Diff
Deleted: branches/chromium/1025/LayoutTests/svg/custom/delete-text-crash-expected.png
(Binary files differ)
Modified: branches/chromium/1025/LayoutTests/svg/custom/delete-text-crash-expected.txt (112625 => 112626)
--- branches/chromium/1025/LayoutTests/svg/custom/delete-text-crash-expected.txt 2012-03-30 00:44:10 UTC (rev 112625)
+++ branches/chromium/1025/LayoutTests/svg/custom/delete-text-crash-expected.txt 2012-03-30 01:01:22 UTC (rev 112626)
@@ -1,14 +1,2 @@
-layer at (0,0) size 800x616
- RenderView at (0,0) size 800x600
-layer at (0,0) size 800x616
- RenderBlock {HTML} at (0,0) size 800x616
- RenderBody {BODY} at (8,8) size 784x600
- RenderSVGRoot {svg} at (8,8) size 16x4
- RenderSVGContainer {g} at (8,8) size 16x4
- RenderSVGRect {rect} at (8,8) size 0x0 [fill={[type=SOLID] [color=#000000]}] [x=0.00] [y=0.00] [width=0.00] [height=0.00]
- [filter="x"] RenderSVGResourceFilter {filter} at (-78.40,-60) size 940.80x720
- RenderSVGText {text} at (0,-15) size 14x19 contains 1 chunk(s)
- RenderSVGInlineText {#text} at (0,0) size 0x0
- RenderSVGResourceFilter {filter} [id="x"] [filterUnits=objectBoundingBox] [primitiveUnits=userSpaceOnUse]
- RenderText {#text} at (0,0) size 0x0
-caret: position 1 of child 0 {#text} of child 3 {text} of child 1 {g} of child 1 {svg} of body
+abb
+
Modified: branches/chromium/1025/LayoutTests/svg/custom/delete-text-crash.html (112625 => 112626)
--- branches/chromium/1025/LayoutTests/svg/custom/delete-text-crash.html 2012-03-30 00:44:10 UTC (rev 112625)
+++ branches/chromium/1025/LayoutTests/svg/custom/delete-text-crash.html 2012-03-30 01:01:22 UTC (rev 112626)
@@ -1,7 +1,5 @@
<html>
<!-- This test passes if there is no crash or assert -->
-<!-- This test should be updated to use DumpAsText once WK81006 is fixed -->
-<!-- The style overflow should be removed once we migrate to DumpAsText as well -->
<style type="text/css">
body {
overflow: hidden;
@@ -16,7 +14,10 @@
document.designMode='on';
document.execCommand('delete');
document.execCommand('delete');
- }
+ }
+
+ if (window.layoutTestController)
+ layoutTestController.dumpAsText();
</script>
<body _onload_="testCrash()">
<svg id="root" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
Copied: branches/chromium/1025/LayoutTests/svg/custom/delete-text-innerText-crash-expected.txt (from rev 111601, trunk/LayoutTests/svg/custom/delete-text-innerText-crash-expected.txt) (0 => 112626)
--- branches/chromium/1025/LayoutTests/svg/custom/delete-text-innerText-crash-expected.txt (rev 0)
+++ branches/chromium/1025/LayoutTests/svg/custom/delete-text-innerText-crash-expected.txt 2012-03-30 01:01:22 UTC (rev 112626)
@@ -0,0 +1,3 @@
+This test passes if there is no crash or assert.
+abb
+
Copied: branches/chromium/1025/LayoutTests/svg/custom/delete-text-innerText-crash.html (from rev 111601, trunk/LayoutTests/svg/custom/delete-text-innerText-crash.html) (0 => 112626)
--- branches/chromium/1025/LayoutTests/svg/custom/delete-text-innerText-crash.html (rev 0)
+++ branches/chromium/1025/LayoutTests/svg/custom/delete-text-innerText-crash.html 2012-03-30 01:01:22 UTC (rev 112626)
@@ -0,0 +1,29 @@
+<html>
+<script>
+ function testCrash() {
+ q = document.getElementById('root');
+ r = document.createRange();
+ r.selectNodeContents( q.getElementById('t') );
+ window.getSelection().addRange(r)
+ document.designMode='on';
+ document.execCommand('delete');
+ document.execCommand('delete');
+
+ if (window.layoutTestController)
+ layoutTestController.dumpAsText();
+ }
+</script>
+<body _onload_="testCrash()">
+This test passes if there is no crash or assert.<br/>
+<svg id="root" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
+ <g>
+ <rect filter="url(#x)"/>
+ <text>aa</text>
+ <rect id="t"/>
+ <style></style>
+ <text>bb</text>
+ </g>
+ <filter id="x"></filter>
+</svg>
+</body>
+</html>
Modified: branches/chromium/1025/Source/WebCore/rendering/svg/RenderSVGResourceContainer.cpp (112625 => 112626)
--- branches/chromium/1025/Source/WebCore/rendering/svg/RenderSVGResourceContainer.cpp 2012-03-30 00:44:10 UTC (rev 112625)
+++ branches/chromium/1025/Source/WebCore/rendering/svg/RenderSVGResourceContainer.cpp 2012-03-30 01:01:22 UTC (rev 112626)
@@ -22,7 +22,7 @@
#if ENABLE(SVG)
#include "RenderSVGResourceContainer.h"
-#include "RenderSVGShadowTreeRootContainer.h"
+#include "RenderSVGRoot.h"
#include "RenderView.h"
#include "SVGResourcesCache.h"
#include "SVGStyledTransformableElement.h"
@@ -54,7 +54,7 @@
{
// Invalidate all resources if our layout changed.
