Diff
Modified: trunk/Source/WebCore/ChangeLog (97669 => 97670)
--- trunk/Source/WebCore/ChangeLog 2011-10-17 23:37:59 UTC (rev 97669)
+++ trunk/Source/WebCore/ChangeLog 2011-10-17 23:40:17 UTC (rev 97670)
@@ -1,3 +1,57 @@
+2011-10-17 Andreas Kling <kl...@webkit.org>
+
+ Protect against incorrect Element::fast*Attribute() usage.
+ https://bugs.webkit.org/show_bug.cgi?id=67612
+
+ Reviewed by Darin Adler.
+
+ Add debug-only checks in Element's fastHasAttribute() and fastGetAttribute() to verify
+ that we aren't looking up the "style" attribute or any of the SVG animatable attributes.
+
+ No new tests, erroneous behavior is covered by assertions.
+
+ * WebCore.exp.in: Export Element::fastAttributeLookupAllowed() for debug builds
+ since it's used by the inline fast*Attribute() calls.
+ * css/CSSStyleSelector.cpp:
+ (WebCore::CSSStyleSelector::canShareStyleWithElement): Use getAttribute() for class.
+ * css/SelectorChecker.cpp:
+ (WebCore::linkAttribute): Use getAttribute() for xlink:href.
+ * dom/Element.cpp:
+ (WebCore::Element::getAttribute): Manually inline fastGetAttribute() in ideal case.
+ (WebCore::Element::fastAttributeLookupAllowed): Checks if an attribute can be used
+ with the fast lookup functions.
+ * dom/Element.h:
+ (WebCore::Element::fastHasAttribute): Add assertion.
+ (WebCore::Element::fastGetAttribute): Ditto.
+ * editing/ApplyStyleCommand.cpp:
+ (WebCore::hasNoAttributeOrOnlyStyleAttribute): Use getAttribute() for class.
+ * editing/ReplaceSelectionCommand.cpp:
+ (WebCore::isInlineNodeWithStyle): Ditto.
+ * html/ClassList.cpp:
+ (WebCore::ClassList::ClassList): Ditto.
+ (WebCore::ClassList::addInternal): Ditto.
+ (WebCore::ClassList::removeInternal): Ditto.
+ (WebCore::ClassList::toString): Ditto.
+ * svg/SVGAltGlyphElement.cpp:
+ (WebCore::SVGAltGlyphElement::hasValidGlyphElements): Use getAttribute() for xlink:href.
+ * svg/SVGAnimateMotionElement.cpp:
+ (WebCore::SVGAnimateMotionElement::rotateMode): Use getAttribute() for rotate.
+ * svg/SVGAnimationElement.cpp:
+ (WebCore::SVGAnimationElement::animationMode): Use getAttribute() for values.
+ * svg/SVGElement.cpp:
+ (WebCore::SVGElement::isAnimatableAttribute): Added, returns true if the given
+ QualifiedName represents an animatable attribute.
+ * svg/SVGElement.h:
+ * svg/SVGFontFaceUriElement.cpp:
+ (WebCore::SVGFontFaceUriElement::srcValue): Use getAttribute() for xlink:href.
+ (WebCore::SVGFontFaceUriElement::loadFont): Ditto.
+ * svg/animation/SVGSMILElement.cpp:
+ (WebCore::SVGSMILElement::xlinkHref): Ditto.
+ * svg/SVGGlyphRefElement.cpp:
+ (WebCore::SVGGlyphRefElement::hasValidGlyphElement): Ditto.
+ * svg/SVGStyleElement.cpp:
+ (WebCore::SVGStyleElement::type): Use getAttribute() for type.
