https://bugs.webkit.org/show_bug.cgi?id=94569
Reviewed by Dirk Schulze.
Source/WebCore:
This patch changes hasValidAttributeType() to return false when
we have attributeType=CSS with a non-CSS attribute name.
Previously we would animate non-CSS attributes when attributeType was
CSS which resulted in crashes. To track this case, this patch catches
changes to targetElement, attributeName, and attributeType and checks
if an invalid combination is present. If invalid, hasInvalidCSSAttributeType()
will return true causing hasValidAttributeType() to return false and prevent
the animation from running.
Tests: svg/animations/animate-css-xml-attributeType.html
svg/animations/invalid-css-attribute-crash-expected.svg
svg/animations/invalid-css-attribute-crash.svg
* svg/SVGAnimateElement.cpp:
(WebCore::SVGAnimateElement::hasValidAttributeType):
(WebCore::SVGAnimateElement::targetElementWillChange):
* svg/SVGAnimationElement.cpp:
(WebCore::SVGAnimationElement::SVGAnimationElement):
(WebCore::SVGAnimationElement::isSupportedAttribute):
This now supports the attributeType attribute which is stored in m_attributeType.
(WebCore::SVGAnimationElement::parseAttribute):
(WebCore::SVGAnimationElement::setAttributeType):
Changes to attributeType, attributeName, and targetElement need to be tracked
to determine when an invalid combination happens.
(WebCore::SVGAnimationElement::targetElementWillChange):
(WebCore):
(WebCore::SVGAnimationElement::setAttributeName):
(WebCore::SVGAnimationElement::checkInvalidCSSAttributeType):
* svg/SVGAnimationElement.h:
(WebCore::SVGAnimationElement::attributeType):
(SVGAnimationElement):
(WebCore::SVGAnimationElement::hasInvalidCSSAttributeType):
* svg/animation/SVGSMILElement.cpp:
(WebCore::SVGSMILElement::targetElement):
* svg/animation/SVGSMILElement.h:
(SVGSMILElement):
LayoutTests:
Adding a test to prove this patch works (invalid-css-attribute-crash.svg)
and an additional test to show that switching between XML and CSS
attributeTypes works as expected (animate-css-xml-attributeType.html).
* platform/chromium/TestExpectations:
* platform/efl/TestExpectations:
* platform/gtk/TestExpectations:
* platform/mac/TestExpectations:
* platform/qt/TestExpectations:
* platform/win/TestExpectations:
* svg/animations/animate-css-xml-attributeType-expected.txt: Added.
* svg/animations/animate-css-xml-attributeType.html: Added.
* svg/animations/invalid-css-attribute-crash-expected.svg: Added.
* svg/animations/invalid-css-attribute-crash.svg: Added.
* svg/animations/script-tests/animate-css-xml-attributeType.js: Added.
(sample1):
(sample6):
(executeTest):
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@130777
268f45cc-cd09-0410-ab3c-
d52691b4dbfc
+2012-10-09 Philip Rogers <pdr@google.com>
+
+ Prevent animation when CSS attributeType is invalid.
+ https://bugs.webkit.org/show_bug.cgi?id=94569
+
+ Reviewed by Dirk Schulze.
+
+ Adding a test to prove this patch works (invalid-css-attribute-crash.svg)
+ and an additional test to show that switching between XML and CSS
+ attributeTypes works as expected (animate-css-xml-attributeType.html).
+
+ * platform/chromium/TestExpectations:
+ * platform/efl/TestExpectations:
+ * platform/gtk/TestExpectations:
+ * platform/mac/TestExpectations:
+ * platform/qt/TestExpectations:
+ * platform/win/TestExpectations:
+ * svg/animations/animate-css-xml-attributeType-expected.txt: Added.
+ * svg/animations/animate-css-xml-attributeType.html: Added.
+ * svg/animations/invalid-css-attribute-crash-expected.svg: Added.
+ * svg/animations/invalid-css-attribute-crash.svg: Added.
+ * svg/animations/script-tests/animate-css-xml-attributeType.js: Added.
