Diff
Modified: trunk/LayoutTests/ChangeLog (90165 => 90166)
--- trunk/LayoutTests/ChangeLog 2011-06-30 21:49:42 UTC (rev 90165)
+++ trunk/LayoutTests/ChangeLog 2011-06-30 21:51:17 UTC (rev 90166)
@@ -1,3 +1,14 @@
+2011-06-30 Julien Chaffraix <[email protected]>
+
+ Reviewed by Nikolas Zimmermann.
+
+ Update SVG position values on SVG DOM updates
+ https://bugs.webkit.org/show_bug.cgi?id=62439
+
+ * svg/custom/crash-textPath-attributes-expected.txt: Added.
+ * svg/custom/crash-textPath-attributes.html: Added.
+ * svg/custom/resources/crash-textPath-attributes-iframe.svg: Added.
+
2011-06-30 Sreeram Ramachandran <[email protected]>
Reviewed by Adam Barth.
Added: trunk/LayoutTests/svg/custom/crash-textPath-attributes-expected.txt (0 => 90166)
--- trunk/LayoutTests/svg/custom/crash-textPath-attributes-expected.txt (rev 0)
+++ trunk/LayoutTests/svg/custom/crash-textPath-attributes-expected.txt 2011-06-30 21:51:17 UTC (rev 90166)
@@ -0,0 +1,4 @@
+
+Test for Update SVG position values on SVG DOM updates
+
+This test PASSES if he does not crash
Added: trunk/LayoutTests/svg/custom/crash-textPath-attributes.html (0 => 90166)
--- trunk/LayoutTests/svg/custom/crash-textPath-attributes.html (rev 0)
+++ trunk/LayoutTests/svg/custom/crash-textPath-attributes.html 2011-06-30 21:51:17 UTC (rev 90166)
@@ -0,0 +1,13 @@
+<iframe src="" _onload_="go(this)"></iframe>
+<script>
+ if (window.layoutTestController)
+ layoutTestController.dumpAsText();
+
+ function go(oIframe) {
+ var oSelection = oIframe.contentWindow.getSelection();
+ oSelection.selectAllChildren(oIframe.contentDocument);
+ oSelection.deleteFromDocument();
+ }
+</script>
+<p>Test for <a href="" SVG position values on SVG DOM updates</a></p>
+<p>This test PASSES if he does not crash</p>
Property changes on: trunk/LayoutTests/svg/custom/crash-textPath-attributes.html
___________________________________________________________________
Added: svn:executable
Added: trunk/LayoutTests/svg/custom/resources/crash-textPath-attributes-iframe.svg (0 => 90166)
--- trunk/LayoutTests/svg/custom/resources/crash-textPath-attributes-iframe.svg (rev 0)
+++ trunk/LayoutTests/svg/custom/resources/crash-textPath-attributes-iframe.svg 2011-06-30 21:51:17 UTC (rev 90166)
@@ -0,0 +1,3 @@
+<!DOCTYPE svg>
+<?xml-stylesheet href=""
+<svg xmlns="http://www.w3.org/2000/svg"><text>x<tspan> <tspan
Property changes on: trunk/LayoutTests/svg/custom/resources/crash-textPath-attributes-iframe.svg
___________________________________________________________________
Added: svn:executable
Modified: trunk/Source/WebCore/ChangeLog (90165 => 90166)
--- trunk/Source/WebCore/ChangeLog 2011-06-30 21:49:42 UTC (rev 90165)
+++ trunk/Source/WebCore/ChangeLog 2011-06-30 21:51:17 UTC (rev 90166)
@@ -1,3 +1,25 @@
+2011-06-30 Julien Chaffraix <[email protected]>
+
+ Reviewed by Nikolas Zimmermann.
+
+ Update SVG position values on SVG DOM updates
+ https://bugs.webkit.org/show_bug.cgi?id=62439
+
+ Test: svg/custom/crash-textPath-attributes.html
+
+ * rendering/svg/RenderSVGInline.cpp:
+ (WebCore::RenderSVGInline::destroy): Notify our containing RenderSVGText that it needs
+ to update its positioning information.