+
2011-10-17 Chris Fleizach <cfleiz...@apple.com>
AX: buttons of number type <input> controls are not fully accessible
Modified: trunk/Source/WebCore/WebCore.exp.in (97669 => 97670)
--- trunk/Source/WebCore/WebCore.exp.in 2011-10-17 23:37:59 UTC (rev 97669)
+++ trunk/Source/WebCore/WebCore.exp.in 2011-10-17 23:40:17 UTC (rev 97670)
@@ -1510,6 +1510,7 @@
#if !defined(NDEBUG)
__ZN7WebCore20LogNotYetImplementedE
+__ZNK7WebCore7Element26fastAttributeLookupAllowedERKNS_13QualifiedNameE
#endif
#if !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
Modified: trunk/Source/WebCore/css/CSSStyleSelector.cpp (97669 => 97670)
--- trunk/Source/WebCore/css/CSSStyleSelector.cpp 2011-10-17 23:37:59 UTC (rev 97669)
+++ trunk/Source/WebCore/css/CSSStyleSelector.cpp 2011-10-17 23:40:17 UTC (rev 97670)
@@ -864,7 +864,7 @@
return false;
if (m_element == m_element->document()->cssTarget())
return false;
- if (element->fastGetAttribute(typeAttr) != m_element->fastGetAttribute(typeAttr))
+ if (element->getAttribute(typeAttr) != m_element->getAttribute(typeAttr))
return false;
if (element->fastGetAttribute(XMLNames::langAttr) != m_element->fastGetAttribute(XMLNames::langAttr))
return false;
@@ -902,7 +902,7 @@
if (equalIgnoringCase(element->fastGetAttribute(dirAttr), "auto") || equalIgnoringCase(m_element->fastGetAttribute(dirAttr), "auto"))
return false;
- if (element->hasClass() && m_element->fastGetAttribute(classAttr) != element->fastGetAttribute(classAttr))
+ if (element->hasClass() && m_element->getAttribute(classAttr) != element->getAttribute(classAttr))
return false;
if (element->hasMappedAttributes() && !element->attributeMap()->mappedMapsEquivalent(m_styledElement->attributeMap()))
Modified: trunk/Source/WebCore/css/SelectorChecker.cpp (97669 => 97670)
--- trunk/Source/WebCore/css/SelectorChecker.cpp 2011-10-17 23:37:59 UTC (rev 97669)
+++ trunk/Source/WebCore/css/SelectorChecker.cpp 2011-10-17 23:40:17 UTC (rev 97670)
@@ -215,7 +215,7 @@
#if ENABLE(SVG)
if (element->isSVGElement())
- return &element->fastGetAttribute(XLinkNames::hrefAttr);
+ return &element->getAttribute(XLinkNames::hrefAttr);
#endif
return 0;
Modified: trunk/Source/WebCore/dom/Element.cpp (97669 => 97670)
--- trunk/Source/WebCore/dom/Element.cpp 2011-10-17 23:37:59 UTC (rev 97669)
+++ trunk/Source/WebCore/dom/Element.cpp 2011-10-17 23:40:17 UTC (rev 97670)
@@ -226,7 +226,11 @@
updateAnimatedSVGAttribute(name);
#endif
- return fastGetAttribute(name);
+ if (m_attributeMap) {
+ if (Attribute* attribute = m_attributeMap->getAttributeItem(name))
+ return attribute->value();
+ }
+ return nullAtom;
}
void Element::scrollIntoView(bool alignToTop)
@@ -2019,4 +2023,19 @@
return animController->animationsForRenderer(renderer());
}
+#ifndef NDEBUG
+bool Element::fastAttributeLookupAllowed(const QualifiedName& name) const
+{
+ if (name == HTMLNames::styleAttr)
+ return false;
+
+#if ENABLE(SVG)
+ if (isSVGElement())
+ return !SVGElement::isAnimatableAttribute(name);
+#endif
+
+ return true;
+}
+#endif
+
} // namespace WebCore
Modified: trunk/Source/WebCore/dom/Element.h (97669 => 97670)
--- trunk/Source/WebCore/dom/Element.h 2011-10-17 23:37:59 UTC (rev 97669)
+++ trunk/Source/WebCore/dom/Element.h 2011-10-17 23:40:17 UTC (rev 97670)
@@ -123,6 +123,9 @@
// attribute or one of the SVG animatable attributes.
