updateShapeFromElement().
+
+ RenderSVGRect tries to optimize its layout and drawing if the rectangle
+ is not rounded. So it uses the flag m_usePathFallback to know whether to
+ use m_path or m_innerStrokeRect and m_outerStrokeRect. If the rectangle
+ is rounded but its boundingSize is empty, m_path will be cleared,
+ m_innerStrokeRect and m_outerStrokeRect will be recalculated but
+ m_usePathFallback will not be reset to false. Therefore when calling
+ RenderSVGRect::isEmpty(), it will call RenderSVGShape::isEmpty() which
+ will assert since m_path is null.
+
+ Test: svg/animations/animate-rounded-corner-rect-zero-height.svg
+
+ * rendering/svg/RenderSVGRect.cpp:
+ (WebCore::RenderSVGRect::updateShapeFromElement):
+ Reset m_usePathFallback to false once clearPath() is called.
+
2019-04-03 Ryosuke Niwa <[email protected]>
Nullptr crash in InlineTextBox::selectionState via TextIndicator::createWithRange
Modified: trunk/Source/WebCore/rendering/svg/RenderSVGRect.cpp (243844 => 243845)
--- trunk/Source/WebCore/rendering/svg/RenderSVGRect.cpp 2019-04-04 02:01:07 UTC (rev 243844)
+++ trunk/Source/WebCore/rendering/svg/RenderSVGRect.cpp 2019-04-04 02:09:50 UTC (rev 243845)
@@ -55,6 +55,7 @@
m_innerStrokeRect = FloatRect();
m_outerStrokeRect = FloatRect();
clearPath();
+ m_usePathFallback = false;
SVGLengthContext lengthContext(&rectElement());
FloatSize boundingBoxSize(lengthContext.valueForLength(style().width(), LengthModeWidth), lengthContext.valueForLength(style().height(), LengthModeHeight));
@@ -71,7 +72,6 @@
m_usePathFallback = true;
return;
}
- m_usePathFallback = false;
}
m_fillBoundingBox = FloatRect(FloatPoint(lengthContext.valueForLength(style().svgStyle().x(), LengthModeWidth),
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
