Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 68a544edb81fa4c689e1e988175a9db2f2c16811
https://github.com/WebKit/WebKit/commit/68a544edb81fa4c689e1e988175a9db2f2c16811
Author: Ahmad Saleem <[email protected]>
Date: 2026-08-16 (Sun, 16 Aug 2026)
Changed paths:
A
LayoutTests/imported/w3c/web-platform-tests/svg/struct/reftests/reference/use-image-href-mutating-ref.svg
A
LayoutTests/imported/w3c/web-platform-tests/svg/struct/reftests/use-image-href-mutating-expected.svg
A
LayoutTests/imported/w3c/web-platform-tests/svg/struct/reftests/use-image-href-mutating.svg
M Source/WebCore/svg/SVGImageElement.cpp
Log Message:
-----------
Changing href on an <image> referenced by <use> does not update the use
instances
https://bugs.webkit.org/show_bug.cgi?id=320438
rdar://183402463
Reviewed by Nikolas Zimmermann.
This patch aligns WebKit with Gecko / Firefox and Blink / Chromium.
SVGImageElement::svgAttributeChanged() handles href in its own branch, and that
branch does
not take an InstanceInvalidationGuard, so the <use> shadow tree instances are
never rebuilt
and keep the href they were cloned with. Nothing else covers for it: an <image>
inside <defs>
has no renderer of its own, so the updateSVGRendererForElementChange() call in
that branch is
a no-op, and the instances are the only rendered copies. An <image> in <defs>
whose href is
assigned from script therefore stays blank in every <use> that references it,
whether directly
or through a <pattern>.
203463@main (Remove the SVG elements' attributes macros) replaced the single
function-scope
guard, which covered every branch including this one, with per-branch guards,
and did not give
one to the href branch. Take the guard here: SVGFEImageElement and
SVGMPathElement guard their
href branches, SVGGradientElement and SVGPatternElement cover href in the same
condition as
their animated properties, and SVGUseElement guards the whole of
svgAttributeChanged().
The test flushes layout before assigning the href, and that ordering is
load-bearing.
SVGUseElement builds its shadow tree lazily during a style update, so an href
assigned before
the tree exists is already in place when the instance is cloned, and the test
would pass with
or without this change. Forcing the tree to be built first guarantees the
instance has been
cloned from the empty href before it is changed.
The instance's image is loaded through the cloned element's own CachedImage
request, which is
only started once the shadow tree has been regenerated, so it is still
outstanding when the
referenced element's load event fires. The test therefore waits for a rendering
update after
that event rather than sampling immediately, which was flaky on the stress and
site-isolation
queues.
Tests:
imported/w3c/web-platform-tests/svg/struct/reftests/use-image-href-mutating.svg
*
LayoutTests/imported/w3c/web-platform-tests/svg/struct/reftests/reference/use-image-href-mutating-ref.svg:
Added.
*
LayoutTests/imported/w3c/web-platform-tests/svg/struct/reftests/use-image-href-mutating-expected.svg:
Added.
*
LayoutTests/imported/w3c/web-platform-tests/svg/struct/reftests/use-image-href-mutating.svg:
Added.
* Source/WebCore/svg/SVGImageElement.cpp:
(WebCore::SVGImageElement::svgAttributeChanged):
Canonical link: https://commits.webkit.org/319264@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
