Title: [131631] trunk
- Revision
- 131631
- Author
- [email protected]
- Date
- 2012-10-17 13:07:57 -0700 (Wed, 17 Oct 2012)
Log Message
Allow lazy initialization of SVG XML animated properties.
https://bugs.webkit.org/show_bug.cgi?id=84657
Reviewed by Tim Horton.
Source/WebCore:
When animating a property in the shadow tree, instance properties and tearoffs are created
but they simply reference the animated element's animating properties.
When starting an animation for the first time (see SVGAnimateElement::resetAnimatedType),
we initialize the root property and instance properties using startAnimValAnimation(...).
If an instance property is added while the root property is animating, this initialization
will not occur and we crash.
This patch updates the resetAnimValToBaseVal codepath to start (and initialize) an animated
property if it is not already animating. After this patch, instance properties can be added
in the middle of animation and they will be properly started/initialized.
Test: svg/animations/use-while-animating-crash.html
* svg/SVGAnimatedTypeAnimator.h:
(WebCore::SVGAnimatedTypeAnimator::resetFromBaseValue):
(WebCore::SVGAnimatedTypeAnimator::resetFromBaseValues):
(WebCore::SVGAnimatedTypeAnimator::executeAction):
LayoutTests:
* platform/mac/svg/animations/use-while-animating-crash-expected.txt: Added.
* svg/animations/use-while-animating-crash.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (131630 => 131631)
--- trunk/LayoutTests/ChangeLog 2012-10-17 19:47:19 UTC (rev 131630)
+++ trunk/LayoutTests/ChangeLog 2012-10-17 20:07:57 UTC (rev 131631)
@@ -1,3 +1,13 @@
+2012-10-17 Philip Rogers <[email protected]>
+
+ Allow lazy initialization of SVG XML animated properties.
+ https://bugs.webkit.org/show_bug.cgi?id=84657
+
+ Reviewed by Tim Horton.
+
+ * platform/mac/svg/animations/use-while-animating-crash-expected.txt: Added.
+ * svg/animations/use-while-animating-crash.html: Added.
+
2012-10-17 Dan Carney <[email protected]>
Bind isolatedWorldSecurityOrigin to world
Added: trunk/LayoutTests/platform/mac/svg/animations/use-while-animating-crash-expected.txt (0 => 131631)
--- trunk/LayoutTests/platform/mac/svg/animations/use-while-animating-crash-expected.txt (rev 0)
+++ trunk/LayoutTests/platform/mac/svg/animations/use-while-animating-crash-expected.txt 2012-10-17 20:07:57 UTC (rev 131631)
@@ -0,0 +1 @@
+PASS
Added: trunk/LayoutTests/svg/animations/use-while-animating-crash.html (0 => 131631)
--- trunk/LayoutTests/svg/animations/use-while-animating-crash.html (rev 0)
+++ trunk/LayoutTests/svg/animations/use-while-animating-crash.html 2012-10-17 20:07:57 UTC (rev 131631)
@@ -0,0 +1,39 @@
+<!DOCTYPE html>
+<!-- Test for WK84657 - Test passes if the SVG animation does not crash and "PASS" is printed. -->
+<html>
+<head>
+<script>
+ function crash() {
+ var useRectElement = document.getElementById('useRect');
+ useRectElement.setAttributeNS("http://www.w3.org/1999/xlink", "href", "#rect");
+ }
+ function startTest() {
+ if (window.testRunner) {
+ testRunner.waitUntilDone();
+ testRunner.dumpAsText();
+ }
+ var svgElement = document.getElementById('svg');
+ window.setTimeout(function() {
+ crash();
+ window.setTimeout(function() {
+ svgElement.setCurrentTime(100);
+ document.write("PASS");
+ if (window.testRunner)
+ testRunner.notifyDone();
+ }, 20); // This needs to be at least 20 to ensure an animation cycle runs.
