Diff
Modified: trunk/LayoutTests/ChangeLog (111600 => 111601)
--- trunk/LayoutTests/ChangeLog 2012-03-21 20:41:43 UTC (rev 111600)
+++ trunk/LayoutTests/ChangeLog 2012-03-21 20:49:40 UTC (rev 111601)
@@ -1,3 +1,16 @@
+2012-03-21 Stephen Chenney <[email protected]>
+
+ SVG layout leaves objects still needing layout
+ https://bugs.webkit.org/show_bug.cgi?id=81006
+
+ Reviewed by Nikolas Zimmermann.
+
+ * svg/custom/delete-text-crash-expected.png: Removed.
+ * svg/custom/delete-text-crash-expected.txt:
+ * svg/custom/delete-text-crash.html:
+ * svg/custom/delete-text-innerText-crash-expected.txt: Added.
+ * svg/custom/delete-text-innerText-crash.html: Added.
+
2012-03-21 Vsevolod Vlasov <[email protected]>
Web Inspector: Extract WebInspector.UIBreakpoint from WebInspector.Breakpoint.
Deleted: trunk/LayoutTests/svg/custom/delete-text-crash-expected.png
(Binary files differ)
Modified: trunk/LayoutTests/svg/custom/delete-text-crash-expected.txt (111600 => 111601)
--- trunk/LayoutTests/svg/custom/delete-text-crash-expected.txt 2012-03-21 20:41:43 UTC (rev 111600)
+++ trunk/LayoutTests/svg/custom/delete-text-crash-expected.txt 2012-03-21 20:49:40 UTC (rev 111601)
@@ -1,14 +1,2 @@
-layer at (0,0) size 800x616
- RenderView at (0,0) size 800x600
-layer at (0,0) size 800x616
- RenderBlock {HTML} at (0,0) size 800x616
- RenderBody {BODY} at (8,8) size 784x600
- RenderSVGRoot {svg} at (8,8) size 16x4
- RenderSVGContainer {g} at (8,8) size 16x4
- RenderSVGRect {rect} at (8,8) size 0x0 [fill={[type=SOLID] [color=#000000]}] [x=0.00] [y=0.00] [width=0.00] [height=0.00]
- [filter="x"] RenderSVGResourceFilter {filter} at (-78.40,-60) size 940.80x720
- RenderSVGText {text} at (0,-15) size 14x19 contains 1 chunk(s)
- RenderSVGInlineText {#text} at (0,0) size 0x0
- RenderSVGResourceFilter {filter} [id="x"] [filterUnits=objectBoundingBox] [primitiveUnits=userSpaceOnUse]
- RenderText {#text} at (0,0) size 0x0
-caret: position 1 of child 0 {#text} of child 3 {text} of child 1 {g} of child 1 {svg} of body
+abb
+
Modified: trunk/LayoutTests/svg/custom/delete-text-crash.html (111600 => 111601)
--- trunk/LayoutTests/svg/custom/delete-text-crash.html 2012-03-21 20:41:43 UTC (rev 111600)
+++ trunk/LayoutTests/svg/custom/delete-text-crash.html 2012-03-21 20:49:40 UTC (rev 111601)
@@ -1,7 +1,5 @@
<html>
<!-- This test passes if there is no crash or assert -->
-<!-- This test should be updated to use DumpAsText once WK81006 is fixed -->
-<!-- The style overflow should be removed once we migrate to DumpAsText as well -->
<style type="text/css">
body {
overflow: hidden;
@@ -16,7 +14,10 @@
document.designMode='on';
document.execCommand('delete');
document.execCommand('delete');
- }
+ }
+
+ if (window.layoutTestController)
+ layoutTestController.dumpAsText();
</script>
<body _onload_="testCrash()">
<svg id="root" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
Added: trunk/LayoutTests/svg/custom/delete-text-innerText-crash-expected.txt (0 => 111601)
--- trunk/LayoutTests/svg/custom/delete-text-innerText-crash-expected.txt (rev 0)
+++ trunk/LayoutTests/svg/custom/delete-text-innerText-crash-expected.txt 2012-03-21 20:49:40 UTC (rev 111601)
@@ -0,0 +1,3 @@
+This test passes if there is no crash or assert.
