Title: [120731] trunk
- Revision
- 120731
- Author
- [email protected]
- Date
- 2012-06-19 10:43:22 -0700 (Tue, 19 Jun 2012)
Log Message
Crash in WebCore::RenderSVGModelObject::checkIntersection
https://bugs.webkit.org/show_bug.cgi?id=89059
Reviewed by Rob Buis.
Source/WebCore:
getElementCTM updates layout causing the renderer to be destroyed. We get
the new renderer by storing the element pointer and later accessing it using
the element pointer.
Test: svg/custom/intersection-list-crash.svg
* rendering/svg/RenderSVGModelObject.cpp:
(WebCore::RenderSVGModelObject::checkIntersection):
(WebCore::RenderSVGModelObject::checkEnclosure):
LayoutTests:
* svg/custom/intersection-list-crash-expected.txt: Added.
* svg/custom/intersection-list-crash.svg: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (120730 => 120731)
--- trunk/LayoutTests/ChangeLog 2012-06-19 17:38:20 UTC (rev 120730)
+++ trunk/LayoutTests/ChangeLog 2012-06-19 17:43:22 UTC (rev 120731)
@@ -1,3 +1,13 @@
+2012-06-19 Abhishek Arya <[email protected]>
+
+ Crash in WebCore::RenderSVGModelObject::checkIntersection
+ https://bugs.webkit.org/show_bug.cgi?id=89059
+
+ Reviewed by Rob Buis.
+
+ * svg/custom/intersection-list-crash-expected.txt: Added.
+ * svg/custom/intersection-list-crash.svg: Added.
+
2012-06-19 Dan Bernstein <[email protected]>
Paginated display API doesn’t allow setting the page progression direction
Added: trunk/LayoutTests/svg/custom/intersection-list-crash-expected.txt (0 => 120731)
--- trunk/LayoutTests/svg/custom/intersection-list-crash-expected.txt (rev 0)
+++ trunk/LayoutTests/svg/custom/intersection-list-crash-expected.txt 2012-06-19 17:43:22 UTC (rev 120731)
@@ -0,0 +1 @@
+PASS. WebKit didn't crash.
Added: trunk/LayoutTests/svg/custom/intersection-list-crash.svg (0 => 120731)
--- trunk/LayoutTests/svg/custom/intersection-list-crash.svg (rev 0)
+++ trunk/LayoutTests/svg/custom/intersection-list-crash.svg 2012-06-19 17:43:22 UTC (rev 120731)
@@ -0,0 +1,26 @@
+<svg _onload_="runTest()" xmlns="http://www.w3.org/2000/svg" id="askedForIntersection">
+<style>
+.c1:nth-last-of-type(1n) { }
+</style>
+<script>
+if (window.layoutTestController)
+ layoutTestController.dumpAsText();
+
+function runTest()
+{
+ docElement = document.documentElement;
+ textarea = document.createElementNS("http://www.w3.org/1999/xhtml", "textarea");
+ textarea.setAttribute("class", "c1");
+ docElement.appendChild(textarea);
+ object = document.createElementNS("http://www.w3.org/1999/xhtml", "object");
+ object.setAttribute("usemap", "#DivLogo-map");
+ iframe = document.createElementNS("http://www.w3.org/1999/xhtml", "iframe");
+ docElement.appendChild(iframe);
+ var svg = document.getElementById('askedForIntersection');
+ var rect = svg.createSVGRect();
+ svg.getIntersectionList(rect, svg);
+}
+</script>
+<rect style='content: counters(c, ".", decimal)'></rect>
+<text x="10" y="50">PASS. WebKit didn't crash.</text>
+</svg>
Property changes on: trunk/LayoutTests/svg/custom/intersection-list-crash.svg
___________________________________________________________________
Added: svn:executable
Modified: trunk/Source/WebCore/ChangeLog (120730 => 120731)
--- trunk/Source/WebCore/ChangeLog 2012-06-19 17:38:20 UTC (rev 120730)
+++ trunk/Source/WebCore/ChangeLog 2012-06-19 17:43:22 UTC (rev 120731)
@@ -1,3 +1,20 @@
+2012-06-19 Abhishek Arya <[email protected]>
+
+ Crash in WebCore::RenderSVGModelObject::checkIntersection
+ https://bugs.webkit.org/show_bug.cgi?id=89059
+
+ Reviewed by Rob Buis.
+
+ getElementCTM updates layout causing the renderer to be destroyed. We get
+ the new renderer by storing the element pointer and later accessing it using
+ the element pointer.
+
+ Test: svg/custom/intersection-list-crash.svg
+
+ * rendering/svg/RenderSVGModelObject.cpp:
+ (WebCore::RenderSVGModelObject::checkIntersection):
+ (WebCore::RenderSVGModelObject::checkEnclosure):
+
2012-06-13 Eric Uhrhane <[email protected]>
FileWriter progress events should be throttled to 50ms
Modified: trunk/Source/WebCore/rendering/svg/RenderSVGModelObject.cpp (120730 => 120731)
--- trunk/Source/WebCore/rendering/svg/RenderSVGModelObject.cpp 2012-06-19 17:38:20 UTC (rev 120730)
+++ trunk/Source/WebCore/rendering/svg/RenderSVGModelObject.cpp 2012-06-19 17:43:22 UTC (rev 120731)
@@ -171,8 +171,10 @@
if (!isGraphicsElement(renderer))
return false;
AffineTransform ctm;
- getElementCTM(static_cast<SVGElement*>(renderer->node()), ctm);
- return intersectsAllowingEmpty(rect, ctm.mapRect(renderer->repaintRectInLocalCoordinates()));
+ SVGElement* svgElement = static_cast<SVGElement*>(renderer->node());
+ getElementCTM(svgElement, ctm);
+ ASSERT(svgElement->renderer());
+ return intersectsAllowingEmpty(rect, ctm.mapRect(svgElement->renderer()->repaintRectInLocalCoordinates()));
}
bool RenderSVGModelObject::checkEnclosure(RenderObject* renderer, const FloatRect& rect)
@@ -182,8 +184,10 @@
if (!isGraphicsElement(renderer))
return false;
AffineTransform ctm;
- getElementCTM(static_cast<SVGElement*>(renderer->node()), ctm);
- return rect.contains(ctm.mapRect(renderer->repaintRectInLocalCoordinates()));
+ SVGElement* svgElement = static_cast<SVGElement*>(renderer->node());
+ getElementCTM(svgElement, ctm);
+ ASSERT(svgElement->renderer());
+ return rect.contains(ctm.mapRect(svgElement->renderer()->repaintRectInLocalCoordinates()));
}
} // namespace WebCore
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
