Diff
Copied: branches/chromium/1025/LayoutTests/svg/custom/bug78807-expected.txt (from rev 109299, trunk/LayoutTests/svg/custom/bug78807-expected.txt) (0 => 109471)
--- branches/chromium/1025/LayoutTests/svg/custom/bug78807-expected.txt (rev 0)
+++ branches/chromium/1025/LayoutTests/svg/custom/bug78807-expected.txt 2012-03-02 01:26:49 UTC (rev 109471)
@@ -0,0 +1,6 @@
+This page contains the following errors:
+
+error on line 11 at column 19: Extra content at the end of the document
+Below is a rendering of the page up to the first error.
+
+
Copied: branches/chromium/1025/LayoutTests/svg/custom/bug78807.svg (from rev 109299, trunk/LayoutTests/svg/custom/bug78807.svg) (0 => 109471)
--- branches/chromium/1025/LayoutTests/svg/custom/bug78807.svg (rev 0)
+++ branches/chromium/1025/LayoutTests/svg/custom/bug78807.svg 2012-03-02 01:26:49 UTC (rev 109471)
@@ -0,0 +1,11 @@
+<svg style="content:counter(counter_0);" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
+ <!-- This test passes if there is no crash. -->
+ <script>
+ if (window.layoutTestController)
+ layoutTestController.dumpAsText();
+ </script>
+ <g id="g">
+ <style>
+ </style>
+ </g>
+ <use xlink:href=""
Copied: branches/chromium/1025/LayoutTests/svg/custom/bug78838-expected.txt (from rev 109299, trunk/LayoutTests/svg/custom/bug78838-expected.txt) (0 => 109471)
--- branches/chromium/1025/LayoutTests/svg/custom/bug78838-expected.txt (rev 0)
+++ branches/chromium/1025/LayoutTests/svg/custom/bug78838-expected.txt 2012-03-02 01:26:49 UTC (rev 109471)
@@ -0,0 +1,2 @@
+
+PASSED
Copied: branches/chromium/1025/LayoutTests/svg/custom/bug78838.html (from rev 109299, trunk/LayoutTests/svg/custom/bug78838.html) (0 => 109471)
--- branches/chromium/1025/LayoutTests/svg/custom/bug78838.html (rev 0)
+++ branches/chromium/1025/LayoutTests/svg/custom/bug78838.html 2012-03-02 01:26:49 UTC (rev 109471)
@@ -0,0 +1,19 @@
+<!-- This test passes if there is no crash. -->
+<script>
+function go() {
+
+ if (window.layoutTestController)
+ layoutTestController.dumpAsText();
+
+ q = document.getElementById('root').contentDocument;
+ q.firstChild.setAttribute('style', 'content:counter(item)');
+
+ document.designMode = 'on';
+ q.execCommand('selectAll');
+ q.execCommand('insertImage');
+ q.getElementById('x').appendChild( q.firstChild.cloneNode(1) );
+ q.execCommand('undo');
+}
+</script>
+<object data="" id="root" _onload_="go()"/></object>
+<p>PASSED</p>
Copied: branches/chromium/1025/LayoutTests/svg/custom/bug79798-expected.txt (from rev 109299, trunk/LayoutTests/svg/custom/bug79798-expected.txt) (0 => 109471)
--- branches/chromium/1025/LayoutTests/svg/custom/bug79798-expected.txt (rev 0)
+++ branches/chromium/1025/LayoutTests/svg/custom/bug79798-expected.txt 2012-03-02 01:26:49 UTC (rev 109471)
@@ -0,0 +1 @@
+
Copied: branches/chromium/1025/LayoutTests/svg/custom/bug79798.html (from rev 109299, trunk/LayoutTests/svg/custom/bug79798.html) (0 => 109471)
--- branches/chromium/1025/LayoutTests/svg/custom/bug79798.html (rev 0)
+++ branches/chromium/1025/LayoutTests/svg/custom/bug79798.html 2012-03-02 01:26:49 UTC (rev 109471)
@@ -0,0 +1,24 @@
+<!-- This test passes if there is no crash. -->
+<!-- It was created by the fuzzer and has been reduced. -->
+<script>
+ function go() {
+
+ if (window.layoutTestController)
+ layoutTestController.dumpAsText();
+
+ q = document.getElementById('root').contentDocument;
+
+ r = document.createRange();
+ s = window.getSelection();
+
+ r.selectNodeContents( q.getElementById('g') );
+ s.addRange( r );
+
+ document.designMode = 'on';
+ q.execCommand('formatBlock', 1, 'h1');
+ q.execCommand('formatBlock', 1, 'h1');
+ q.execCommand('formatBlock', 1, 'h1');
+ document.open();
+ }
+</script>