bool fastHasAttribute(const QualifiedName&) const;
const AtomicString& fastGetAttribute(const QualifiedName&) const;
+#ifndef NDEBUG
+ bool fastAttributeLookupAllowed(const QualifiedName&) const;
+#endif
bool hasAttributes() const;
@@ -507,11 +510,13 @@
inline bool Element::fastHasAttribute(const QualifiedName& name) const
{
+ ASSERT(fastAttributeLookupAllowed(name));
return m_attributeMap && m_attributeMap->getAttributeItem(name);
}
inline const AtomicString& Element::fastGetAttribute(const QualifiedName& name) const
{
+ ASSERT(fastAttributeLookupAllowed(name));
if (m_attributeMap) {
if (Attribute* attribute = m_attributeMap->getAttributeItem(name))
return attribute->value();
Modified: trunk/Source/WebCore/editing/ApplyStyleCommand.cpp (97669 => 97670)
--- trunk/Source/WebCore/editing/ApplyStyleCommand.cpp 2011-10-17 23:37:59 UTC (rev 97669)
+++ trunk/Source/WebCore/editing/ApplyStyleCommand.cpp 2011-10-17 23:40:17 UTC (rev 97670)
@@ -79,7 +79,7 @@
return true;
unsigned matchedAttributes = 0;
- if (element->fastGetAttribute(classAttr) == styleSpanClassString())
+ if (element->getAttribute(classAttr) == styleSpanClassString())
matchedAttributes++;
if (element->hasAttribute(styleAttr) && (shouldStyleAttributeBeEmpty == AllowNonEmptyStyleAttribute
|| !element->inlineStyleDecl() || element->inlineStyleDecl()->isEmpty()))
Modified: trunk/Source/WebCore/editing/ReplaceSelectionCommand.cpp (97669 => 97670)
--- trunk/Source/WebCore/editing/ReplaceSelectionCommand.cpp 2011-10-17 23:37:59 UTC (rev 97669)
+++ trunk/Source/WebCore/editing/ReplaceSelectionCommand.cpp 2011-10-17 23:40:17 UTC (rev 97670)
@@ -746,7 +746,7 @@
// We can skip over elements whose class attribute is
// one of our internal classes.
const HTMLElement* element = static_cast<const HTMLElement*>(node);
- AtomicString classAttributeValue = element->getAttribute(classAttr);
+ const AtomicString& classAttributeValue = element->getAttribute(classAttr);
if (classAttributeValue == AppleTabSpanClass
|| classAttributeValue == AppleConvertedSpace
|| classAttributeValue == ApplePasteAsQuotation)
Modified: trunk/Source/WebCore/html/ClassList.cpp (97669 => 97670)
--- trunk/Source/WebCore/html/ClassList.cpp 2011-10-17 23:37:59 UTC (rev 97669)
+++ trunk/Source/WebCore/html/ClassList.cpp 2011-10-17 23:40:17 UTC (rev 97670)
@@ -39,7 +39,7 @@
: m_element(element)
{
if (m_element->document()->inQuirksMode())
- m_classNamesForQuirksMode.set(m_element->fastGetAttribute(classAttr), false);
+ m_classNamesForQuirksMode.set(m_element->getAttribute(classAttr), false);
}
void ClassList::ref()
@@ -85,7 +85,7 @@
void ClassList::addInternal(const AtomicString& token)
{
- const AtomicString& oldClassName(m_element->fastGetAttribute(classAttr));
+ const AtomicString& oldClassName(m_element->getAttribute(classAttr));
if (oldClassName.isEmpty())
m_element->setAttribute(classAttr, token);
else if (!containsInternal(token)) {
@@ -107,7 +107,7 @@
// of character by character testing.
if (!containsInternal(token))
return;
- const AtomicString& newClassName(removeToken(m_element->fastGetAttribute(classAttr), token));
+ const AtomicString& newClassName(removeToken(m_element->getAttribute(classAttr), token));
m_element->setAttribute(classAttr, newClassName);
}
@@ -126,7 +126,7 @@
String ClassList::toString() const
{
- return m_element->fastGetAttribute(classAttr);
+ return m_element->getAttribute(classAttr);
}
void ClassList::reset(const String& newClassName)