+ (sample1):
+ (sample6):
+ (executeTest):
+
2012-10-08 Simon Fraser <simon.fraser@apple.com>
Remove DRT/WTR implementations of layerTreeAsText
# reasonable.
crbug.com/19897 [ Android Linux Win ] svg/custom/getscreenctm-in-mixed-content2.xhtml [ Failure ]
+webkit.org/b/98718 svg/animations/animate-css-xml-attributeType.html [ Failure Pass ]
+
# Failing since creation in http://trac.webkit.org/changeset/75308
# Failing worse maybe since https://bugs.webkit.org/show_bug.cgi?id=53471
crbug.com/122193 svg/text/caret-in-svg-text.xhtml [ Failure ]
webkit.org/b/98651 svg/text/non-bmp-positioning-lists.svg [ Skip ]
webkit.org/b/98653 svg/text/lengthAdjust-text-metrics.html [ Failure ]
+webkit.org/b/98718 svg/animations/animate-css-xml-attributeType.html [ Failure Pass ]
+
# EFL's TestRunner does not implement setMediaType
Bug(EFL) fast/media/print-restores-previous-mediatype.html [ Failure ]
webkit.org/b/89650 [ Debug ] svg/W3C-SVG-1.1/animate-elem-85-t.svg [ Failure Pass ]
webkit.org/b/89650 svg/W3C-SVG-1.1/struct-dom-06-b.svg [ Failure Pass ]
+webkit.org/b/98718 svg/animations/animate-css-xml-attributeType.html [ Failure Pass ]
+
webkit.org/b/80158 plugins/netscape-plugin-page-cache-works.html [ Failure Pass ]
webkit.org/b/83704 media/event-attributes.html [ Failure Pass ]
webkit.org/b/89116 svg/dynamic-updates/SVGFESpecularLightingElement-svgdom-suraceScale-prop.html [ ImageOnlyFailure Pass ]
webkit.org/b/89116 svg/filters/feLighting-crash.svg [ ImageOnlyFailure Pass ]
+webkit.org/b/98718 svg/animations/animate-css-xml-attributeType.html [ Failure Pass ]
+
# Needs rebaseline after https://bugs.webkit.org/show_bug.cgi?id=79682
webkit.org/b/79682 svg/repaint/text-mask-update.svg [ Failure ImageOnlyFailure Missing Pass ]
svg/text/text-intro-05-t.svg
svg/text/text-tselect-02-f.svg
+webkit.org/b/98718 svg/animations/animate-css-xml-attributeType.html [ Failure Pass ]
+
# [Qt] svg/animations/animate-path-nested-transforms.html fails
# https://bugs.webkit.org/show_bug.cgi?id=48987
svg/animations/animate-path-nested-transforms.html
fast/text/cg-vs-atsui.html
fast/text/atsui-spacing-features.html
+webkit.org/b/98718 svg/animations/animate-css-xml-attributeType.html [ Failure Pass ]
+
# <rdar://problem/5718773> Support a minimum antialiased font size
svg/hixie/text/003.html
svg/hixie/text/003a.xml
--- /dev/null
+SVG 1.1 dynamic animation tests
+
+Tests that XML and CSS attributeTypes can be switched between.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS rect.x.animVal.value is 100
+PASS rect.x.baseVal.value is 100
+PASS rect.x.animVal.value is 300
+PASS rect.x.animVal.value is 100
+PASS getComputedStyle(rect).getPropertyCSSValue('opacity').getFloatValue(CSSPrimitiveValue.CSS_NUMBER) is 0.8
+PASS rect.x.animVal.value is 100
+PASS getComputedStyle(rect).getPropertyCSSValue('opacity').getFloatValue(CSSPrimitiveValue.CSS_NUMBER) is 1.0
+PASS rect.x.animVal.value is 200
+PASS rect.x.baseVal.value is 100
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
--- /dev/null
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src="../../fast/js/resources/js-test-pre.js"></script>
+<script src="../dynamic-updates/resources/SVGTestCase.js"></script>
+<script src="resources/SVGAnimationTestCase.js"></script>
+</head>
+<body onload="runSMILTest()">
+<h1>SVG 1.1 dynamic animation tests</h1>
+<p id="description"></p>
+<div id="console"></div>
+<script src="script-tests/animate-css-xml-attributeType.js"></script>
+</body>
+</html>
--- /dev/null
+<svg xmlns="http://www.w3.org/2000/svg">
+<text x="5" y="20">This test passes if it does not CRASH.</text>
+</svg>
--- /dev/null
+<svg xmlns="http://www.w3.org/2000/svg">
+<!-- Test for WK94569: Passes if there is no crash in animating non-CSS animations with attributeType=CSS. -->
+<text x="5" y="20">This test passes if it does not CRASH.</text>
+<feConvolveMatrix>
+<set attributeName="result" attributeType="CSS" to="inherit"></set>
+</feConvolveMatrix>
+</svg>
--- /dev/null
+description("Tests that XML and CSS attributeTypes can be switched between.");
+createSVGTestCase();
+
+// Setup test document
+var rect = createSVGElement("rect");
+rect.setAttribute("id", "rect");
+rect.setAttribute("x", "100");
+rect.setAttribute("width", "100");
+rect.setAttribute("height", "100");
+rect.setAttribute("fill", "green");
+rect.setAttribute("onclick", "executeTest()");
+
+var set = createSVGElement("set");
+set.setAttribute("id", "set");
+set.setAttribute("attributeName", "x");
+set.setAttribute("attributeType", "XML");
+set.setAttribute("to", "300");
+set.setAttribute("begin", "click");
+rect.appendChild(set);
+rootSVGElement.appendChild(rect);
+
+// Setup animation test
+function sample1() {
+ shouldBeCloseEnough("rect.x.animVal.value", "100");
+ shouldBe("rect.x.baseVal.value", "100");
+}
+
+function sample2() {
+ shouldBeCloseEnough("rect.x.animVal.value", "300");
+ // change the animationType to CSS which is invalid.