+abb
+
Added: trunk/LayoutTests/svg/custom/delete-text-innerText-crash.html (0 => 111601)
--- trunk/LayoutTests/svg/custom/delete-text-innerText-crash.html (rev 0)
+++ trunk/LayoutTests/svg/custom/delete-text-innerText-crash.html 2012-03-21 20:49:40 UTC (rev 111601)
@@ -0,0 +1,29 @@
+<html>
+<script>
+ function testCrash() {
+ q = document.getElementById('root');
+ r = document.createRange();
+ r.selectNodeContents( q.getElementById('t') );
+ window.getSelection().addRange(r)
+ document.designMode='on';
+ document.execCommand('delete');
+ document.execCommand('delete');
+
+ if (window.layoutTestController)
+ layoutTestController.dumpAsText();
+ }
+</script>
+<body _onload_="testCrash()">
+This test passes if there is no crash or assert.<br/>
+<svg id="root" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
+ <g>
+ <rect filter="url(#x)"/>
+ <text>aa</text>
+ <rect id="t"/>
+ <style></style>
+ <text>bb</text>
+ </g>
+ <filter id="x"></filter>
+</svg>
+</body>
+</html>
Modified: trunk/Source/WebCore/ChangeLog (111600 => 111601)
--- trunk/Source/WebCore/ChangeLog 2012-03-21 20:41:43 UTC (rev 111600)
+++ trunk/Source/WebCore/ChangeLog 2012-03-21 20:49:40 UTC (rev 111601)
@@ -1,3 +1,27 @@
+2012-03-21 Stephen Chenney <[email protected]>
+
+ SVG layout leaves objects still needing layout
+ https://bugs.webkit.org/show_bug.cgi?id=81006
+
+ Reviewed by Nikolas Zimmermann.
+
+ Change the layout of SVG objects such that resources that trigger
+ layout of other objects are handled in a distinct pass, and then
+ objects still requiring layout are laid out again.
+
+ Test: svg/custom/delete-text-innerText-crash.html
+
+ * rendering/svg/RenderSVGResourceContainer.cpp:
+ (WebCore::RenderSVGResourceContainer::layout):
+ * rendering/svg/RenderSVGResourceMarker.cpp:
+ (WebCore::RenderSVGResourceMarker::layout):
+ * rendering/svg/RenderSVGRoot.cpp:
+ (WebCore::RenderSVGRoot::layout):
+ (WebCore::RenderSVGRoot::addResourceForClientInvalidation):
+ (WebCore):
+ * rendering/svg/RenderSVGRoot.h:
+ (RenderSVGRoot):
+
2012-03-21 Tim Horton <[email protected]>
Make use of CG rounded-rect primitives
Modified: trunk/Source/WebCore/rendering/svg/RenderSVGResourceContainer.cpp (111600 => 111601)
--- trunk/Source/WebCore/rendering/svg/RenderSVGResourceContainer.cpp 2012-03-21 20:41:43 UTC (rev 111600)
+++ trunk/Source/WebCore/rendering/svg/RenderSVGResourceContainer.cpp 2012-03-21 20:49:40 UTC (rev 111601)
@@ -22,6 +22,7 @@
#if ENABLE(SVG)
#include "RenderSVGResourceContainer.h"
+#include "RenderSVGRoot.h"
#include "RenderView.h"
#include "SVGResourcesCache.h"
#include "SVGStyledTransformableElement.h"
@@ -53,7 +54,7 @@
{
// Invalidate all resources if our layout changed.
if (everHadLayout() && selfNeedsLayout())
- removeAllClientsFromCache();
+ RenderSVGRoot::addResourceForClientInvalidation(this);
RenderSVGHiddenContainer::layout();
}
Modified: trunk/Source/WebCore/rendering/svg/RenderSVGResourceMarker.cpp (111600 => 111601)
--- trunk/Source/WebCore/rendering/svg/RenderSVGResourceMarker.cpp 2012-03-21 20:41:43 UTC (rev 111600)
+++ trunk/Source/WebCore/rendering/svg/RenderSVGResourceMarker.cpp 2012-03-21 20:49:40 UTC (rev 111601)
@@ -26,6 +26,7 @@
#include "GraphicsContext.h"
#include "RenderSVGContainer.h"
+#include "RenderSVGRoot.h"
#include "SVGElement.h"
#include "SVGMarkerElement.h"
#include "SVGRenderSupport.h"
@@ -49,7 +50,7 @@
{
// Invalidate all resources if our layout changed.