+ }, 1);
+ }
+</script>
+</head>
+<body _onload_="startTest()">
+<svg id="svg" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
+ <defs>
+ <rect id="rect" x="100px" y="100px" width="100px" height="100px" fill="green">
+ <animate attributeName="x" from="100" to="0" begin="0s" dur="5s" repeatCount="1"/>
+ </rect>
+ </defs>
+ <use x="100px" y="100px" xlink:href=""
+ <use id="useRect" x="100px" y="200px"/>
+</svg>
+</body>
+</html>
Modified: trunk/Source/WebCore/ChangeLog (131630 => 131631)
--- trunk/Source/WebCore/ChangeLog 2012-10-17 19:47:19 UTC (rev 131630)
+++ trunk/Source/WebCore/ChangeLog 2012-10-17 20:07:57 UTC (rev 131631)
@@ -1,3 +1,29 @@
+2012-10-17 Philip Rogers <[email protected]>
+
+ Allow lazy initialization of SVG XML animated properties.
+ https://bugs.webkit.org/show_bug.cgi?id=84657
+
+ Reviewed by Tim Horton.
+
+ When animating a property in the shadow tree, instance properties and tearoffs are created
+ but they simply reference the animated element's animating properties.
+
+ When starting an animation for the first time (see SVGAnimateElement::resetAnimatedType),
+ we initialize the root property and instance properties using startAnimValAnimation(...).
+ If an instance property is added while the root property is animating, this initialization
+ will not occur and we crash.
+
+ This patch updates the resetAnimValToBaseVal codepath to start (and initialize) an animated
+ property if it is not already animating. After this patch, instance properties can be added
+ in the middle of animation and they will be properly started/initialized.
+
+ Test: svg/animations/use-while-animating-crash.html
+
+ * svg/SVGAnimatedTypeAnimator.h:
+ (WebCore::SVGAnimatedTypeAnimator::resetFromBaseValue):
+ (WebCore::SVGAnimatedTypeAnimator::resetFromBaseValues):
+ (WebCore::SVGAnimatedTypeAnimator::executeAction):
+
2012-10-17 Dan Carney <[email protected]>
Bind isolatedWorldSecurityOrigin to world
Modified: trunk/Source/WebCore/svg/SVGAnimatedTypeAnimator.h (131630 => 131631)
--- trunk/Source/WebCore/svg/SVGAnimatedTypeAnimator.h 2012-10-17 19:47:19 UTC (rev 131630)
+++ trunk/Source/WebCore/svg/SVGAnimatedTypeAnimator.h 2012-10-17 20:07:57 UTC (rev 131631)
@@ -150,7 +150,10 @@
ASSERT(animatedTypes[0].properties.size() == 1);
ASSERT(type);
ASSERT(type->type() == m_type);
- (type->*getter)() = castAnimatedPropertyToActualType<AnimValType>(animatedTypes[0].properties[0].get())->currentBaseValue();
+ typename AnimValType::ContentType& animatedTypeValue = (type->*getter)();
+ animatedTypeValue = castAnimatedPropertyToActualType<AnimValType>(animatedTypes[0].properties[0].get())->currentBaseValue();
+
+ executeAction<AnimValType>(StartAnimationAction, animatedTypes, 0, &animatedTypeValue);
}
template<typename AnimValType>
@@ -198,6 +201,9 @@
pair<typename AnimValType1::ContentType, typename AnimValType2::ContentType>& animatedTypeValue = (type->*getter)();
animatedTypeValue.first = castAnimatedPropertyToActualType<AnimValType1>(animatedTypes[0].properties[0].get())->currentBaseValue();
animatedTypeValue.second = castAnimatedPropertyToActualType<AnimValType2>(animatedTypes[0].properties[1].get())->currentBaseValue();
+
+ executeAction<AnimValType1>(StartAnimationAction, animatedTypes, 0, &animatedTypeValue.first);
+ executeAction<AnimValType2>(StartAnimationAction, animatedTypes, 1, &animatedTypeValue.second);
}
template<typename AnimValType1, typename AnimValType2>
@@ -262,7 +268,8 @@
switch (action) {
case StartAnimationAction:
ASSERT(type);
- property->animationStarted(type);
+ if (!property->isAnimating())
+ property->animationStarted(type);
break;
case StopAnimationAction:
ASSERT(!type);
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo/webkit-changes
