Title: [120762] branches/chromium/1132
- Revision
- 120762
- Author
- [email protected]
- Date
- 2012-06-19 15:46:56 -0700 (Tue, 19 Jun 2012)
Log Message
Merge 120559
BUG=130356
Review URL: https://chromiumcodereview.appspot.com/10536212
Modified Paths
Added Paths
Diff
Copied: branches/chromium/1132/LayoutTests/svg/text/textpath-reference-crash-expected.txt (from rev 120559, trunk/LayoutTests/svg/text/textpath-reference-crash-expected.txt) (0 => 120762)
--- branches/chromium/1132/LayoutTests/svg/text/textpath-reference-crash-expected.txt (rev 0)
+++ branches/chromium/1132/LayoutTests/svg/text/textpath-reference-crash-expected.txt 2012-06-19 22:46:56 UTC (rev 120762)
@@ -0,0 +1 @@
+PASS
Copied: branches/chromium/1132/LayoutTests/svg/text/textpath-reference-crash.html (from rev 120559, trunk/LayoutTests/svg/text/textpath-reference-crash.html) (0 => 120762)
--- branches/chromium/1132/LayoutTests/svg/text/textpath-reference-crash.html (rev 0)
+++ branches/chromium/1132/LayoutTests/svg/text/textpath-reference-crash.html 2012-06-19 22:46:56 UTC (rev 120762)
@@ -0,0 +1,49 @@
+<!DOCTYPE html>
+<html>
+ <!-- Test for wkbug.com/88144 - Crash in SVGDocumentExtensions::removeAllElementReferencesForTarget. -->
+ <head>
+ <script>
+ if (window.layoutTestController)
+ layoutTestController.dumpAsText();
+
+ window._onload_ = function() {
+ svg0 = document.createElementNS('http://www.w3.org/2000/svg', 'svg');
+ svg0.setAttribute('id', 'svg0');
+ document.body.appendChild(svg0);
+
+ document.body.appendChild(document.createTextNode('A'));
+
+ svg1 = document.createElementNS('http://www.w3.org/2000/svg', 'svg');
+ svg1.setAttribute('id', 'svg1');
+ svg1.appendChild(document.createTextNode('A'));
+ document.body.appendChild(svg1);
+
+ document.body.appendChild(document.createTextNode('A'));
+
+ image = document.createElementNS('http://www.w3.org/2000/svg', 'image');
+ image.setAttribute('id', 'image');
+ svg0.appendChild(image);
+
+ textPath = document.createElementNS('http://www.w3.org/2000/svg', 'textPath');
+ textPath.setAttributeNS('http://www.w3.org/1999/xlink', 'xlink:href', '#svg1');
+ textPath.setAttribute('id', 'textPath');
+ image.appendChild(textPath);
+
+ use = document.createElementNS('http://www.w3.org/2000/svg', 'use');
+ use.setAttributeNS('http://www.w3.org/1999/xlink', 'xlink:href', '#image');
+ use.setAttribute('id', 'use');
+ svg0.appendChild(use);
+
+ image.setAttributeNS('http://www.w3.org/1999/xlink', 'xlink:href', '#svg0');
+ document.designMode = 'on';
+ window.getSelection().setBaseAndExtent(svg1, 0, svg1, 0);
+ document.execCommand('ForwardDelete');
+
+ document.body.offsetTop;
+ document.body.innerHTML = "PASS";
+ }
+ </script>
+ </head>
+ <body>
+ </body>
+</html>
Modified: branches/chromium/1132/Source/WebCore/svg/SVGDocumentExtensions.cpp (120761 => 120762)
--- branches/chromium/1132/Source/WebCore/svg/SVGDocumentExtensions.cpp 2012-06-19 22:34:55 UTC (rev 120761)
+++ branches/chromium/1132/Source/WebCore/svg/SVGDocumentExtensions.cpp 2012-06-19 22:46:56 UTC (rev 120762)
@@ -410,12 +410,17 @@
for (HashSet<SVGElement*>::iterator setIt = referencingElements->begin(); setIt != setEnd; ++setIt)
toBeNotified.append(*setIt);
- m_elementDependencies.remove(it);
-
// Force rebuilding the referencingElement so it knows about this change.
Vector<SVGElement*>::iterator vectorEnd = toBeNotified.end();
- for (Vector<SVGElement*>::iterator vectorIt = toBeNotified.begin(); vectorIt != vectorEnd; ++vectorIt)
- (*vectorIt)->svgAttributeChanged(XLinkNames::hrefAttr);
+ for (Vector<SVGElement*>::iterator vectorIt = toBeNotified.begin(); vectorIt != vectorEnd; ++vectorIt) {
+ // Before rebuilding referencingElement ensure it was not removed from under us.
+ if (HashSet<SVGElement*>* referencingElements = setOfElementsReferencingTarget(referencedElement)) {
+ if (referencingElements->contains(*vectorIt))
+ (*vectorIt)->svgAttributeChanged(XLinkNames::hrefAttr);
+ }
+ }
+
+ m_elementDependencies.remove(referencedElement);
}
#if ENABLE(SVG_FONTS)
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
