Prevent animation when CSS attributeType is invalid.

https://bugs.webkit.org/show_bug.cgi?id=94569

Reviewed by Dirk Schulze.

Source/WebCore:

This patch changes hasValidAttributeType() to return false when
we have attributeType=CSS with a non-CSS attribute name.

Previously we would animate non-CSS attributes when attributeType was
CSS which resulted in crashes. To track this case, this patch catches
changes to targetElement, attributeName, and attributeType and checks
if an invalid combination is present. If invalid, hasInvalidCSSAttributeType()
will return true causing hasValidAttributeType() to return false and prevent
the animation from running.

Tests: svg/animations/animate-css-xml-attributeType.html
       svg/animations/invalid-css-attribute-crash-expected.svg
       svg/animations/invalid-css-attribute-crash.svg

* svg/SVGAnimateElement.cpp:
(WebCore::SVGAnimateElement::hasValidAttributeType):
(WebCore::SVGAnimateElement::targetElementWillChange):
* svg/SVGAnimationElement.cpp:
(WebCore::SVGAnimationElement::SVGAnimationElement):
(WebCore::SVGAnimationElement::isSupportedAttribute):

    This now supports the attributeType attribute which is stored in m_attributeType.

(WebCore::SVGAnimationElement::parseAttribute):
(WebCore::SVGAnimationElement::setAttributeType):

    Changes to attributeType, attributeName, and targetElement need to be tracked
    to determine when an invalid combination happens.

(WebCore::SVGAnimationElement::targetElementWillChange):
(WebCore):
(WebCore::SVGAnimationElement::setAttributeName):
(WebCore::SVGAnimationElement::checkInvalidCSSAttributeType):
* svg/SVGAnimationElement.h:
(WebCore::SVGAnimationElement::attributeType):
(SVGAnimationElement):
(WebCore::SVGAnimationElement::hasInvalidCSSAttributeType):
* svg/animation/SVGSMILElement.cpp:
(WebCore::SVGSMILElement::targetElement):
* svg/animation/SVGSMILElement.h:
(SVGSMILElement):

LayoutTests:

Adding a test to prove this patch works (invalid-css-attribute-crash.svg)
and an additional test to show that switching between XML and CSS
attributeTypes works as expected (animate-css-xml-attributeType.html).

* platform/chromium/TestExpectations:
* platform/efl/TestExpectations:
* platform/gtk/TestExpectations:
* platform/mac/TestExpectations:
* platform/qt/TestExpectations:
* platform/win/TestExpectations:
* svg/animations/animate-css-xml-attributeType-expected.txt: Added.
* svg/animations/animate-css-xml-attributeType.html: Added.
* svg/animations/invalid-css-attribute-crash-expected.svg: Added.
* svg/animations/invalid-css-attribute-crash.svg: Added.
* svg/animations/script-tests/animate-css-xml-attributeType.js: Added.
(sample1):
(sample6):
(executeTest):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@130777 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index f2b20f5..8d06330 100644 (file)
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,29 @@
+2012-10-09  Philip Rogers  <pdr@google.com>
+
+        Prevent animation when CSS attributeType is invalid.
+        https://bugs.webkit.org/show_bug.cgi?id=94569
+
+        Reviewed by Dirk Schulze.
+
+        Adding a test to prove this patch works (invalid-css-attribute-crash.svg)
+        and an additional test to show that switching between XML and CSS
+        attributeTypes works as expected (animate-css-xml-attributeType.html).
+
+        * platform/chromium/TestExpectations:
+        * platform/efl/TestExpectations:
+        * platform/gtk/TestExpectations:
+        * platform/mac/TestExpectations:
+        * platform/qt/TestExpectations:
+        * platform/win/TestExpectations:
+        * svg/animations/animate-css-xml-attributeType-expected.txt: Added.
+        * svg/animations/animate-css-xml-attributeType.html: Added.
+        * svg/animations/invalid-css-attribute-crash-expected.svg: Added.
+        * svg/animations/invalid-css-attribute-crash.svg: Added.
+        * svg/animations/script-tests/animate-css-xml-attributeType.js: Added.
+        (sample1):
+        (sample6):
+        (executeTest):
+
 2012-10-08  Simon Fraser  <simon.fraser@apple.com>
 
