Title: [145627] branches/safari-536.30-branch
- Revision
- 145627
- Author
- [email protected]
- Date
- 2013-03-12 17:16:24 -0700 (Tue, 12 Mar 2013)
Log Message
Merged r135719. <rdar://problem/13334904>
Modified Paths
Added Paths
Diff
Modified: branches/safari-536.30-branch/LayoutTests/ChangeLog (145626 => 145627)
--- branches/safari-536.30-branch/LayoutTests/ChangeLog 2013-03-13 00:14:07 UTC (rev 145626)
+++ branches/safari-536.30-branch/LayoutTests/ChangeLog 2013-03-13 00:16:24 UTC (rev 145627)
@@ -1,5 +1,19 @@
2013-03-12 Lucas Forschler <[email protected]>
+ Merge r135719
+
+ 2012-11-26 Florin Malita <[email protected]>
+
+ RenderSVGResourceContainer does not clear cached data on removal
+ https://bugs.webkit.org/show_bug.cgi?id=102620
+
+ Reviewed by Dirk Schulze.
+
+ * svg/custom/stale-resource-data-crash-expected.txt: Added.
+ * svg/custom/stale-resource-data-crash.svg: Added.
+
+2013-03-12 Lucas Forschler <[email protected]>
+
Merge r135478
2012-11-21 Cosmin Truta <[email protected]>
Copied: branches/safari-536.30-branch/LayoutTests/svg/custom/stale-resource-data-crash-expected.txt (from rev 135719, trunk/LayoutTests/svg/custom/stale-resource-data-crash-expected.txt) (0 => 145627)
--- branches/safari-536.30-branch/LayoutTests/svg/custom/stale-resource-data-crash-expected.txt (rev 0)
+++ branches/safari-536.30-branch/LayoutTests/svg/custom/stale-resource-data-crash-expected.txt 2013-03-13 00:16:24 UTC (rev 145627)
@@ -0,0 +1,2 @@
+PASS: did not crash.
+
Copied: branches/safari-536.30-branch/LayoutTests/svg/custom/stale-resource-data-crash.svg (from rev 135719, trunk/LayoutTests/svg/custom/stale-resource-data-crash.svg) (0 => 145627)
--- branches/safari-536.30-branch/LayoutTests/svg/custom/stale-resource-data-crash.svg (rev 0)
+++ branches/safari-536.30-branch/LayoutTests/svg/custom/stale-resource-data-crash.svg 2013-03-13 00:16:24 UTC (rev 145627)
@@ -0,0 +1,32 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<svg id="svg" xmlns:xlink="http://www.w3.org/1999/xlink" xmlns="http://www.w3.org/2000/svg">
+ <defs id="defs">
+ <filter id="f1">
+ <feDiffuseLighting>
+ <feDistantLight azimuth="45" id="light"/>
+ </feDiffuseLighting>
+ </filter>
+ <filter id="f2"/>
+ </defs>
+ <image id="img" filter="url(#f1)" xlink:href=""
+
+ <text>PASS: did not crash.</text>
+
+ <script>
+ f2 = document.getElementById('f2');
+ docElement = document.getElementById('svg');
+ light = document.getElementById('light');
+ newDefs = document.getElementById('defs').cloneNode(true);
+
+ if (window.testRunner) {
+ testRunner.dumpAsText();
+ // Force a paint at this point to generate cached filter results.
+ testRunner.display();
+ }
+
+ docElement.appendChild(newDefs);
+ docElement.appendChild(f2);
+ docElement.offsetTop;
+ light.removeAttribute('azimuth');
+ </script>
+</svg>
Modified: branches/safari-536.30-branch/Source/WebCore/ChangeLog (145626 => 145627)
--- branches/safari-536.30-branch/Source/WebCore/ChangeLog 2013-03-13 00:14:07 UTC (rev 145626)
+++ branches/safari-536.30-branch/Source/WebCore/ChangeLog 2013-03-13 00:16:24 UTC (rev 145627)
@@ -1,5 +1,24 @@
2013-03-12 Lucas Forschler <[email protected]>
+ Merge r135719
+
+ 2012-11-26 Florin Malita <[email protected]>
+
+ RenderSVGResourceContainer does not clear cached data on removal
+ https://bugs.webkit.org/show_bug.cgi?id=102620
+
+ Reviewed by Dirk Schulze.
+
+ RenderSVGResourceContainer::removeClient needs to also remove the client from specialized
+ caches, otherwise we can end up with stale references.
+
+ Test: svg/custom/stale-resource-data-crash.svg
+
+ * rendering/svg/RenderSVGResourceContainer.cpp:
+ (WebCore::RenderSVGResourceContainer::removeClient):
+
+2013-03-12 Lucas Forschler <[email protected]>
+
Merge r135478
2012-11-21 Cosmin Truta <[email protected]>
Modified: branches/safari-536.30-branch/Source/WebCore/rendering/svg/RenderSVGResourceContainer.cpp (145626 => 145627)
--- branches/safari-536.30-branch/Source/WebCore/rendering/svg/RenderSVGResourceContainer.cpp 2013-03-13 00:14:07 UTC (rev 145626)
+++ branches/safari-536.30-branch/Source/WebCore/rendering/svg/RenderSVGResourceContainer.cpp 2013-03-13 00:16:24 UTC (rev 145627)
@@ -141,6 +141,7 @@
void RenderSVGResourceContainer::removeClient(RenderObject* client)
{
ASSERT(client);
+ removeClientFromCache(client, false);
m_clients.remove(client);
}
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
