Title: [112277] trunk/Source/WebCore
- Revision
- 112277
- Author
- [email protected]
- Date
- 2012-03-27 08:58:03 -0700 (Tue, 27 Mar 2012)
Log Message
<svg:use> elements in the parser can create elements not marked as created by the parser
https://bugs.webkit.org/show_bug.cgi?id=81985
Reviewed by Adam Barth.
The SVGUseElement was creating its shadow tree immediately upon
demand. This resulted in nodes being created that were not marked as
"createdByParser", even during parsing. As it happens, there is
already code in there to track "createdByParser" in the SVGUseElement,
it was just being ignored all the time. This may even have been
inefficient. Now we delay creating the shadow dom tree until children
are finished, which is the standard time to handle the createdByParser
flag.
I also verified that other SVG classes that derived from core DOM
classes that use the createdByParser flag do correctly pass this flag
on.
No new tests as this is covered by existing tests and does not have new behavior.
* svg/SVGUseElement.cpp:
(WebCore::SVGUseElement::insertedIntoDocument):
(WebCore::SVGUseElement::svgAttributeChanged):
(WebCore::SVGUseElement::willRecalcStyle):
(WebCore::SVGUseElement::finishParsingChildren):
* xml/XMLErrors.cpp:
(WebCore::XMLErrors::insertErrorMessageBlock):
Modified Paths
Diff
Modified: trunk/Source/WebCore/ChangeLog (112276 => 112277)
--- trunk/Source/WebCore/ChangeLog 2012-03-27 15:56:39 UTC (rev 112276)
+++ trunk/Source/WebCore/ChangeLog 2012-03-27 15:58:03 UTC (rev 112277)
@@ -1,3 +1,33 @@
+2012-03-27 Stephen Chenney <[email protected]>
+
+ <svg:use> elements in the parser can create elements not marked as created by the parser
+ https://bugs.webkit.org/show_bug.cgi?id=81985
+
+ Reviewed by Adam Barth.
+
+ The SVGUseElement was creating its shadow tree immediately upon
+ demand. This resulted in nodes being created that were not marked as
+ "createdByParser", even during parsing. As it happens, there is
+ already code in there to track "createdByParser" in the SVGUseElement,
+ it was just being ignored all the time. This may even have been
+ inefficient. Now we delay creating the shadow dom tree until children
+ are finished, which is the standard time to handle the createdByParser
+ flag.
+
+ I also verified that other SVG classes that derived from core DOM
+ classes that use the createdByParser flag do correctly pass this flag
+ on.
+
+ No new tests as this is covered by existing tests and does not have new behavior.
+
+ * svg/SVGUseElement.cpp:
+ (WebCore::SVGUseElement::insertedIntoDocument):
+ (WebCore::SVGUseElement::svgAttributeChanged):
+ (WebCore::SVGUseElement::willRecalcStyle):
+ (WebCore::SVGUseElement::finishParsingChildren):
+ * xml/XMLErrors.cpp:
+ (WebCore::XMLErrors::insertErrorMessageBlock):
+
2012-03-27 Ming Xie <[email protected]>
[BlackBerry] Disable DisallowCType.h usage
Modified: trunk/Source/WebCore/svg/SVGUseElement.cpp (112276 => 112277)
--- trunk/Source/WebCore/svg/SVGUseElement.cpp 2012-03-27 15:56:39 UTC (rev 112276)
+++ trunk/Source/WebCore/svg/SVGUseElement.cpp 2012-03-27 15:58:03 UTC (rev 112277)
@@ -181,7 +181,8 @@
SVGStyledTransformableElement::insertedIntoDocument();
ASSERT(!m_targetElementInstance || !isWellFormedDocument(document()));
ASSERT(!hasPendingResources() || !isWellFormedDocument(document()));
- buildPendingResource();
+ if (!m_wasInsertedByParser)
+ buildPendingResource();
SVGExternalResourcesRequired::insertedIntoDocument(this);
}
@@ -252,7 +253,8 @@
m_cachedDocument->removeClient(this);
m_cachedDocument = 0;
}
- buildPendingResource();
+ if (!m_wasInsertedByParser)
+ buildPendingResource();
return;
}
@@ -270,7 +272,7 @@
bool SVGUseElement::willRecalcStyle(StyleChange)
{
- if (m_needsShadowTreeRecreation && renderer() && needsStyleRecalc())
+ if (!m_wasInsertedByParser && m_needsShadowTreeRecreation && renderer() && needsStyleRecalc())
buildPendingResource();
return true;
}
@@ -953,6 +955,10 @@
{
SVGStyledTransformableElement::finishParsingChildren();
SVGExternalResourcesRequired::finishParsingChildren();
+ if (m_wasInsertedByParser) {
+ buildPendingResource();
+ m_wasInsertedByParser = false;
+ }
}
}
Modified: trunk/Source/WebCore/xml/XMLErrors.cpp (112276 => 112277)
--- trunk/Source/WebCore/xml/XMLErrors.cpp 2012-03-27 15:56:39 UTC (rev 112276)
+++ trunk/Source/WebCore/xml/XMLErrors.cpp 2012-03-27 15:58:03 UTC (rev 112277)
@@ -144,11 +144,10 @@
body->parserAddChild(documentElement);
m_document->parserAddChild(rootElement.get());
- if (m_document->attached()) {
- // rootElement shouldn't be attached right now, but in some cases might be.
- // See https://bugs.webkit.org/show_bug.cgi?id=81985
+ if (m_document->attached())
+ // In general, rootElement shouldn't be attached right now, but it will be if there is a style element
+ // in the SVG content.
rootElement->reattach();
- }
documentElement = body.get();
}
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