         Remove DRT/WTR implementations of layerTreeAsText

diff --git a/LayoutTests/platform/chromium/TestExpectations b/LayoutTests/platform/chromium/TestExpectations
index 2a330fa..6713b1f 100644 (file)
--- a/LayoutTests/platform/chromium/TestExpectations
+++ b/LayoutTests/platform/chromium/TestExpectations
@@ -1223,6 +1223,8 @@ crbug.com/18116 svg/custom/global-constructors.html [ Failure ]
 # reasonable.
 crbug.com/19897 [ Android Linux Win ] svg/custom/getscreenctm-in-mixed-content2.xhtml [ Failure ]
 
+webkit.org/b/98718 svg/animations/animate-css-xml-attributeType.html [ Failure Pass ]
+
 # Failing since creation in http://trac.webkit.org/changeset/75308
 # Failing worse maybe since https://bugs.webkit.org/show_bug.cgi?id=53471
 crbug.com/122193 svg/text/caret-in-svg-text.xhtml [ Failure ]

diff --git a/LayoutTests/platform/efl/TestExpectations b/LayoutTests/platform/efl/TestExpectations
index f3623fe..435f99e 100644 (file)
--- a/LayoutTests/platform/efl/TestExpectations
+++ b/LayoutTests/platform/efl/TestExpectations
@@ -820,6 +820,8 @@ webkit.org/b/98644 svg/W3C-SVG-1.1/pservers-grad-13-b.svg [ Skip ]
 webkit.org/b/98651 svg/text/non-bmp-positioning-lists.svg [ Skip ]
 webkit.org/b/98653 svg/text/lengthAdjust-text-metrics.html [ Failure ]
 
+webkit.org/b/98718 svg/animations/animate-css-xml-attributeType.html [ Failure Pass ]
+
 # EFL's TestRunner does not implement setMediaType
 Bug(EFL) fast/media/print-restores-previous-mediatype.html [ Failure ]
 

diff --git a/LayoutTests/platform/gtk/TestExpectations b/LayoutTests/platform/gtk/TestExpectations
index 0e44ffa..0d8ffd2 100644 (file)
--- a/LayoutTests/platform/gtk/TestExpectations
+++ b/LayoutTests/platform/gtk/TestExpectations
@@ -535,6 +535,8 @@ webkit.org/b/89650 svg/W3C-SVG-1.1/animate-elem-82-t.svg [ Failure Pass ]
 webkit.org/b/89650 [ Debug ] svg/W3C-SVG-1.1/animate-elem-85-t.svg [ Failure Pass ]
 webkit.org/b/89650 svg/W3C-SVG-1.1/struct-dom-06-b.svg [ Failure Pass ]
 
+webkit.org/b/98718 svg/animations/animate-css-xml-attributeType.html [ Failure Pass ]
+
 webkit.org/b/80158 plugins/netscape-plugin-page-cache-works.html [ Failure Pass ]
 
 webkit.org/b/83704 media/event-attributes.html [ Failure Pass ]

diff --git a/LayoutTests/platform/mac/TestExpectations b/LayoutTests/platform/mac/TestExpectations
index d04fa35..3d644d5 100644 (file)
--- a/LayoutTests/platform/mac/TestExpectations
+++ b/LayoutTests/platform/mac/TestExpectations
@@ -1185,6 +1185,8 @@ webkit.org/b/89116 svg/dynamic-updates/SVGFESpecularLightingElement-svgdom-specu
 webkit.org/b/89116 svg/dynamic-updates/SVGFESpecularLightingElement-svgdom-suraceScale-prop.html [ ImageOnlyFailure Pass ]
 webkit.org/b/89116 svg/filters/feLighting-crash.svg [ ImageOnlyFailure Pass ]
 
