Title: [271785] trunk
- Revision
- 271785
- Author
- [email protected]
- Date
- 2021-01-24 16:28:45 -0800 (Sun, 24 Jan 2021)
Log Message
SVG reference filter chain with errors applies only some of the filters, producing incorrect output
https://bugs.webkit.org/show_bug.cgi?id=220893
Reviewed by Sam Weinig.
Source/WebCore:
If the CSS filter property refers to an invalid reference filter, ensure that
the entire reference filter is skipped. Previously, we'd add elements of the reference
filter up to the invalid one.
This behavior matches Gecko and Blink.
Tests: css3/filters/invalid-reference-filter-in-chain.html
css3/filters/invalid-reference-filter.html
* rendering/CSSFilter.cpp:
(WebCore::CSSFilter::buildReferenceFilter):
LayoutTests:
* css3/filters/invalid-reference-filter-expected.html: Added.
* css3/filters/invalid-reference-filter-in-chain-expected.html: Added.
* css3/filters/invalid-reference-filter-in-chain.html: Added.
* css3/filters/invalid-reference-filter.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (271784 => 271785)
--- trunk/LayoutTests/ChangeLog 2021-01-24 21:58:52 UTC (rev 271784)
+++ trunk/LayoutTests/ChangeLog 2021-01-25 00:28:45 UTC (rev 271785)
@@ -1,3 +1,15 @@
+2021-01-24 Simon Fraser <[email protected]>
+
+ SVG reference filter chain with errors applies only some of the filters, producing incorrect output
+ https://bugs.webkit.org/show_bug.cgi?id=220893
+
+ Reviewed by Sam Weinig.
+
+ * css3/filters/invalid-reference-filter-expected.html: Added.
+ * css3/filters/invalid-reference-filter-in-chain-expected.html: Added.
+ * css3/filters/invalid-reference-filter-in-chain.html: Added.
+ * css3/filters/invalid-reference-filter.html: Added.
+
2021-01-23 Per Arne Vollan <[email protected]>
[macOS] Deny mach lookup access to "com.apple.iconservices" in the WebContent process
Added: trunk/LayoutTests/css3/filters/invalid-reference-filter-expected.html (0 => 271785)
--- trunk/LayoutTests/css3/filters/invalid-reference-filter-expected.html (rev 0)
+++ trunk/LayoutTests/css3/filters/invalid-reference-filter-expected.html 2021-01-25 00:28:45 UTC (rev 271785)
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+ .box {
+ height: 200px;
+ width: 200px;
+ background-color: green;
+ }
+</style>
+</head>
+<body>
+ <div class='box'></div>
+</body>
+</html>
+
+
Added: trunk/LayoutTests/css3/filters/invalid-reference-filter-in-chain-expected.html (0 => 271785)
--- trunk/LayoutTests/css3/filters/invalid-reference-filter-in-chain-expected.html (rev 0)
+++ trunk/LayoutTests/css3/filters/invalid-reference-filter-in-chain-expected.html 2021-01-25 00:28:45 UTC (rev 271785)
@@ -0,0 +1,28 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+ body svg {
+ position: absolute;
+ width: 0;
+ height: 0;
+ }
+
+ .box {
+ margin: 10px;
+ height: 200px;
+ width: 200px;
+ border: 20px solid blue;
+ background-color: green;
+ box-sizing: border-box;
+ }
+</style>
+</head>
+<body>
+ <div class='box' style="filter: saturate(0);"></div>
+ <div class='box' style="filter: invert() saturate(0);"></div>
+ <div class='box' style="filter: invert()"></div>
+</body>
+</html>
+
+
Added: trunk/LayoutTests/css3/filters/invalid-reference-filter-in-chain.html (0 => 271785)
--- trunk/LayoutTests/css3/filters/invalid-reference-filter-in-chain.html (rev 0)
+++ trunk/LayoutTests/css3/filters/invalid-reference-filter-in-chain.html 2021-01-25 00:28:45 UTC (rev 271785)
@@ -0,0 +1,36 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+ body svg {
+ position: absolute;
+ width: 0;
+ height: 0;
+ }
+
+ .box {
+ margin: 10px;
+ height: 200px;
+ width: 200px;
+ border: 20px solid blue;
+ background-color: green;
+ box-sizing: border-box;
+ }
+</style>
+</head>
+<body>
+ <svg version='1.1' xmlns='http://www.w3.org/2000/svg'>
+ <defs>
+ <filter id='filter1'>
