Diff
Modified: trunk/LayoutTests/ChangeLog (258458 => 258459)
--- trunk/LayoutTests/ChangeLog 2020-03-14 02:10:54 UTC (rev 258458)
+++ trunk/LayoutTests/ChangeLog 2020-03-14 03:11:34 UTC (rev 258459)
@@ -1,3 +1,13 @@
+2020-03-13 Said Abou-Hallawa <s...@apple.com>
+
+ SVGMatrix should have the access right of its owner SVGTransform always
+ https://bugs.webkit.org/show_bug.cgi?id=207462
+
+ Reviewed by Simon Fraser.
+
+ * svg/dom/SVGTransformList-anim-read-only-expected.txt: Added.
+ * svg/dom/SVGTransformList-anim-read-only.html: Added.
+
2020-03-13 Zalan Bujtas <za...@apple.com>
[Tree building] Block::attachIgnoringContinuation should allow inline tables as before child container
Added: trunk/LayoutTests/svg/dom/SVGTransformList-anim-read-only-expected.txt (0 => 258459)
--- trunk/LayoutTests/svg/dom/SVGTransformList-anim-read-only-expected.txt (rev 0)
+++ trunk/LayoutTests/svg/dom/SVGTransformList-anim-read-only-expected.txt 2020-03-14 03:11:34 UTC (rev 258459)
@@ -0,0 +1,28 @@
+This test checks the read-only property of SVGTransformList.animVal
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+
+Check SVGAnimatedTransformList.animVal is a readonly SVGTransformList
+PASS transformAnim.appendItem(t) threw exception NoModificationAllowedError: The object can not be modified..
+PASS transformAnim.clear() threw exception NoModificationAllowedError: The object can not be modified..
+PASS transformAnim.initialize(t) threw exception NoModificationAllowedError: The object can not be modified..
+PASS transformAnim.insertItemBefore(t, 0) threw exception NoModificationAllowedError: The object can not be modified..
+PASS transformAnim.replaceItem(t, 0) threw exception NoModificationAllowedError: The object can not be modified..
+PASS transformAnim.removeItem(0) threw exception NoModificationAllowedError: The object can not be modified..
+PASS transformAnim(0) = t threw exception ReferenceError: Left side of assignment is not a reference..
+
+Check items of SVGAnimatedTransformList.animVal are readonly SVGTransform
+PASS t.setScale(2, 2) threw exception NoModificationAllowedError: The object can not be modified..
+PASS t.setMatrix(m) threw exception NoModificationAllowedError: The object can not be modified..
+PASS m.b = 2 threw exception NoModificationAllowedError: The object can not be modified..
+
+Check detached items from SVGAnimatedTransformList.animVal are not readonly SVGTransform
+PASS t.setScale(2, 2) did not throw exception.
+PASS t.setMatrix(m) did not throw exception.
+PASS m.b = 2 did not throw exception.
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
Added: trunk/LayoutTests/svg/dom/SVGTransformList-anim-read-only.html (0 => 258459)
--- trunk/LayoutTests/svg/dom/SVGTransformList-anim-read-only.html (rev 0)
+++ trunk/LayoutTests/svg/dom/SVGTransformList-anim-read-only.html 2020-03-14 03:11:34 UTC (rev 258459)
@@ -0,0 +1,53 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src=""
+</head>
+<body>
+<p id="description"></p>
+<div id="console"></div>
+<script>
+description("This test checks the read-only property of SVGTransformList.animVal");
+
+var svgElement = document.createElementNS("http://www.w3.org/2000/svg", "svg");
+var rectElement = document.createElementNS("http://www.w3.org/2000/svg", "rect");
+var transformBase = rectElement.transform.baseVal;
+var transformAnim = rectElement.transform.animVal;
+var t = transformBase.createSVGTransformFromMatrix();
+var m = svgElement.createSVGMatrix();
+
+debug("");
+debug("Check SVGAnimatedTransformList.animVal is a readonly SVGTransformList");
+shouldThrow("transformAnim.appendItem(t)");
+shouldThrow("transformAnim.clear()");