+webkit.org/b/98718 svg/animations/animate-css-xml-attributeType.html [ Failure Pass ]
+
 # Needs rebaseline after https://bugs.webkit.org/show_bug.cgi?id=79682
 webkit.org/b/79682 svg/repaint/text-mask-update.svg [ Failure ImageOnlyFailure Missing Pass ]
 

diff --git a/LayoutTests/platform/qt/TestExpectations b/LayoutTests/platform/qt/TestExpectations
index 1cc2389..01aa7c6 100644 (file)
--- a/LayoutTests/platform/qt/TestExpectations
+++ b/LayoutTests/platform/qt/TestExpectations
@@ -1426,6 +1426,8 @@ svg/text/text-fonts-01-t.svg
 svg/text/text-intro-05-t.svg
 svg/text/text-tselect-02-f.svg
 
+webkit.org/b/98718 svg/animations/animate-css-xml-attributeType.html [ Failure Pass ]
+
 # [Qt] svg/animations/animate-path-nested-transforms.html fails
 # https://bugs.webkit.org/show_bug.cgi?id=48987
 svg/animations/animate-path-nested-transforms.html

diff --git a/LayoutTests/platform/win/TestExpectations b/LayoutTests/platform/win/TestExpectations
index 533183d..cd9fb3e 100644 (file)
--- a/LayoutTests/platform/win/TestExpectations
+++ b/LayoutTests/platform/win/TestExpectations
@@ -142,6 +142,8 @@ fast/text/atsui-pointtooffset-calls-cg.html
 fast/text/cg-vs-atsui.html
 fast/text/atsui-spacing-features.html
 
+webkit.org/b/98718 svg/animations/animate-css-xml-attributeType.html [ Failure Pass ]
+
 # <rdar://problem/5718773> Support a minimum antialiased font size
 svg/hixie/text/003.html
 svg/hixie/text/003a.xml

diff --git a/LayoutTests/svg/animations/animate-css-xml-attributeType-expected.txt b/LayoutTests/svg/animations/animate-css-xml-attributeType-expected.txt
new file mode 100644 (file)
index 0000000..99f621d
--- /dev/null
+++ b/LayoutTests/svg/animations/animate-css-xml-attributeType-expected.txt
@@ -0,0 +1,20 @@
+SVG 1.1 dynamic animation tests
+
+Tests that XML and CSS attributeTypes can be switched between.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS rect.x.animVal.value is 100
+PASS rect.x.baseVal.value is 100
+PASS rect.x.animVal.value is 300
+PASS rect.x.animVal.value is 100
+PASS getComputedStyle(rect).getPropertyCSSValue('opacity').getFloatValue(CSSPrimitiveValue.CSS_NUMBER) is 0.8
+PASS rect.x.animVal.value is 100
+PASS getComputedStyle(rect).getPropertyCSSValue('opacity').getFloatValue(CSSPrimitiveValue.CSS_NUMBER) is 1.0
+PASS rect.x.animVal.value is 200
+PASS rect.x.baseVal.value is 100
+PASS successfullyParsed is true
+
+TEST COMPLETE
+

diff --git a/LayoutTests/svg/animations/animate-css-xml-attributeType.html b/LayoutTests/svg/animations/animate-css-xml-attributeType.html
new file mode 100644 (file)
index 0000000..ee9dff9
--- /dev/null
+++ b/LayoutTests/svg/animations/animate-css-xml-attributeType.html
@@ -0,0 +1,14 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src="../../fast/js/resources/js-test-pre.js"></script>
+<script src="../dynamic-updates/resources/SVGTestCase.js"></script>
+<script src="resources/SVGAnimationTestCase.js"></script>
+</head>
+<body onload="runSMILTest()">
+<h1>SVG 1.1 dynamic animation tests</h1>
+<p id="description"></p>
+<div id="console"></div>
+<script src="script-tests/animate-css-xml-attributeType.js"></script>
+</body>
+</html>

diff --git a/LayoutTests/svg/animations/invalid-css-attribute-crash-expected.svg b/LayoutTests/svg/animations/invalid-css-attribute-crash-expected.svg
new file mode 100644 (file)
index 0000000..33bae46
--- /dev/null
+++ b/LayoutTests/svg/animations/invalid-css-attribute-crash-expected.svg
@@ -0,0 +1,3 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+<text x="5" y="20">This test passes if it does not CRASH.</text>
+</svg>