+
+ * rendering/svg/SVGInlineFlowBox.cpp:
+ (WebCore::SVGInlineFlowBox::calculateBoundaries): Check the type of the InlineBox
+ like the rest of the code (fixes an ASSERT_NOT_REACHED in InlineBox::calculateBoudaries).
+
+ * rendering/svg/SVGTextLayoutAttributesBuilder.cpp:
+ (WebCore::SVGTextLayoutAttributesBuilder::buildLayoutAttributesForTextSubtree): Clear
+ our cached layout attributes every time we invalidate them. This avoids keeping stale
+ attribute that have a backpointer to a RenderObject.
+
2011-06-30 Sreeram Ramachandran <[email protected]>
Reviewed by Adam Barth.
Modified: trunk/Source/WebCore/rendering/svg/RenderSVGInline.cpp (90165 => 90166)
--- trunk/Source/WebCore/rendering/svg/RenderSVGInline.cpp 2011-06-30 21:49:42 UTC (rev 90165)
+++ trunk/Source/WebCore/rendering/svg/RenderSVGInline.cpp 2011-06-30 21:51:17 UTC (rev 90166)
@@ -95,6 +95,9 @@
void RenderSVGInline::destroy()
{
+ if (RenderSVGText* textRenderer = RenderSVGText::locateRenderSVGTextAncestor(this))
+ textRenderer->setNeedsPositioningValuesUpdate();
+
SVGResourcesCache::clientDestroyed(this);
RenderInline::destroy();
}
Modified: trunk/Source/WebCore/rendering/svg/SVGInlineFlowBox.cpp (90165 => 90166)
--- trunk/Source/WebCore/rendering/svg/SVGInlineFlowBox.cpp 2011-06-30 21:49:42 UTC (rev 90165)
+++ trunk/Source/WebCore/rendering/svg/SVGInlineFlowBox.cpp 2011-06-30 21:51:17 UTC (rev 90166)
@@ -75,8 +75,11 @@
IntRect SVGInlineFlowBox::calculateBoundaries() const
{
IntRect childRect;
- for (InlineBox* child = firstChild(); child; child = child->nextOnLine())
+ for (InlineBox* child = firstChild(); child; child = child->nextOnLine()) {
+ if (!child->isSVGInlineTextBox() && !child->isSVGInlineFlowBox())
+ continue;
childRect.unite(child->calculateBoundaries());
+ }
return childRect;
}
Modified: trunk/Source/WebCore/rendering/svg/SVGTextLayoutAttributesBuilder.cpp (90165 => 90166)
--- trunk/Source/WebCore/rendering/svg/SVGTextLayoutAttributesBuilder.cpp 2011-06-30 21:49:42 UTC (rev 90165)
+++ trunk/Source/WebCore/rendering/svg/SVGTextLayoutAttributesBuilder.cpp 2011-06-30 21:51:17 UTC (rev 90166)
@@ -39,7 +39,11 @@
{
ASSERT(textRoot);
- // Build list of x/y/dx/dy/rotate values for each subtree element that may define these values (tspan/textPath etc).
+ // We always clear our current attribute as we don't want to keep any stale ones that could survive DOM modification.
+ Vector<SVGTextLayoutAttributes>& allAttributes = textRoot->layoutAttributes();
+ allAttributes.clear();
+
+ // Build list of x/y/dx/dy/rotate values for each subtree element that may define these values (tspan/textPath etc).
unsigned atCharacter = 0;
UChar lastCharacter = '\0';
collectTextPositioningElements(textRoot, atCharacter, lastCharacter);
@@ -51,8 +55,6 @@
buildLayoutAttributesForAllCharacters(textRoot, atCharacter);
// Propagate layout attributes to each RenderSVGInlineText object, and the whole list to the RenderSVGText root.
- Vector<SVGTextLayoutAttributes>& allAttributes = textRoot->layoutAttributes();
- allAttributes.clear();
atCharacter = 0;
lastCharacter = '\0';
propagateLayoutAttributes(textRoot, allAttributes, atCharacter, lastCharacter);
