Diff
Copied: branches/chromium/1025/LayoutTests/svg/custom/delete-modified-text-in-defs-crash-expected.txt (from rev 112119, trunk/LayoutTests/svg/custom/delete-modified-text-in-defs-crash-expected.txt) (0 => 112621)
--- branches/chromium/1025/LayoutTests/svg/custom/delete-modified-text-in-defs-crash-expected.txt (rev 0)
+++ branches/chromium/1025/LayoutTests/svg/custom/delete-modified-text-in-defs-crash-expected.txt 2012-03-30 00:29:39 UTC (rev 112621)
@@ -0,0 +1 @@
+PASS
Copied: branches/chromium/1025/LayoutTests/svg/custom/delete-modified-text-in-defs-crash.svg (from rev 112119, trunk/LayoutTests/svg/custom/delete-modified-text-in-defs-crash.svg) (0 => 112621)
--- branches/chromium/1025/LayoutTests/svg/custom/delete-modified-text-in-defs-crash.svg (rev 0)
+++ branches/chromium/1025/LayoutTests/svg/custom/delete-modified-text-in-defs-crash.svg 2012-03-30 00:29:39 UTC (rev 112621)
@@ -0,0 +1,29 @@
+<svg id="svgRoot" xmlns="http://www.w3.org/2000/svg" _onload_="go()">
+ <defs>
+ <text>
+ <tspan id="tspan1" x="375"></tspan>
+ <tspan>PASS</tspan>
+ </text>
+ </defs>
+ <g><rect id="legendbox"/></g>
+ <script><![CDATA[
+ document.execCommand("SelectAll");
+ elem = document.getElementById("tspan1");
+ elem.removeAttribute("x");
+ range = document.createRange();
+ range.setStartBefore(document.getElementById("tspan1"));
+ range.setEndAfter(document.getElementById("legendbox"));
+ range.deleteContents();
+
+ if (window.layoutTestController)
+ layoutTestController.dumpAsText();
+
+ function go() {
+ var svgRoot = document.getElementById("svgRoot");
+ var passText = document.createElementNS("http://www.w3.org/2000/svg", "text");
+ var textContent = document.createTextNode("PASS");
+ passText.appendChild(textContent);
+ svgRoot.appendChild(passText);
+ }
+ ]]></script>
+</svg>
Modified: branches/chromium/1025/Source/WebCore/rendering/svg/RenderSVGInlineText.cpp (112620 => 112621)
--- branches/chromium/1025/Source/WebCore/rendering/svg/RenderSVGInlineText.cpp 2012-03-30 00:26:27 UTC (rev 112620)
+++ branches/chromium/1025/Source/WebCore/rendering/svg/RenderSVGInlineText.cpp 2012-03-30 00:29:39 UTC (rev 112621)
@@ -99,7 +99,7 @@
// the RenderSVGInlineText objects, and thus needs to be rebuild. The latter will assure that the
// SVGTextLayoutAttributes associated with the RenderSVGInlineText will be updated.
if (RenderSVGText* textRenderer = RenderSVGText::locateRenderSVGTextAncestor(this)) {
- textRenderer->textDOMChanged();
+ textRenderer->invalidateTextPositioningElements();
textRenderer->layoutAttributesChanged(this);
}
}
Modified: branches/chromium/1025/Source/WebCore/rendering/svg/RenderSVGText.cpp (112620 => 112621)
--- branches/chromium/1025/Source/WebCore/rendering/svg/RenderSVGText.cpp 2012-03-30 00:26:27 UTC (rev 112620)
+++ branches/chromium/1025/Source/WebCore/rendering/svg/RenderSVGText.cpp 2012-03-30 00:29:39 UTC (rev 112621)
@@ -6,6 +6,7 @@
* Copyright (C) 2008 Rob Buis <[email protected]>
* Copyright (C) 2009 Dirk Schulze <[email protected]>
* Copyright (C) Research In Motion Limited 2010-2012. All rights reserved.
+ * Copyright (C) 2012 Google Inc.
*
* This library is free software; you can redistribute it and/or
* modify it under the terms of the GNU Library General Public
@@ -176,10 +177,12 @@
affectedAttributes.append(next);
}
-void RenderSVGText::textDOMChanged()
+void RenderSVGText::invalidateTextPositioningElements()
{
- if (m_needsPositioningValuesUpdate)
- return;
+ // Clear the text positioning elements. This should be called when either the children
+ // of a DOM text element have changed, or the length of the text in any child element
+ // has changed. Failure to clear may leave us with invalid elements, as other code paths
+ // do not always cause the position elements to be marked invalid before use.
m_layoutAttributesBuilder.clearTextPositioningElements();
}
Modified: branches/chromium/1025/Source/WebCore/rendering/svg/RenderSVGText.h (112620 => 112621)
--- branches/chromium/1025/Source/WebCore/rendering/svg/RenderSVGText.h 2012-03-30 00:26:27 UTC (rev 112620)
+++ branches/chromium/1025/Source/WebCore/rendering/svg/RenderSVGText.h 2012-03-30 00:29:39 UTC (rev 112621)
@@ -48,7 +48,10 @@
bool needsReordering() const { return m_needsReordering; }
- void textDOMChanged();
+ // Call this method when either the children of a DOM text element have changed, or the length of
+ // the text in any child element has changed.
+ void invalidateTextPositioningElements();
+
void layoutAttributesChanged(RenderObject*);
void layoutAttributesWillBeDestroyed(RenderSVGInlineText*, Vector<SVGTextLayoutAttributes*>& affectedAttributes);
void rebuildLayoutAttributes(bool performFullRebuild = false);
Modified: branches/chromium/1025/Source/WebCore/svg/SVGAElement.cpp (112620 => 112621)
--- branches/chromium/1025/Source/WebCore/svg/SVGAElement.cpp 2012-03-30 00:26:27 UTC (rev 112620)
+++ branches/chromium/1025/Source/WebCore/svg/SVGAElement.cpp 2012-03-30 00:29:39 UTC (rev 112621)
@@ -247,7 +247,7 @@
// Invalidate the TextPosition cache in SVGTextLayoutAttributesBuilder as it may now point
// to no-longer existing SVGTextPositioningElements and thus needs to be rebuilt.
if (RenderSVGText* textRenderer = RenderSVGText::locateRenderSVGTextAncestor(renderer()))
- textRenderer->textDOMChanged();
+ textRenderer->invalidateTextPositioningElements();
}
} // namespace WebCore
Modified: branches/chromium/1025/Source/WebCore/svg/SVGTextContentElement.cpp (112620 => 112621)
--- branches/chromium/1025/Source/WebCore/svg/SVGTextContentElement.cpp 2012-03-30 00:26:27 UTC (rev 112620)
+++ branches/chromium/1025/Source/WebCore/svg/SVGTextContentElement.cpp 2012-03-30 00:29:39 UTC (rev 112621)
@@ -318,7 +318,7 @@
// Invalidate the TextPosition cache in SVGTextLayoutAttributesBuilder as it may now point
// to no-longer existing SVGTextPositioningElements and thus needs to be rebuilt.
if (RenderSVGText* textRenderer = RenderSVGText::locateRenderSVGTextAncestor(renderer()))
- textRenderer->textDOMChanged();
+ textRenderer->invalidateTextPositioningElements();
}
}