diff --git a/LayoutTests/svg/animations/invalid-css-attribute-crash.svg b/LayoutTests/svg/animations/invalid-css-attribute-crash.svg
new file mode 100644 (file)
index 0000000..2d2ba67
--- /dev/null
+++ b/LayoutTests/svg/animations/invalid-css-attribute-crash.svg
@@ -0,0 +1,7 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+<!-- Test for WK94569: Passes if there is no crash in animating non-CSS animations with attributeType=CSS. -->
+<text x="5" y="20">This test passes if it does not CRASH.</text>
+<feConvolveMatrix>
+<set attributeName="result" attributeType="CSS" to="inherit"></set>
+</feConvolveMatrix>
+</svg>

diff --git a/LayoutTests/svg/animations/script-tests/animate-css-xml-attributeType.js b/LayoutTests/svg/animations/script-tests/animate-css-xml-attributeType.js
new file mode 100644 (file)
index 0000000..77cfb60
--- /dev/null
+++ b/LayoutTests/svg/animations/script-tests/animate-css-xml-attributeType.js
@@ -0,0 +1,77 @@
+description("Tests that XML and CSS attributeTypes can be switched between.");
+createSVGTestCase();
+
+// Setup test document
+var rect = createSVGElement("rect");
+rect.setAttribute("id", "rect");
+rect.setAttribute("x", "100");
+rect.setAttribute("width", "100");
+rect.setAttribute("height", "100");
+rect.setAttribute("fill", "green");
+rect.setAttribute("onclick", "executeTest()");
+
+var set = createSVGElement("set");
+set.setAttribute("id", "set");
+set.setAttribute("attributeName", "x");
+set.setAttribute("attributeType", "XML");
+set.setAttribute("to", "300");
+set.setAttribute("begin", "click");
+rect.appendChild(set);
+rootSVGElement.appendChild(rect);
+
+// Setup animation test
+function sample1() {
+    shouldBeCloseEnough("rect.x.animVal.value", "100");
+    shouldBe("rect.x.baseVal.value", "100");
+}
+
+function sample2() {
+    shouldBeCloseEnough("rect.x.animVal.value", "300");
+    // change the animationType to CSS which is invalid.
+    set.setAttribute("attributeType", "CSS");
+}
+
+function sample3() {
+    // verify that the animation resets.
+    shouldBeCloseEnough("rect.x.animVal.value", "100");
+    // change the animation to a CSS animatable value.
+    set.setAttribute("attributeName", "opacity");
+    set.setAttribute("to", "0.8");
+}
+
+function sample4() {
+    shouldBeCloseEnough("getComputedStyle(rect).getPropertyCSSValue('opacity').getFloatValue(CSSPrimitiveValue.CSS_NUMBER)", "0.8");
+    // change the animation to a non-CSS animatable value.
+    set.setAttribute("attributeName", "x");
+    set.setAttribute("to", "200");
+}
+
+function sample5() {
+    // verify that the animation does not run.
+    shouldBeCloseEnough("rect.x.animVal.value", "100");
+    shouldBeCloseEnough("getComputedStyle(rect).getPropertyCSSValue('opacity').getFloatValue(CSSPrimitiveValue.CSS_NUMBER)", "1.0");
+    // change the animationType to XML which is valid.
+    set.setAttribute("attributeType", "XML");
+}
+
+function sample6() {
+    shouldBeCloseEnough("rect.x.animVal.value", "200");
+    shouldBe("rect.x.baseVal.value", "100");
+}
+
+function executeTest() {
+    const expectedValues = [
+        // [animationId, time, sampleCallback]
+        ["set", 0.0, sample1],
+        ["set", 0.5, sample2],
+        ["set", 1.0, sample3],
+        ["set", 1.5, sample4],
+        ["set", 2.0, sample5],
+        ["set", 2.5, sample6]
+    ];
+
+    runAnimationTest(expectedValues);
+}
+
+window.clickX = 150;
+var successfullyParsed = true;

diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
index 2412369..4f550fe 100644 (file)
--- a/Source/WebCore/ChangeLog
+++ b/Source/WebCore/ChangeLog
@@ -1,3 +1,52 @@
+2012-10-09  Philip Rogers  <pdr@google.com>
+
+        Prevent animation when CSS attributeType is invalid.
+        https://bugs.webkit.org/show_bug.cgi?id=94569
+
+        Reviewed by Dirk Schulze.
+
+        This patch changes hasValidAttributeType() to return false when
+        we have attributeType=CSS with a non-CSS attribute name.
+
+        Previously we would animate non-CSS attributes when attributeType was
+        CSS which resulted in crashes. To track this case, this patch catches
+        changes to targetElement, attributeName, and attributeType and checks
+        if an invalid combination is present. If invalid, hasInvalidCSSAttributeType()
+        will return true causing hasValidAttributeType() to return false and prevent
+        the animation from running.
+
+        Tests: svg/animations/animate-css-xml-attributeType.html
+               svg/animations/invalid-css-attribute-crash-expected.svg
+               svg/animations/invalid-css-attribute-crash.svg
+
+        * svg/SVGAnimateElement.cpp:
+        (WebCore::SVGAnimateElement::hasValidAttributeType):
+        (WebCore::SVGAnimateElement::targetElementWillChange):
+        * svg/SVGAnimationElement.cpp:
+        (WebCore::SVGAnimationElement::SVGAnimationElement):
+        (WebCore::SVGAnimationElement::isSupportedAttribute):
+
+            This now supports the attributeType attribute which is stored in m_attributeType.
+
+        (WebCore::SVGAnimationElement::parseAttribute):
+        (WebCore::SVGAnimationElement::setAttributeType):
+
+            Changes to attributeType, attributeName, and targetElement need to be tracked
+            to determine when an invalid combination happens.
+
+        (WebCore::SVGAnimationElement::targetElementWillChange):
+        (WebCore):
+        (WebCore::SVGAnimationElement::setAttributeName):
+        (WebCore::SVGAnimationElement::checkInvalidCSSAttributeType):
+        * svg/SVGAnimationElement.h:
+        (WebCore::SVGAnimationElement::attributeType):
+        (SVGAnimationElement):
+        (WebCore::SVGAnimationElement::hasInvalidCSSAttributeType):
+        * svg/animation/SVGSMILElement.cpp:
+        (WebCore::SVGSMILElement::targetElement):
+        * svg/animation/SVGSMILElement.h:
+        (SVGSMILElement):
+
 2012-10-09  Pravin D  <pravind.2k4@gmail.com>
 
         max-width property is does not overriding the width properties for css tables(display:table)

diff --git a/Source/WebCore/svg/SVGAnimateElement.cpp b/Source/WebCore/svg/SVGAnimateElement.cpp
index 34dd9bc..6955cde 100644 (file)
--- a/Source/WebCore/svg/SVGAnimateElement.cpp
+++ b/Source/WebCore/svg/SVGAnimateElement.cpp
@@ -56,8 +56,8 @@ bool SVGAnimateElement::hasValidAttributeType()
     SVGElement* targetElement = this->targetElement();
     if (!targetElement)
         return false;
-    
-    return m_animatedPropertyType != AnimatedUnknown;
+
+    return m_animatedPropertyType != AnimatedUnknown && !hasInvalidCSSAttributeType();
 }
 
 AnimatedPropertyType SVGAnimateElement::determineAnimatedPropertyType(SVGElement* targetElement) const
@@ -398,7 +398,7 @@ float SVGAnimateElement::calculateDistance(const String& fromString, const Strin
 
 void SVGAnimateElement::targetElementWillChange(SVGElement* currentTarget, SVGElement* newTarget)
 {
-    SVGSMILElement::targetElementWillChange(currentTarget, newTarget);
+    SVGAnimationElement::targetElementWillChange(currentTarget, newTarget);
 