+shouldThrow("transformAnim.initialize(t)");
+shouldThrow("transformAnim.insertItemBefore(t, 0)");
+shouldThrow("transformAnim.replaceItem(t, 0)");
+shouldThrow("transformAnim.removeItem(0)");
+shouldThrow("transformAnim(0) = t");
+
+debug("");
+debug("Check items of SVGAnimatedTransformList.animVal are readonly SVGTransform");
+transformBase.appendItem(t);
+t = transformAnim.getItem(0);
+m = svgElement.createSVGMatrix();
+shouldThrow("t.setScale(2, 2)");
+shouldThrow("t.setMatrix(m)");
+m = t.matrix;
+shouldThrow("m.b = 2");
+
+debug("");
+debug("Check detached items from SVGAnimatedTransformList.animVal are not readonly SVGTransform");
+t = transformAnim.getItem(0);
+transformBase.clear();
+m = svgElement.createSVGMatrix();
+shouldNotThrow("t.setScale(2, 2)");
+shouldNotThrow("t.setMatrix(m)");
+m = t.matrix;
+shouldNotThrow("m.b = 2");
+
+successfullyParsed = true;
+</script>
+<script src=""
+</body>
+</html>
Modified: trunk/Source/WebCore/ChangeLog (258458 => 258459)
--- trunk/Source/WebCore/ChangeLog 2020-03-14 02:10:54 UTC (rev 258458)
+++ trunk/Source/WebCore/ChangeLog 2020-03-14 03:11:34 UTC (rev 258459)
@@ -1,3 +1,22 @@
+2020-03-13 Said Abou-Hallawa <s...@apple.com>
+
+ SVGMatrix should have the access right of its owner SVGTransform always
+ https://bugs.webkit.org/show_bug.cgi?id=207462
+
+ Reviewed by Simon Fraser.
+
+ The SVGMatrix needs to be reattached to its owner SVGTransform when the
+ access right of this owner changes. The access right of the owner changes
+ when it gets attached to or detached from a higher level owner.
+
+ Test: svg/dom/SVGTransformList-anim-read-only.html
+
+ * svg/SVGTransform.h:
+ * svg/properties/SVGProperty.h:
+ (WebCore::SVGProperty::attach):
+ (WebCore::SVGProperty::detach):
+ (WebCore::SVGProperty::reattach):
+
2020-03-13 Alex Christensen <achristen...@webkit.org>
WKWebView._negotiatedLegacyTLS should be correct after back/forward navigations
Modified: trunk/Source/WebCore/svg/SVGTransform.h (258458 => 258459)
--- trunk/Source/WebCore/svg/SVGTransform.h 2020-03-14 02:10:54 UTC (rev 258458)
+++ trunk/Source/WebCore/svg/SVGTransform.h 2020-03-14 03:11:34 UTC (rev 258459)
@@ -144,6 +144,20 @@
return { };
}
+ void attach(SVGPropertyOwner* owner, SVGPropertyAccess access) override
+ {
+ Base::attach(owner, access);
+ // Reattach the SVGMatrix to the SVGTransformValue with the new SVGPropertyAccess.
+ m_value.matrix()->reattach(this, access);
+ }
+
+ void detach() override
+ {
+ Base::detach();
+ // Reattach the SVGMatrix to the SVGTransformValue with the SVGPropertyAccess::ReadWrite.
+ m_value.matrix()->reattach(this, access());
+ }
+
private:
using Base = SVGValueProperty<SVGTransformValue>;
Modified: trunk/Source/WebCore/svg/properties/SVGProperty.h (258458 => 258459)
--- trunk/Source/WebCore/svg/properties/SVGProperty.h 2020-03-14 02:10:54 UTC (rev 258458)
+++ trunk/Source/WebCore/svg/properties/SVGProperty.h 2020-03-14 03:11:34 UTC (rev 258459)
@@ -36,7 +36,7 @@
// Managing the relationship with the owner.
bool isAttached() const { return m_owner; }
- void attach(SVGPropertyOwner* owner, SVGPropertyAccess access)
+ virtual void attach(SVGPropertyOwner* owner, SVGPropertyAccess access)
{
ASSERT(!m_owner);
ASSERT(m_state == SVGPropertyState::Clean);
@@ -44,7 +44,7 @@
m_access = access;
}
- void detach()
+ virtual void detach()
{
m_owner = nullptr;
m_access = SVGPropertyAccess::ReadWrite;
@@ -51,6 +51,13 @@
m_state = SVGPropertyState::Clean;
}
+ void reattach(SVGPropertyOwner* owner, SVGPropertyAccess access)
+ {
+ ASSERT_UNUSED(owner, owner == m_owner);
+ m_access = access;
+ m_state = SVGPropertyState::Clean;
+ }
+
const SVGElement* contextElement() const
{
if (!m_owner)