+ set.setAttribute("attributeType", "CSS");
+}
+
+function sample3() {
+ // verify that the animation resets.
+ shouldBeCloseEnough("rect.x.animVal.value", "100");
+ // change the animation to a CSS animatable value.
+ set.setAttribute("attributeName", "opacity");
+ set.setAttribute("to", "0.8");
+}
+
+function sample4() {
+ shouldBeCloseEnough("getComputedStyle(rect).getPropertyCSSValue('opacity').getFloatValue(CSSPrimitiveValue.CSS_NUMBER)", "0.8");
+ // change the animation to a non-CSS animatable value.
+ set.setAttribute("attributeName", "x");
+ set.setAttribute("to", "200");
+}
+
+function sample5() {
+ // verify that the animation does not run.
+ shouldBeCloseEnough("rect.x.animVal.value", "100");
+ shouldBeCloseEnough("getComputedStyle(rect).getPropertyCSSValue('opacity').getFloatValue(CSSPrimitiveValue.CSS_NUMBER)", "1.0");
+ // change the animationType to XML which is valid.
+ set.setAttribute("attributeType", "XML");
+}
+
+function sample6() {
+ shouldBeCloseEnough("rect.x.animVal.value", "200");
+ shouldBe("rect.x.baseVal.value", "100");
+}
+
+function executeTest() {
+ const expectedValues = [
+ // [animationId, time, sampleCallback]
+ ["set", 0.0, sample1],
+ ["set", 0.5, sample2],
+ ["set", 1.0, sample3],
+ ["set", 1.5, sample4],
+ ["set", 2.0, sample5],
+ ["set", 2.5, sample6]
+ ];
+
+ runAnimationTest(expectedValues);
+}
+
+window.clickX = 150;
+var successfullyParsed = true;
+2012-10-09 Philip Rogers <pdr@google.com>
+
+ Prevent animation when CSS attributeType is invalid.
+ https://bugs.webkit.org/show_bug.cgi?id=94569
+
+ Reviewed by Dirk Schulze.
+
+ This patch changes hasValidAttributeType() to return false when
+ we have attributeType=CSS with a non-CSS attribute name.
+
+ Previously we would animate non-CSS attributes when attributeType was
+ CSS which resulted in crashes. To track this case, this patch catches
+ changes to targetElement, attributeName, and attributeType and checks
+ if an invalid combination is present. If invalid, hasInvalidCSSAttributeType()
+ will return true causing hasValidAttributeType() to return false and prevent
+ the animation from running.
+
+ Tests: svg/animations/animate-css-xml-attributeType.html
+ svg/animations/invalid-css-attribute-crash-expected.svg
+ svg/animations/invalid-css-attribute-crash.svg
+
+ * svg/SVGAnimateElement.cpp:
+ (WebCore::SVGAnimateElement::hasValidAttributeType):
+ (WebCore::SVGAnimateElement::targetElementWillChange):
+ * svg/SVGAnimationElement.cpp:
+ (WebCore::SVGAnimationElement::SVGAnimationElement):
+ (WebCore::SVGAnimationElement::isSupportedAttribute):
+
+ This now supports the attributeType attribute which is stored in m_attributeType.
+
+ (WebCore::SVGAnimationElement::parseAttribute):
+ (WebCore::SVGAnimationElement::setAttributeType):
+
+ Changes to attributeType, attributeName, and targetElement need to be tracked
+ to determine when an invalid combination happens.