     ASSERT(!m_animatedType);
     m_fromType.clear();

diff --git a/Source/WebCore/svg/SVGAnimationElement.cpp b/Source/WebCore/svg/SVGAnimationElement.cpp
index 6ace61b..bbaadbb 100644 (file)
--- a/Source/WebCore/svg/SVGAnimationElement.cpp
+++ b/Source/WebCore/svg/SVGAnimationElement.cpp
@@ -55,6 +55,8 @@ SVGAnimationElement::SVGAnimationElement(const QualifiedName& tagName, Document*
     , m_fromPropertyValueType(RegularPropertyValue)
     , m_toPropertyValueType(RegularPropertyValue)
     , m_animationValid(false)
+    , m_attributeType(AttributeTypeAuto)
+    , m_hasInvalidCSSAttributeType(false)
 {
     registerAnimatedPropertiesForSVGAnimationElement();
 }
@@ -145,6 +147,7 @@ bool SVGAnimationElement::isSupportedAttribute(const QualifiedName& attrName)
         supportedAttributes.add(SVGNames::keyTimesAttr);
         supportedAttributes.add(SVGNames::keyPointsAttr);
         supportedAttributes.add(SVGNames::keySplinesAttr);
+        supportedAttributes.add(SVGNames::attributeTypeAttr);
     }
     return supportedAttributes.contains<QualifiedName, SVGAttributeHashTranslator>(attrName);
 }
@@ -185,6 +188,11 @@ void SVGAnimationElement::parseAttribute(const Attribute& attribute)
         return;
     }
 
+    if (attribute.name() == SVGNames::attributeTypeAttr) {
+        setAttributeType(attribute.value());
+        return;
+    }
+
     if (SVGTests::parseAttribute(attribute))
         return;
     if (SVGExternalResourcesRequired::parseAttribute(attribute))
@@ -281,16 +289,17 @@ CalcMode SVGAnimationElement::calcMode() const
     return hasTagName(SVGNames::animateMotionTag) ? CalcModePaced : CalcModeLinear;
 }
 
-SVGAnimationElement::AttributeType SVGAnimationElement::attributeType() const
-{    
+void SVGAnimationElement::setAttributeType(const AtomicString& attributeType)
+{
     DEFINE_STATIC_LOCAL(const AtomicString, css, ("CSS"));
     DEFINE_STATIC_LOCAL(const AtomicString, xml, ("XML"));
-    const AtomicString& value = fastGetAttribute(SVGNames::attributeTypeAttr);
-    if (value == css)
-        return AttributeTypeCSS;
-    if (value == xml)
-        return AttributeTypeXML;
-    return AttributeTypeAuto;
+    if (attributeType == css)
+        m_attributeType = AttributeTypeCSS;
+    else if (attributeType == xml)
+        m_attributeType = AttributeTypeXML;
+    else
+        m_attributeType = AttributeTypeAuto;
+    checkInvalidCSSAttributeType(targetElement(DoNotResolveNewTarget));
 }
 
 String SVGAnimationElement::toValue() const
@@ -648,6 +657,25 @@ void SVGAnimationElement::determinePropertyValueTypes(const String& from, const
         m_toPropertyValueType = InheritValue;
 }
 
+void SVGAnimationElement::targetElementWillChange(SVGElement* currentTarget, SVGElement* newTarget)
+{
+    SVGSMILElement::targetElementWillChange(currentTarget, newTarget);
+
+    checkInvalidCSSAttributeType(newTarget);
+}
+
+void SVGAnimationElement::setAttributeName(const QualifiedName& attributeName)
+{
+    SVGSMILElement::setAttributeName(attributeName);
+
+    checkInvalidCSSAttributeType(targetElement(DoNotResolveNewTarget));
+}
+
+void SVGAnimationElement::checkInvalidCSSAttributeType(SVGElement* target)
+{
+    m_hasInvalidCSSAttributeType = target && hasValidAttributeName() && attributeType() == AttributeTypeCSS && !isTargetAttributeCSSProperty(target, attributeName());
+}
+
 }
 