+ <feturbulence basefrequency='0.005 0.005' id='frequency1' numoctaves='1' result='noise' seed='1' type='fractalNoise'></feturbulence>
+ <fedisplacementmap id='displacement1' in2='fractalNoise' in='SourceGraphic' scale='0'></fedisplacementmap> <!-- in2 is invalid -->
+ </filter>
+ </defs>
+ </svg>
+ <div class='box' style="filter: url(#filter1) saturate(0);"></div>
+ <div class='box' style="filter: invert() url(#filter1) saturate(0);"></div>
+ <div class='box' style="filter: invert() url(#filter1)"></div>
+</body>
+</html>
+
+
Added: trunk/LayoutTests/css3/filters/invalid-reference-filter.html (0 => 271785)
--- trunk/LayoutTests/css3/filters/invalid-reference-filter.html (rev 0)
+++ trunk/LayoutTests/css3/filters/invalid-reference-filter.html 2021-01-25 00:28:45 UTC (rev 271785)
@@ -0,0 +1,32 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+ body svg {
+ position: absolute;
+ width: 0;
+ height: 0;
+ }
+
+ .box {
+ height: 200px;
+ width: 200px;
+ background-color: green;
+ filter: url(#filter1);
+ }
+</style>
+</head>
+<body>
+ <svg version='1.1' xmlns='http://www.w3.org/2000/svg'>
+ <defs>
+ <filter id='filter1'>
+ <feturbulence basefrequency='0.005 0.005' id='frequency1' numoctaves='1' result='noise' seed='1' type='fractalNoise'></feturbulence>
+ <fedisplacementmap id='displacement1' in2='fractalNoise' in='SourceGraphic' scale='0'></fedisplacementmap> <!-- in2 is invalid -->
+ </filter>
+ </defs>
+ </svg>
+ <div class='box'></div>
+</body>
+</html>
+
+
Modified: trunk/Source/WebCore/ChangeLog (271784 => 271785)
--- trunk/Source/WebCore/ChangeLog 2021-01-24 21:58:52 UTC (rev 271784)
+++ trunk/Source/WebCore/ChangeLog 2021-01-25 00:28:45 UTC (rev 271785)
@@ -1,3 +1,22 @@
+2021-01-24 Simon Fraser <[email protected]>
+
+ SVG reference filter chain with errors applies only some of the filters, producing incorrect output
+ https://bugs.webkit.org/show_bug.cgi?id=220893
+
+ Reviewed by Sam Weinig.
+
+ If the CSS filter property refers to an invalid reference filter, ensure that
+ the entire reference filter is skipped. Previously, we'd add elements of the reference
+ filter up to the invalid one.
+
+ This behavior matches Gecko and Blink.
+
+ Tests: css3/filters/invalid-reference-filter-in-chain.html
+ css3/filters/invalid-reference-filter.html
+
+ * rendering/CSSFilter.cpp:
+ (WebCore::CSSFilter::buildReferenceFilter):
+
2021-01-24 Rob Buis <[email protected]>
Make FontCascade::CodePath an enum class
Modified: trunk/Source/WebCore/rendering/CSSFilter.cpp (271784 => 271785)
--- trunk/Source/WebCore/rendering/CSSFilter.cpp 2021-01-24 21:58:52 UTC (rev 271784)
+++ trunk/Source/WebCore/rendering/CSSFilter.cpp 2021-01-25 00:28:45 UTC (rev 271785)
@@ -110,15 +110,18 @@
return nullptr;
}
- RefPtr<FilterEffect> effect;
-
auto builder = makeUnique<SVGFilterBuilder>(&previousEffect);
m_sourceAlpha = builder->getEffectById(SourceAlpha::effectName());
+ RefPtr<FilterEffect> effect;
+ Vector<Ref<FilterEffect>> referenceEffects;
+
for (auto& effectElement : childrenOfType<SVGFilterPrimitiveStandardAttributes>(*filter)) {
effect = effectElement.build(builder.get(), *this);
- if (!effect)
- continue;
+ if (!effect) {
+ LOG_WITH_STREAM(Filters, stream << "CSSFilter " << this << " buildReferenceFilter: failed to build effect from " << effectElement);
+ return nullptr;
+ }
effectElement.setStandardAttributes(effect.get());
if (effectElement.renderer())
@@ -125,8 +128,10 @@
effect->setOperatingColorSpace(effectElement.renderer()->style().svgStyle().colorInterpolationFilters() == ColorInterpolation::LinearRGB ? ColorSpace::LinearRGB : ColorSpace::SRGB);
builder->add(effectElement.result(), effect);
- m_effects.append(*effect);
+ referenceEffects.append(*effect);
}
+
+ m_effects.appendVector(WTFMove(referenceEffects));
return effect;
}
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