Modified: trunk/Source/WebCore/svg/SVGAltGlyphElement.cpp (97669 => 97670)
--- trunk/Source/WebCore/svg/SVGAltGlyphElement.cpp 2011-10-17 23:37:59 UTC (rev 97669)
+++ trunk/Source/WebCore/svg/SVGAltGlyphElement.cpp 2011-10-17 23:40:17 UTC (rev 97670)
@@ -90,7 +90,7 @@
bool SVGAltGlyphElement::hasValidGlyphElements(Vector<String>& glyphNames) const
{
String target;
- Element* element = targetElementFromIRIString(fastGetAttribute(XLinkNames::hrefAttr), document(), &target);
+ Element* element = targetElementFromIRIString(getAttribute(XLinkNames::hrefAttr), document(), &target);
if (!element)
return false;
Modified: trunk/Source/WebCore/svg/SVGAnimateMotionElement.cpp (97669 => 97670)
--- trunk/Source/WebCore/svg/SVGAnimateMotionElement.cpp 2011-10-17 23:37:59 UTC (rev 97669)
+++ trunk/Source/WebCore/svg/SVGAnimateMotionElement.cpp 2011-10-17 23:40:17 UTC (rev 97670)
@@ -116,7 +116,7 @@
{
DEFINE_STATIC_LOCAL(const AtomicString, autoVal, ("auto"));
DEFINE_STATIC_LOCAL(const AtomicString, autoReverse, ("auto-reverse"));
- String rotate = fastGetAttribute(SVGNames::rotateAttr);
+ const AtomicString& rotate = getAttribute(SVGNames::rotateAttr);
if (rotate == autoVal)
return RotateAuto;
if (rotate == autoReverse)
Modified: trunk/Source/WebCore/svg/SVGAnimationElement.cpp (97669 => 97670)
--- trunk/Source/WebCore/svg/SVGAnimationElement.cpp 2011-10-17 23:37:59 UTC (rev 97669)
+++ trunk/Source/WebCore/svg/SVGAnimationElement.cpp 2011-10-17 23:40:17 UTC (rev 97670)
@@ -253,7 +253,7 @@
return ToAnimation;
if (!animationPath().isEmpty())
return PathAnimation;
- if (fastHasAttribute(SVGNames::valuesAttr))
+ if (hasAttribute(SVGNames::valuesAttr))
return ValuesAnimation;
if (!toValue().isEmpty())
return fromValue().isEmpty() ? ToAnimation : FromToAnimation;
Modified: trunk/Source/WebCore/svg/SVGElement.cpp (97669 => 97670)
--- trunk/Source/WebCore/svg/SVGElement.cpp 2011-10-17 23:37:59 UTC (rev 97669)
+++ trunk/Source/WebCore/svg/SVGElement.cpp 2011-10-17 23:40:17 UTC (rev 97670)
@@ -435,6 +435,111 @@
return document()->styleSelector()->styleForElement(static_cast<Element*>(this), 0, true);
}
+#ifndef NDEBUG
+bool SVGElement::isAnimatableAttribute(const QualifiedName& name)
+{
+ DEFINE_STATIC_LOCAL(HashSet<QualifiedName>, animatableAttributes, ());
+
+ if (animatableAttributes.isEmpty()) {
+ animatableAttributes.add(HTMLNames::classAttr);
+ animatableAttributes.add(XLinkNames::hrefAttr);
+ animatableAttributes.add(SVGNames::amplitudeAttr);
+ animatableAttributes.add(SVGNames::azimuthAttr);
+ animatableAttributes.add(SVGNames::baseFrequencyAttr);
+ animatableAttributes.add(SVGNames::biasAttr);
+ animatableAttributes.add(SVGNames::clipPathUnitsAttr);
+ animatableAttributes.add(SVGNames::cxAttr);
+ animatableAttributes.add(SVGNames::cyAttr);
+ animatableAttributes.add(SVGNames::diffuseConstantAttr);
+ animatableAttributes.add(SVGNames::divisorAttr);
+ animatableAttributes.add(SVGNames::dxAttr);
+ animatableAttributes.add(SVGNames::dyAttr);
+ animatableAttributes.add(SVGNames::edgeModeAttr);
+ animatableAttributes.add(SVGNames::elevationAttr);
+ animatableAttributes.add(SVGNames::exponentAttr);
+ animatableAttributes.add(SVGNames::externalResourcesRequiredAttr);
+ animatableAttributes.add(SVGNames::filterResAttr);
+ animatableAttributes.add(SVGNames::filterUnitsAttr);
+ animatableAttributes.add(SVGNames::fxAttr);
+ animatableAttributes.add(SVGNames::fyAttr);
+ animatableAttributes.add(SVGNames::gradientTransformAttr);
