Title: [119914] trunk
- Revision
- 119914
- Author
- [email protected]
- Date
- 2012-06-09 12:37:07 -0700 (Sat, 09 Jun 2012)
Log Message
Fixed-position foreignObject descendants should be relative to the foreignObject viewport
https://bugs.webkit.org/show_bug.cgi?id=88547
Reviewed by Abhishek Arya.
Source/WebCore:
Tests: svg/foreignObject/fO-fixed-position-crash.html
svg/foreignObject/fixed-position-expected.svg
svg/foreignObject/fixed-position.svg
Fixed position elements are currently registered with the top level
RenderView even when embedded within an SVG foreignOject. This patch
changes containingBlock() & container() to return the containing
foreignObject renderer instead.
The new foreignObject fixed position behavior matches that of current
FireFox and Opera versions and is consistent with the spec:
http://www.w3.org/TR/CSS2/visuren.html#fixed-positioning
http://www.w3.org/TR/SVG/coords.html#EstablishingANewViewport
* rendering/RenderObject.cpp:
(WebCore::RenderObject::containingBlock):
(WebCore::RenderObject::container):
LayoutTests:
* svg/foreignObject/fO-fixed-position-crash-expected.txt: Added.
* svg/foreignObject/fO-fixed-position-crash.html: Added.
* svg/foreignObject/fixed-position-expected.svg: Added.
* svg/foreignObject/fixed-position.svg: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (119913 => 119914)
--- trunk/LayoutTests/ChangeLog 2012-06-09 19:35:02 UTC (rev 119913)
+++ trunk/LayoutTests/ChangeLog 2012-06-09 19:37:07 UTC (rev 119914)
@@ -1,3 +1,15 @@
+2012-06-09 Florin Malita <[email protected]>
+
+ Fixed-position foreignObject descendants should be relative to the foreignObject viewport
+ https://bugs.webkit.org/show_bug.cgi?id=88547
+
+ Reviewed by Abhishek Arya.
+
+ * svg/foreignObject/fO-fixed-position-crash-expected.txt: Added.
+ * svg/foreignObject/fO-fixed-position-crash.html: Added.
+ * svg/foreignObject/fixed-position-expected.svg: Added.
+ * svg/foreignObject/fixed-position.svg: Added.
+
2012-06-09 Adam Barth <[email protected]>
Can't use eval in iframes sanbdoxed via CSP header
Added: trunk/LayoutTests/svg/foreignObject/fO-fixed-position-crash-expected.txt (0 => 119914)
--- trunk/LayoutTests/svg/foreignObject/fO-fixed-position-crash-expected.txt (rev 0)
+++ trunk/LayoutTests/svg/foreignObject/fO-fixed-position-crash-expected.txt 2012-06-09 19:37:07 UTC (rev 119914)
@@ -0,0 +1 @@
+PASS
Added: trunk/LayoutTests/svg/foreignObject/fO-fixed-position-crash.html (0 => 119914)
--- trunk/LayoutTests/svg/foreignObject/fO-fixed-position-crash.html (rev 0)
+++ trunk/LayoutTests/svg/foreignObject/fO-fixed-position-crash.html 2012-06-09 19:37:07 UTC (rev 119914)
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<html>
+<body>
+<!-- Test for https://bugs.webkit.org/show_bug.cgi?id=88547 -->
+<svg xmlns="http://www.w3.org/2000/svg">
+ <foreignObject>
+ <div id="div" style="position:fixed; height:50%; counter-increment:inherit;">Passes if replacing this text doesn't cause a crash.</div>
+ </foreignObject>
+
+ <script>
+ window._onload_=function() {
+ document.designMode="on";
+ document.execCommand("SelectAll");
+ document.getElementById('div').innerHTML = "PASS";
+ };
+
+ if (window.layoutTestController)
+ layoutTestController.dumpAsText();
+ </script>
+</svg>
+</body>
+</html>
Added: trunk/LayoutTests/svg/foreignObject/fixed-position-expected.svg (0 => 119914)
--- trunk/LayoutTests/svg/foreignObject/fixed-position-expected.svg (rev 0)
+++ trunk/LayoutTests/svg/foreignObject/fixed-position-expected.svg 2012-06-09 19:37:07 UTC (rev 119914)
@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="UTF-8" standalone="no"?>