 #endif // ENABLE(SVG)

diff --git a/Source/WebCore/svg/SVGAnimationElement.h b/Source/WebCore/svg/SVGAnimationElement.h
index 919a158..ec5b2fa 100644 (file)
--- a/Source/WebCore/svg/SVGAnimationElement.h
+++ b/Source/WebCore/svg/SVGAnimationElement.h
@@ -183,7 +183,7 @@ protected:
         AttributeTypeXML,
         AttributeTypeAuto
     };
-    AttributeType attributeType() const;
+    AttributeType attributeType() const { return m_attributeType; }
 
     String toValue() const;
     String byValue() const;
@@ -198,8 +198,15 @@ protected:
     AnimatedPropertyValueType m_fromPropertyValueType;
     AnimatedPropertyValueType m_toPropertyValueType;
 
+    virtual void targetElementWillChange(SVGElement* currentTarget, SVGElement* oldTarget) OVERRIDE;
+    bool hasInvalidCSSAttributeType() const { return m_hasInvalidCSSAttributeType; }
+
 private:
     virtual void animationAttributeChanged() OVERRIDE;
+    virtual void setAttributeName(const QualifiedName&) OVERRIDE;
+    void setAttributeType(const AtomicString&);
+
+    void checkInvalidCSSAttributeType(SVGElement*);
 
     virtual bool calculateToAtEndOfDurationValue(const String& toAtEndOfDurationString) = 0;
     virtual bool calculateFromAndToValues(const String& fromString, const String& toString) = 0;
@@ -230,12 +237,14 @@ private:
 
     bool m_animationValid;
 
+    AttributeType m_attributeType;
     Vector<String> m_values;
     Vector<float> m_keyTimes;
     Vector<float> m_keyPoints;
     Vector<UnitBezier> m_keySplines;
     String m_lastValuesAnimationFrom;
     String m_lastValuesAnimationTo;
+    bool m_hasInvalidCSSAttributeType;
 };
 
 } // namespace WebCore

diff --git a/Source/WebCore/svg/animation/SVGSMILElement.cpp b/Source/WebCore/svg/animation/SVGSMILElement.cpp
index 94fc55d..f4deff5 100644 (file)
--- a/Source/WebCore/svg/animation/SVGSMILElement.cpp
+++ b/Source/WebCore/svg/animation/SVGSMILElement.cpp
@@ -567,12 +567,12 @@ void SVGSMILElement::setAttributeName(const QualifiedName& attributeName)
         m_attributeName = attributeName;
 }
 
-SVGElement* SVGSMILElement::targetElement()
+SVGElement* SVGSMILElement::targetElement(ResolveTarget resolveTarget)
 {
     if (m_targetElement)
         return m_targetElement;
 
-    if (!inDocument())
+    if (!inDocument() || resolveTarget == DoNotResolveNewTarget)
         return 0;
 
     String href = getAttribute(XLinkNames::hrefAttr);

diff --git a/Source/WebCore/svg/animation/SVGSMILElement.h b/Source/WebCore/svg/animation/SVGSMILElement.h
index 7bd0f73..e1c9f16 100644 (file)
--- a/Source/WebCore/svg/animation/SVGSMILElement.h
+++ b/Source/WebCore/svg/animation/SVGSMILElement.h
@@ -58,7 +58,7 @@ public:
 
     SMILTimeContainer* timeContainer() const { return m_timeContainer.get(); }
 
-    SVGElement* targetElement();
+    SVGElement* targetElement(ResolveTarget = ResolveNewTarget);
     void resetTargetElement(ResolveTarget = ResolveNewTarget);
     const QualifiedName& attributeName() const { return m_attributeName; }
 
@@ -121,6 +121,7 @@ protected:
 
     // Sub-classes may need to take action when the target is changed.
     virtual void targetElementWillChange(SVGElement* currentTarget, SVGElement* newTarget);
+    virtual void setAttributeName(const QualifiedName&);
 
 private:
     virtual void startedActiveInterval() = 0;
@@ -142,8 +143,6 @@ private:
     void beginListChanged(SMILTime eventTime);
     void endListChanged(SMILTime eventTime);
 
-    void setAttributeName(const QualifiedName&);
-
     // This represents conditions on elements begin or end list that need to be resolved on runtime
     // for example <animate begin="otherElement.begin + 8s; button.click" ... />
     struct Condition {