+ animatableAttributes.add(SVGNames::gradientUnitsAttr);
+ animatableAttributes.add(SVGNames::heightAttr);
+ animatableAttributes.add(SVGNames::in2Attr);
+ animatableAttributes.add(SVGNames::inAttr);
+ animatableAttributes.add(SVGNames::interceptAttr);
+ animatableAttributes.add(SVGNames::k1Attr);
+ animatableAttributes.add(SVGNames::k2Attr);
+ animatableAttributes.add(SVGNames::k3Attr);
+ animatableAttributes.add(SVGNames::k4Attr);
+ animatableAttributes.add(SVGNames::kernelMatrixAttr);
+ animatableAttributes.add(SVGNames::kernelUnitLengthAttr);
+ animatableAttributes.add(SVGNames::lengthAdjustAttr);
+ animatableAttributes.add(SVGNames::limitingConeAngleAttr);
+ animatableAttributes.add(SVGNames::markerHeightAttr);
+ animatableAttributes.add(SVGNames::markerUnitsAttr);
+ animatableAttributes.add(SVGNames::markerWidthAttr);
+ animatableAttributes.add(SVGNames::maskContentUnitsAttr);
+ animatableAttributes.add(SVGNames::maskUnitsAttr);
+ animatableAttributes.add(SVGNames::methodAttr);
+ animatableAttributes.add(SVGNames::modeAttr);
+ animatableAttributes.add(SVGNames::numOctavesAttr);
+ animatableAttributes.add(SVGNames::offsetAttr);
+ animatableAttributes.add(SVGNames::operatorAttr);
+ animatableAttributes.add(SVGNames::orderAttr);
+ animatableAttributes.add(SVGNames::orientAttr);
+ animatableAttributes.add(SVGNames::pathLengthAttr);
+ animatableAttributes.add(SVGNames::patternContentUnitsAttr);
+ animatableAttributes.add(SVGNames::patternTransformAttr);
+ animatableAttributes.add(SVGNames::patternUnitsAttr);
+ animatableAttributes.add(SVGNames::pointsAtXAttr);
+ animatableAttributes.add(SVGNames::pointsAtYAttr);
+ animatableAttributes.add(SVGNames::pointsAtZAttr);
+ animatableAttributes.add(SVGNames::preserveAlphaAttr);
+ animatableAttributes.add(SVGNames::preserveAspectRatioAttr);
+ animatableAttributes.add(SVGNames::primitiveUnitsAttr);
+ animatableAttributes.add(SVGNames::radiusAttr);
+ animatableAttributes.add(SVGNames::rAttr);
+ animatableAttributes.add(SVGNames::refXAttr);
+ animatableAttributes.add(SVGNames::refYAttr);
+ animatableAttributes.add(SVGNames::resultAttr);
+ animatableAttributes.add(SVGNames::rotateAttr);
+ animatableAttributes.add(SVGNames::rxAttr);
+ animatableAttributes.add(SVGNames::ryAttr);
+ animatableAttributes.add(SVGNames::scaleAttr);
+ animatableAttributes.add(SVGNames::seedAttr);
+ animatableAttributes.add(SVGNames::slopeAttr);
+ animatableAttributes.add(SVGNames::spacingAttr);
+ animatableAttributes.add(SVGNames::specularConstantAttr);
+ animatableAttributes.add(SVGNames::specularExponentAttr);
+ animatableAttributes.add(SVGNames::spreadMethodAttr);
+ animatableAttributes.add(SVGNames::startOffsetAttr);
+ animatableAttributes.add(SVGNames::stdDeviationAttr);
+ animatableAttributes.add(SVGNames::stitchTilesAttr);
+ animatableAttributes.add(SVGNames::surfaceScaleAttr);
+ animatableAttributes.add(SVGNames::tableValuesAttr);
+ animatableAttributes.add(SVGNames::targetAttr);
+ animatableAttributes.add(SVGNames::targetXAttr);
+ animatableAttributes.add(SVGNames::targetYAttr);
+ animatableAttributes.add(SVGNames::transformAttr);
+ animatableAttributes.add(SVGNames::typeAttr);
+ animatableAttributes.add(SVGNames::valuesAttr);
+ animatableAttributes.add(SVGNames::viewBoxAttr);
+ animatableAttributes.add(SVGNames::widthAttr);
+ animatableAttributes.add(SVGNames::x1Attr);
+ animatableAttributes.add(SVGNames::x2Attr);
+ animatableAttributes.add(SVGNames::xAttr);
+ animatableAttributes.add(SVGNames::xChannelSelectorAttr);