+<svg xmlns="http://www.w3.org/2000/svg">
+ <rect width="100" height="100" fill="green"/>
+</svg>
Added: trunk/LayoutTests/svg/foreignObject/fixed-position.svg (0 => 119914)
--- trunk/LayoutTests/svg/foreignObject/fixed-position.svg (rev 0)
+++ trunk/LayoutTests/svg/foreignObject/fixed-position.svg 2012-06-09 19:37:07 UTC (rev 119914)
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8" standalone="no"?>
+<svg xmlns="http://www.w3.org/2000/svg">
+ <rect width="98" height="98" fill="red"/>
+ <foreignObject width="200" height="200" transform="translate(-100, 0)">
+ <!-- Fixed-position content should be relative to the foreignObject viewport. -->
+ <div xmlns="http://www.w3.org/1999/xhtml" style="position: fixed; left: 100px; width: 100px; height: 50%; background-color: green;"></div>
+ </foreignObject>
+</svg>
Modified: trunk/Source/WebCore/ChangeLog (119913 => 119914)
--- trunk/Source/WebCore/ChangeLog 2012-06-09 19:35:02 UTC (rev 119913)
+++ trunk/Source/WebCore/ChangeLog 2012-06-09 19:37:07 UTC (rev 119914)
@@ -1,3 +1,28 @@
+2012-06-09 Florin Malita <[email protected]>
+
+ Fixed-position foreignObject descendants should be relative to the foreignObject viewport
+ https://bugs.webkit.org/show_bug.cgi?id=88547
+
+ Reviewed by Abhishek Arya.
+
+ Tests: svg/foreignObject/fO-fixed-position-crash.html
+ svg/foreignObject/fixed-position-expected.svg
+ svg/foreignObject/fixed-position.svg
+
+ Fixed position elements are currently registered with the top level
+ RenderView even when embedded within an SVG foreignOject. This patch
+ changes containingBlock() & container() to return the containing
+ foreignObject renderer instead.
+
+ The new foreignObject fixed position behavior matches that of current
+ FireFox and Opera versions and is consistent with the spec:
+ http://www.w3.org/TR/CSS2/visuren.html#fixed-positioning
+ http://www.w3.org/TR/SVG/coords.html#EstablishingANewViewport
+
+ * rendering/RenderObject.cpp:
+ (WebCore::RenderObject::containingBlock):
+ (WebCore::RenderObject::container):
+
2012-06-09 Adam Barth <[email protected]>
Can't use eval in iframes sanbdoxed via CSP header
Modified: trunk/Source/WebCore/rendering/RenderObject.cpp (119913 => 119914)
--- trunk/Source/WebCore/rendering/RenderObject.cpp 2012-06-09 19:35:02 UTC (rev 119913)
+++ trunk/Source/WebCore/rendering/RenderObject.cpp 2012-06-09 19:37:07 UTC (rev 119914)
@@ -716,8 +716,14 @@
if (!o && isRenderScrollbarPart())
o = toRenderScrollbarPart(this)->rendererOwningScrollbar();
if (!isText() && m_style->position() == FixedPosition) {
- while (o && !o->isRenderView() && !(o->hasTransform() && o->isRenderBlock()))
+ while (o && !o->isRenderView() && !(o->hasTransform() && o->isRenderBlock())) {
+#if ENABLE(SVG)
+ // foreignObject is the containing block for its contents.
+ if (o->isSVGForeignObject())
+ break;
+#endif
o = o->parent();
+ }
} else if (!isText() && m_style->position() == AbsolutePosition) {
while (o && (o->style()->position() == StaticPosition || (o->isInline() && !o->isReplaced())) && !o->isRenderView() && !(o->hasTransform() && o->isRenderBlock())) {
// For relpositioned inlines, we return the nearest non-anonymous enclosing block. We don't try
@@ -2189,6 +2195,11 @@
while (o && o->parent() && !(o->hasTransform() && o->isRenderBlock())) {
if (repaintContainerSkipped && o == repaintContainer)
*repaintContainerSkipped = true;
+#if ENABLE(SVG)
+ // foreignObject is the containing block for its contents.
+ if (o->isSVGForeignObject())
+ break;
+#endif
o = o->parent();
}
} else if (pos == AbsolutePosition) {
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