if (everHadLayout() && selfNeedsLayout())
- removeAllClientsFromCache();
+ RenderSVGRoot::addResourceForClientInvalidation(this);
RenderSVGHiddenContainer::layout();
}
Modified: branches/chromium/1025/Source/WebCore/rendering/svg/RenderSVGResourceMarker.cpp (112625 => 112626)
--- branches/chromium/1025/Source/WebCore/rendering/svg/RenderSVGResourceMarker.cpp 2012-03-30 00:44:10 UTC (rev 112625)
+++ branches/chromium/1025/Source/WebCore/rendering/svg/RenderSVGResourceMarker.cpp 2012-03-30 01:01:22 UTC (rev 112626)
@@ -26,6 +26,7 @@
#include "GraphicsContext.h"
#include "RenderSVGContainer.h"
+#include "RenderSVGRoot.h"
#include "SVGElement.h"
#include "SVGMarkerElement.h"
#include "SVGRenderSupport.h"
@@ -49,7 +50,7 @@
{
// Invalidate all resources if our layout changed.
if (everHadLayout() && selfNeedsLayout())
- removeAllClientsFromCache();
+ RenderSVGRoot::addResourceForClientInvalidation(this);
// RenderSVGHiddenContainer overwrites layout(). We need the
// layouting of RenderSVGContainer for calculating local
Modified: branches/chromium/1025/Source/WebCore/rendering/svg/RenderSVGRoot.cpp (112625 => 112626)
--- branches/chromium/1025/Source/WebCore/rendering/svg/RenderSVGRoot.cpp 2012-03-30 00:44:10 UTC (rev 112625)
+++ branches/chromium/1025/Source/WebCore/rendering/svg/RenderSVGRoot.cpp 2012-03-30 01:01:22 UTC (rev 112626)
@@ -212,6 +212,8 @@
{
ASSERT(needsLayout());
+ m_resourcesNeedingToInvalidateClients.clear();
+
// Arbitrary affine transforms are incompatible with LayoutState.
LayoutStateDisabler layoutStateDisabler(view());
@@ -228,6 +230,16 @@
SVGRenderSupport::layoutChildren(this, needsLayout || SVGRenderSupport::filtersForceContainerLayout(this));
m_isLayoutSizeChanged = false;
+ if (!m_resourcesNeedingToInvalidateClients.isEmpty()) {
+ // Invalidate resource clients, which may mark some nodes for layout.
+ HashSet<RenderSVGResourceContainer*>::iterator end = m_resourcesNeedingToInvalidateClients.end();
+ for (HashSet<RenderSVGResourceContainer*>::iterator it = m_resourcesNeedingToInvalidateClients.begin(); it != end; ++it)
+ (*it)->removeAllClientsFromCache();
+
+ m_isLayoutSizeChanged = false;
+ SVGRenderSupport::layoutChildren(this, false);
+ }
+
// At this point LayoutRepainter already grabbed the old bounds,
// recalculate them now so repaintAfterLayout() uses the new bounds.
if (m_needsBoundariesOrTransformUpdate) {
@@ -419,6 +431,16 @@
return svg->intrinsicHeight(SVGSVGElement::IgnoreCSSProperties).isPercent() || svg->intrinsicWidth(SVGSVGElement::IgnoreCSSProperties).isPercent();
}
+void RenderSVGRoot::addResourceForClientInvalidation(RenderSVGResourceContainer* resource)
+{
+ RenderObject* svgRoot = resource->parent();
+ while (svgRoot && !svgRoot->isSVGRoot())
+ svgRoot = svgRoot->parent();
+ if (!svgRoot)
+ return;
+ static_cast<RenderSVGRoot*>(svgRoot)->m_resourcesNeedingToInvalidateClients.add(resource);
}
+}
+
#endif // ENABLE(SVG)
Modified: branches/chromium/1025/Source/WebCore/rendering/svg/RenderSVGRoot.h (112625 => 112626)
--- branches/chromium/1025/Source/WebCore/rendering/svg/RenderSVGRoot.h 2012-03-30 00:44:10 UTC (rev 112625)
+++ branches/chromium/1025/Source/WebCore/rendering/svg/RenderSVGRoot.h 2012-03-30 01:01:22 UTC (rev 112626)
@@ -55,6 +55,10 @@
virtual bool hasRelativeDimensions() const;
+ // The flag is cleared at the beginning of each layout() pass. Elements then call this
+ // method during layout when they are invalidated by a filter.
+ static void addResourceForClientInvalidation(RenderSVGResourceContainer*);
+
private:
virtual RenderObjectChildList* virtualChildren() { return children(); }
virtual const RenderObjectChildList* virtualChildren() const { return children(); }
@@ -100,6 +104,7 @@
FloatRect m_repaintBoundingBox;
mutable AffineTransform m_localToParentTransform;
AffineTransform m_localToBorderBoxTransform;
+ HashSet<RenderSVGResourceContainer*> m_resourcesNeedingToInvalidateClients;
bool m_isLayoutSizeChanged : 1;
bool m_needsBoundariesOrTransformUpdate : 1;
};