+ animatableAttributes.add(SVGNames::y1Attr);
+ animatableAttributes.add(SVGNames::y2Attr);
+ animatableAttributes.add(SVGNames::yAttr);
+ animatableAttributes.add(SVGNames::yChannelSelectorAttr);
+ animatableAttributes.add(SVGNames::zAttr);
+ }
+ return animatableAttributes.contains(name);
}
+#endif
+}
+
#endif // ENABLE(SVG)
Modified: trunk/Source/WebCore/svg/SVGElement.h (97669 => 97670)
--- trunk/Source/WebCore/svg/SVGElement.h 2011-10-17 23:37:59 UTC (rev 97669)
+++ trunk/Source/WebCore/svg/SVGElement.h 2011-10-17 23:40:17 UTC (rev 97670)
@@ -101,6 +101,10 @@
virtual SVGAttributeToPropertyMap& localAttributeToPropertyMap();
+#ifndef NDEBUG
+ static bool isAnimatableAttribute(const QualifiedName&);
+#endif
+
protected:
SVGElement(const QualifiedName&, Document*, ConstructionType = CreateSVGElement);
Modified: trunk/Source/WebCore/svg/SVGFontFaceUriElement.cpp (97669 => 97670)
--- trunk/Source/WebCore/svg/SVGFontFaceUriElement.cpp 2011-10-17 23:37:59 UTC (rev 97669)
+++ trunk/Source/WebCore/svg/SVGFontFaceUriElement.cpp 2011-10-17 23:40:17 UTC (rev 97670)
@@ -55,7 +55,7 @@
PassRefPtr<CSSFontFaceSrcValue> SVGFontFaceUriElement::srcValue() const
{
- RefPtr<CSSFontFaceSrcValue> src = ""
+ RefPtr<CSSFontFaceSrcValue> src = ""
AtomicString value(fastGetAttribute(formatAttr));
src->setFormat(value.isEmpty() ? "svg" : value); // Default format
return src.release();
@@ -93,8 +93,8 @@
if (m_cachedFont)
m_cachedFont->removeClient(this);
- String href = ""
- if (!href.isNull()) {
+ const AtomicString& href = ""
+ if (!href.isNull()) {
CachedResourceLoader* cachedResourceLoader = document()->cachedResourceLoader();
ResourceRequest request(document()->completeURL(href));
m_cachedFont = cachedResourceLoader->requestFont(request);
Modified: trunk/Source/WebCore/svg/SVGGlyphRefElement.cpp (97669 => 97670)
--- trunk/Source/WebCore/svg/SVGGlyphRefElement.cpp 2011-10-17 23:37:59 UTC (rev 97669)
+++ trunk/Source/WebCore/svg/SVGGlyphRefElement.cpp 2011-10-17 23:40:17 UTC (rev 97670)
@@ -58,7 +58,7 @@
{
// FIXME: We only support xlink:href so far.
// https://bugs.webkit.org/show_bug.cgi?id=64787
- Element* element = targetElementFromIRIString(fastGetAttribute(XLinkNames::hrefAttr), document(), &glyphName);
+ Element* element = targetElementFromIRIString(getAttribute(XLinkNames::hrefAttr), document(), &glyphName);
if (!element || !element->hasTagName(SVGNames::glyphTag))
return false;
return true;
Modified: trunk/Source/WebCore/svg/SVGStyleElement.cpp (97669 => 97670)
--- trunk/Source/WebCore/svg/SVGStyleElement.cpp 2011-10-17 23:37:59 UTC (rev 97669)
+++ trunk/Source/WebCore/svg/SVGStyleElement.cpp 2011-10-17 23:40:17 UTC (rev 97670)
@@ -54,7 +54,7 @@
const AtomicString& SVGStyleElement::type() const
{
DEFINE_STATIC_LOCAL(const AtomicString, defaultValue, ("text/css"));
- const AtomicString& n = fastGetAttribute(SVGNames::typeAttr);
+ const AtomicString& n = getAttribute(SVGNames::typeAttr);
return n.isNull() ? defaultValue : n;
}
Modified: trunk/Source/WebCore/svg/animation/SVGSMILElement.cpp (97669 => 97670)
--- trunk/Source/WebCore/svg/animation/SVGSMILElement.cpp 2011-10-17 23:37:59 UTC (rev 97669)
+++ trunk/Source/WebCore/svg/animation/SVGSMILElement.cpp 2011-10-17 23:40:17 UTC (rev 97670)
@@ -540,7 +540,7 @@
String SVGSMILElement::xlinkHref() const
{
- return fastGetAttribute(XLinkNames::hrefAttr);
+ return getAttribute(XLinkNames::hrefAttr);
}
SMILTime SVGSMILElement::dur() const