+<object data="" id="root" _onload_="go()"/</object>
Copied: branches/chromium/1025/LayoutTests/svg/custom/resources/bug78838.svg (from rev 109299, trunk/LayoutTests/svg/custom/resources/bug78838.svg) (0 => 109471)
--- branches/chromium/1025/LayoutTests/svg/custom/resources/bug78838.svg (rev 0)
+++ branches/chromium/1025/LayoutTests/svg/custom/resources/bug78838.svg 2012-03-02 01:26:49 UTC (rev 109471)
@@ -0,0 +1,6 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
+ <text id="x">a</text>
+ <use xlink:href=""
+ <text>a</text>
+ <style></style>
+</svg>
Copied: branches/chromium/1025/LayoutTests/svg/custom/resources/bug79798.svg (from rev 109299, trunk/LayoutTests/svg/custom/resources/bug79798.svg) (0 => 109471)
--- branches/chromium/1025/LayoutTests/svg/custom/resources/bug79798.svg (rev 0)
+++ branches/chromium/1025/LayoutTests/svg/custom/resources/bug79798.svg 2012-03-02 01:26:49 UTC (rev 109471)
@@ -0,0 +1,15 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
+ <g id="x">
+ <style></style>
+ </g>
+
+ <g>
+ <g>
+ <text>b</text>
+ <use xlink:href=""
+ <text>c</text>
+ <text>a</text>
+ <glyph id="g"/>
+ </g>
+ </g>
+</svg>
\ No newline at end of file
Modified: branches/chromium/1025/Source/WebCore/svg/SVGUseElement.cpp (109470 => 109471)
--- branches/chromium/1025/Source/WebCore/svg/SVGUseElement.cpp 2012-03-02 01:23:19 UTC (rev 109470)
+++ branches/chromium/1025/Source/WebCore/svg/SVGUseElement.cpp 2012-03-02 01:26:49 UTC (rev 109471)
@@ -421,14 +421,47 @@
}
#endif
-static bool isDisallowedElement(Node* element)
+static bool isDisallowedElement(Node* node)
{
- // <foreignObject> should never be contained in a <use> tree. Too dangerous side effects possible.
- if (element->hasTagName(SVGNames::foreignObjectTag))
+ // Spec: "Any 'svg', 'symbol', 'g', graphics element or other 'use' is potentially a template object that can be re-used
+ // (i.e., "instanced") in the SVG document via a 'use' element."
+ // "Graphics Element" is defined as 'circle', 'ellipse', 'image', 'line', 'path', 'polygon', 'polyline', 'rect', 'text'
+ // Excluded are anything that is used by reference or that only make sense to appear once in a document.
+ // We must also allow the shadow roots of other use elements and text.
+ if (node->isTextNode())
+ return false;
+
+ if (!node->isSVGElement())
return true;
- if (SVGSMILElement::isSMILElement(element))
- return true;
- return false;
+
+ SVGElement* element = static_cast<SVGElement*>(node);
+
+ DEFINE_STATIC_LOCAL(HashSet<QualifiedName>, allowedElementTags, ());
+ if (allowedElementTags.isEmpty()) {
+ allowedElementTags.add(SVGNames::aTag);
+ allowedElementTags.add(SVGNames::circleTag);
+ allowedElementTags.add(SVGNames::defsTag);
+ allowedElementTags.add(SVGNames::descTag);
+ allowedElementTags.add(SVGNames::ellipseTag);
+ allowedElementTags.add(SVGNames::gTag);
+ allowedElementTags.add(SVGNames::imageTag);
+ allowedElementTags.add(SVGNames::lineTag);
+ allowedElementTags.add(SVGNames::metadataTag);
+ allowedElementTags.add(SVGNames::pathTag);
+ allowedElementTags.add(SVGNames::polygonTag);
+ allowedElementTags.add(SVGNames::polylineTag);
+ allowedElementTags.add(SVGNames::rectTag);
+ allowedElementTags.add(SVGNames::svgTag);
+ allowedElementTags.add(SVGNames::switchTag);
+ allowedElementTags.add(SVGNames::symbolTag);
+ allowedElementTags.add(SVGNames::textTag);
+ allowedElementTags.add(SVGNames::textPathTag);
+ allowedElementTags.add(SVGNames::titleTag);
+ allowedElementTags.add(SVGNames::trefTag);
+ allowedElementTags.add(SVGNames::tspanTag);
+ allowedElementTags.add(SVGNames::useTag);
+ }
+ return !allowedElementTags.contains<QualifiedName, SVGAttributeHashTranslator>(element->tagQName());
}
static bool subtreeContainsDisallowedElement(Node* start)
