Title: [273809] trunk/Source/WebCore
- Revision
- 273809
- Author
- [email protected]
- Date
- 2021-03-02 20:52:00 -0800 (Tue, 02 Mar 2021)
Log Message
Crash in removeSymbolElementsFromSubtree()
https://bugs.webkit.org/show_bug.cgi?id=222397
Patch by Julian Gonzalez <[email protected]> on 2021-03-02
Reviewed by Ryosuke Niwa.
Skip children in removeSymbolElementsFromSubtree(), so that
we don't see nodes that have been removed.
Thanks to Darin Adler for the initial version of this patch
and Ryosuke Niwa for refinements.
* svg/SVGUseElement.cpp:
(WebCore::SVGUseElement::updateShadowTree):
(WebCore::removeSymbolElementsFromSubtree):
Modified Paths
Diff
Modified: trunk/Source/WebCore/ChangeLog (273808 => 273809)
--- trunk/Source/WebCore/ChangeLog 2021-03-03 04:49:07 UTC (rev 273808)
+++ trunk/Source/WebCore/ChangeLog 2021-03-03 04:52:00 UTC (rev 273809)
@@ -1,3 +1,20 @@
+2021-03-02 Julian Gonzalez <[email protected]>
+
+ Crash in removeSymbolElementsFromSubtree()
+ https://bugs.webkit.org/show_bug.cgi?id=222397
+
+ Reviewed by Ryosuke Niwa.
+
+ Skip children in removeSymbolElementsFromSubtree(), so that
+ we don't see nodes that have been removed.
+
+ Thanks to Darin Adler for the initial version of this patch
+ and Ryosuke Niwa for refinements.
+
+ * svg/SVGUseElement.cpp:
+ (WebCore::SVGUseElement::updateShadowTree):
+ (WebCore::removeSymbolElementsFromSubtree):
+
2021-03-02 Zalan Bujtas <[email protected]>
[LFC][IFC] Enable simplified vertical alignment for hard line breaks
Modified: trunk/Source/WebCore/svg/SVGUseElement.cpp (273808 => 273809)
--- trunk/Source/WebCore/svg/SVGUseElement.cpp 2021-03-03 04:49:07 UTC (rev 273808)
+++ trunk/Source/WebCore/svg/SVGUseElement.cpp 2021-03-03 04:52:00 UTC (rev 273809)
@@ -224,6 +224,9 @@
if (!isConnected())
return;
+
+ ScriptDisallowedScope::InMainThread scriptDisallowedScope;
+
document().removeSVGUseElement(*this);
String targetID;
@@ -350,8 +353,14 @@
// into <svg> elements, which is correct for symbol elements directly referenced by use elements,
// but incorrect for ones that just happen to be in a subtree.
Vector<Element*> symbolElements;
- for (auto& descendant : descendantsOfType<SVGSymbolElement>(subtree))
- symbolElements.append(&descendant);
+ for (auto it = descendantsOfType<Element>(subtree).begin(); it; ) {
+ if (is<SVGSymbolElement>(*it)) {
+ symbolElements.append(&*it);
+ it.traverseNextSkippingChildren();
+ continue;
+ }
+ ++it;
+ }
disassociateAndRemoveClones(symbolElements);
}
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