if (everHadLayout() && selfNeedsLayout())
- removeAllClientsFromCache();
+ RenderSVGRoot::addResourceForClientInvalidation(this);
// RenderSVGHiddenContainer overwrites layout(). We need the
// layouting of RenderSVGContainer for calculating local
Modified: trunk/Source/WebCore/rendering/svg/RenderSVGRoot.cpp (111600 => 111601)
--- trunk/Source/WebCore/rendering/svg/RenderSVGRoot.cpp 2012-03-21 20:41:43 UTC (rev 111600)
+++ trunk/Source/WebCore/rendering/svg/RenderSVGRoot.cpp 2012-03-21 20:49:40 UTC (rev 111601)
@@ -212,6 +212,8 @@
{
ASSERT(needsLayout());
+ m_resourcesNeedingToInvalidateClients.clear();
+
// Arbitrary affine transforms are incompatible with LayoutState.
LayoutStateDisabler layoutStateDisabler(view());
@@ -227,6 +229,16 @@
m_isLayoutSizeChanged = needsLayout || (svg->hasRelativeLengths() && oldSize != size());
SVGRenderSupport::layoutChildren(this, needsLayout || SVGRenderSupport::filtersForceContainerLayout(this));
+ if (!m_resourcesNeedingToInvalidateClients.isEmpty()) {
+ // Invalidate resource clients, which may mark some nodes for layout.
+ HashSet<RenderSVGResourceContainer*>::iterator end = m_resourcesNeedingToInvalidateClients.end();
+ for (HashSet<RenderSVGResourceContainer*>::iterator it = m_resourcesNeedingToInvalidateClients.begin(); it != end; ++it)
+ (*it)->removeAllClientsFromCache();
+
+ m_isLayoutSizeChanged = false;
+ SVGRenderSupport::layoutChildren(this, false);
+ }
+
// At this point LayoutRepainter already grabbed the old bounds,
// recalculate them now so repaintAfterLayout() uses the new bounds.
if (m_needsBoundariesOrTransformUpdate) {
@@ -437,6 +449,16 @@
return svg->intrinsicHeight(SVGSVGElement::IgnoreCSSProperties).isPercent();
}
+void RenderSVGRoot::addResourceForClientInvalidation(RenderSVGResourceContainer* resource)
+{
+ RenderObject* svgRoot = resource->parent();
+ while (svgRoot && !svgRoot->isSVGRoot())
+ svgRoot = svgRoot->parent();
+ if (!svgRoot)
+ return;
+ static_cast<RenderSVGRoot*>(svgRoot)->m_resourcesNeedingToInvalidateClients.add(resource);
}
+}
+
#endif // ENABLE(SVG)
Modified: trunk/Source/WebCore/rendering/svg/RenderSVGRoot.h (111600 => 111601)
--- trunk/Source/WebCore/rendering/svg/RenderSVGRoot.h 2012-03-21 20:41:43 UTC (rev 111600)
+++ trunk/Source/WebCore/rendering/svg/RenderSVGRoot.h 2012-03-21 20:49:40 UTC (rev 111601)
@@ -59,6 +59,10 @@
// localToBorderBoxTransform maps local SVG viewport coordinates to local CSS box coordinates.
const AffineTransform& localToBorderBoxTransform() const { return m_localToBorderBoxTransform; }
+ // The flag is cleared at the beginning of each layout() pass. Elements then call this
+ // method during layout when they are invalidated by a filter.
+ static void addResourceForClientInvalidation(RenderSVGResourceContainer*);
+
private:
virtual RenderObjectChildList* virtualChildren() { return children(); }
virtual const RenderObjectChildList* virtualChildren() const { return children(); }
@@ -104,6 +108,7 @@
FloatRect m_repaintBoundingBox;
mutable AffineTransform m_localToParentTransform;
AffineTransform m_localToBorderBoxTransform;
+ HashSet<RenderSVGResourceContainer*> m_resourcesNeedingToInvalidateClients;
bool m_isLayoutSizeChanged : 1;
bool m_needsBoundariesOrTransformUpdate : 1;
};
