Title: [145635] branches/safari-536.30-branch
- Revision
- 145635
- Author
- [email protected]
- Date
- 2013-03-12 17:39:21 -0700 (Tue, 12 Mar 2013)
Log Message
Merged r136541. <rdar://problem/13334913>
Modified Paths
Added Paths
Diff
Modified: branches/safari-536.30-branch/LayoutTests/ChangeLog (145634 => 145635)
--- branches/safari-536.30-branch/LayoutTests/ChangeLog 2013-03-13 00:36:07 UTC (rev 145634)
+++ branches/safari-536.30-branch/LayoutTests/ChangeLog 2013-03-13 00:39:21 UTC (rev 145635)
@@ -1,5 +1,19 @@
2013-03-12 Lucas Forschler <[email protected]>
+ Merge r136541
+
+ 2012-12-04 Florin Malita <[email protected]>
+
+ Stale SVGUseElement reference in CachedResource::checkNotify()
+ https://bugs.webkit.org/show_bug.cgi?id=104004
+
+ Reviewed by Eric Seidel.
+
+ * svg/custom/use-href-update-crash-expected.txt: Added.
+ * svg/custom/use-href-update-crash.svg: Added.
+
+2013-03-12 Lucas Forschler <[email protected]>
+
Merge r136253
2012-11-30 Abhishek Arya <[email protected]>
Copied: branches/safari-536.30-branch/LayoutTests/svg/custom/use-href-update-crash-expected.txt (from rev 136541, trunk/LayoutTests/svg/custom/use-href-update-crash-expected.txt) (0 => 145635)
--- branches/safari-536.30-branch/LayoutTests/svg/custom/use-href-update-crash-expected.txt (rev 0)
+++ branches/safari-536.30-branch/LayoutTests/svg/custom/use-href-update-crash-expected.txt 2013-03-13 00:39:21 UTC (rev 145635)
@@ -0,0 +1 @@
+PASS: did not crash.
Copied: branches/safari-536.30-branch/LayoutTests/svg/custom/use-href-update-crash.svg (from rev 136541, trunk/LayoutTests/svg/custom/use-href-update-crash.svg) (0 => 145635)
--- branches/safari-536.30-branch/LayoutTests/svg/custom/use-href-update-crash.svg (rev 0)
+++ branches/safari-536.30-branch/LayoutTests/svg/custom/use-href-update-crash.svg 2013-03-13 00:39:21 UTC (rev 145635)
@@ -0,0 +1,17 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<svg xmlns:xlink="http://www.w3.org/1999/xlink" xmlns="http://www.w3.org/2000/svg">
+ <!-- Test for https://bugs.webkit.org/show_bug.cgi?id=104004 -->
+ <use id="use" xlink:href=""
+ <text>PASS: did not crash.</text>
+
+ <script>
+ var use = document.getElementById('use');
+ use.setAttribute('xlink:href', 'bar.svg#bar');
+ use.parentNode.removeChild(use);
+ use = null;
+ gc();
+
+ if (window.testRunner)
+ testRunner.dumpAsText();
+ </script>
+</svg>
Modified: branches/safari-536.30-branch/Source/WebCore/ChangeLog (145634 => 145635)
--- branches/safari-536.30-branch/Source/WebCore/ChangeLog 2013-03-13 00:36:07 UTC (rev 145634)
+++ branches/safari-536.30-branch/Source/WebCore/ChangeLog 2013-03-13 00:39:21 UTC (rev 145635)
@@ -1,5 +1,34 @@
2013-03-12 Lucas Forschler <[email protected]>
+ Merge r136541
+
+ 2012-12-04 Florin Malita <[email protected]>
+
+ Stale SVGUseElement reference in CachedResource::checkNotify()
+ https://bugs.webkit.org/show_bug.cgi?id=104004
+
+ Reviewed by Eric Seidel.
+
+ SVGUseElement tracks one CachedSVGDocument at a time (for external references), but when
+ the href attribute is updated it fails to unregister with the current CachedSVGDocument
+ and only updates its CachedSVGDocument with the new instance. This leaves an untracked
+ reference with the original CachedSVGDocument.
+
+ The patch adds the missing removeClient() call on href change, and encapsulates the
+ CachedSVGDocument manipulation in a helper method which handles the necessary cleanup.
+
+ Test: svg/custom/use-href-update-crash.svg
+
+ * svg/SVGUseElement.cpp:
+ (WebCore::SVGUseElement::~SVGUseElement):
+ (WebCore::SVGUseElement::svgAttributeChanged):
+ (WebCore::SVGUseElement::setCachedDocument):
+ (WebCore):
+ * svg/SVGUseElement.h:
+ (SVGUseElement):
+
+2013-03-12 Lucas Forschler <[email protected]>
+
Merge r136253
2012-11-30 Abhishek Arya <[email protected]>
Modified: branches/safari-536.30-branch/Source/WebCore/svg/SVGUseElement.cpp (145634 => 145635)
--- branches/safari-536.30-branch/Source/WebCore/svg/SVGUseElement.cpp 2013-03-13 00:36:07 UTC (rev 145634)
+++ branches/safari-536.30-branch/Source/WebCore/svg/SVGUseElement.cpp 2013-03-13 00:39:21 UTC (rev 145635)
@@ -107,8 +107,7 @@
SVGUseElement::~SVGUseElement()
{
- if (m_cachedDocument)
- m_cachedDocument->removeClient(this);
+ setCachedDocument(0);
}
SVGElementInstance* SVGUseElement::instanceRoot()
@@ -248,18 +247,14 @@
KURL url = ""
if (url.hasFragmentIdentifier()) {
ResourceRequest request(url.string());
- m_cachedDocument = document()->cachedResourceLoader()->requestSVGDocument(request);
- if (m_cachedDocument)
- m_cachedDocument->addClient(this);
+ setCachedDocument(document()->cachedResourceLoader()->requestSVGDocument(request));
}
- }
+ } else
+ setCachedDocument(0);
- if (m_cachedDocument && !isExternalReference) {
- m_cachedDocument->removeClient(this);
- m_cachedDocument = 0;
- }
if (!m_wasInsertedByParser)
buildPendingResource();
+
return;
}
@@ -969,6 +964,19 @@
}
}
+void SVGUseElement::setCachedDocument(CachedResourceHandle<CachedSVGDocument> cachedDocument)
+{
+ if (m_cachedDocument == cachedDocument)
+ return;
+
+ if (m_cachedDocument)
+ m_cachedDocument->removeClient(this);
+
+ m_cachedDocument = cachedDocument;
+ if (m_cachedDocument)
+ m_cachedDocument->addClient(this);
}
+}
+
#endif // ENABLE(SVG)
Modified: branches/safari-536.30-branch/Source/WebCore/svg/SVGUseElement.h (145634 => 145635)
--- branches/safari-536.30-branch/Source/WebCore/svg/SVGUseElement.h 2013-03-13 00:36:07 UTC (rev 145634)
+++ branches/safari-536.30-branch/Source/WebCore/svg/SVGUseElement.h 2013-03-13 00:39:21 UTC (rev 145635)
@@ -112,6 +112,7 @@
bool instanceTreeIsLoading(SVGElementInstance*);
virtual void notifyFinished(CachedResource*);
Document* referencedDocument() const;
+ void setCachedDocument(CachedResourceHandle<CachedSVGDocument>);
// SVGTests
virtual void synchronizeRequiredFeatures() { SVGTests::synchronizeRequiredFeatures(this); }
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