+
+ (WebCore::SVGAnimationElement::targetElementWillChange):
+ (WebCore):
+ (WebCore::SVGAnimationElement::setAttributeName):
+ (WebCore::SVGAnimationElement::checkInvalidCSSAttributeType):
+ * svg/SVGAnimationElement.h:
+ (WebCore::SVGAnimationElement::attributeType):
+ (SVGAnimationElement):
+ (WebCore::SVGAnimationElement::hasInvalidCSSAttributeType):
+ * svg/animation/SVGSMILElement.cpp:
+ (WebCore::SVGSMILElement::targetElement):
+ * svg/animation/SVGSMILElement.h:
+ (SVGSMILElement):
+
2012-10-09 Pravin D <pravind.2k4@gmail.com>
max-width property is does not overriding the width properties for css tables(display:table)
SVGElement* targetElement = this->targetElement();
if (!targetElement)
return false;
-
- return m_animatedPropertyType != AnimatedUnknown;
+
+ return m_animatedPropertyType != AnimatedUnknown && !hasInvalidCSSAttributeType();
}
AnimatedPropertyType SVGAnimateElement::determineAnimatedPropertyType(SVGElement* targetElement) const
void SVGAnimateElement::targetElementWillChange(SVGElement* currentTarget, SVGElement* newTarget)
{
- SVGSMILElement::targetElementWillChange(currentTarget, newTarget);
+ SVGAnimationElement::targetElementWillChange(currentTarget, newTarget);
ASSERT(!m_animatedType);
m_fromType.clear();
, m_fromPropertyValueType(RegularPropertyValue)
, m_toPropertyValueType(RegularPropertyValue)
, m_animationValid(false)
+ , m_attributeType(AttributeTypeAuto)
+ , m_hasInvalidCSSAttributeType(false)
{
registerAnimatedPropertiesForSVGAnimationElement();
}
supportedAttributes.add(SVGNames::keyTimesAttr);
supportedAttributes.add(SVGNames::keyPointsAttr);
supportedAttributes.add(SVGNames::keySplinesAttr);
+ supportedAttributes.add(SVGNames::attributeTypeAttr);
}
return supportedAttributes.contains<QualifiedName, SVGAttributeHashTranslator>(attrName);
}
return;
}
+ if (attribute.name() == SVGNames::attributeTypeAttr) {
+ setAttributeType(attribute.value());
+ return;
+ }
+
if (SVGTests::parseAttribute(attribute))
return;
if (SVGExternalResourcesRequired::parseAttribute(attribute))
return hasTagName(SVGNames::animateMotionTag) ? CalcModePaced : CalcModeLinear;
}
-SVGAnimationElement::AttributeType SVGAnimationElement::attributeType() const
-{
+void SVGAnimationElement::setAttributeType(const AtomicString& attributeType)
+{
DEFINE_STATIC_LOCAL(const AtomicString, css, ("CSS"));
DEFINE_STATIC_LOCAL(const AtomicString, xml, ("XML"));
- const AtomicString& value = fastGetAttribute(SVGNames::attributeTypeAttr);
- if (value == css)
- return AttributeTypeCSS;
- if (value == xml)
- return AttributeTypeXML;
- return AttributeTypeAuto;
+ if (attributeType == css)
+ m_attributeType = AttributeTypeCSS;
+ else if (attributeType == xml)
+ m_attributeType = AttributeTypeXML;
+ else
+ m_attributeType = AttributeTypeAuto;
+ checkInvalidCSSAttributeType(targetElement(DoNotResolveNewTarget));
}
String SVGAnimationElement::toValue() const
m_toPropertyValueType = InheritValue;
}
+void SVGAnimationElement::targetElementWillChange(SVGElement* currentTarget, SVGElement* newTarget)
+{
+ SVGSMILElement::targetElementWillChange(currentTarget, newTarget);
+
+ checkInvalidCSSAttributeType(newTarget);
+}
+
+void SVGAnimationElement::setAttributeName(const QualifiedName& attributeName)
+{
+ SVGSMILElement::setAttributeName(attributeName);
+
+ checkInvalidCSSAttributeType(targetElement(DoNotResolveNewTarget));
+}
+
+void SVGAnimationElement::checkInvalidCSSAttributeType(SVGElement* target)
+{
+ m_hasInvalidCSSAttributeType = target && hasValidAttributeName() && attributeType() == AttributeTypeCSS && !isTargetAttributeCSSProperty(target, attributeName());
+}
+
}
#endif // ENABLE(SVG)
AttributeTypeXML,
AttributeTypeAuto
};
- AttributeType attributeType() const;
+ AttributeType attributeType() const { return m_attributeType; }
String toValue() const;
String byValue() const;
AnimatedPropertyValueType m_fromPropertyValueType;
AnimatedPropertyValueType m_toPropertyValueType;
+ virtual void targetElementWillChange(SVGElement* currentTarget, SVGElement* oldTarget) OVERRIDE;
+ bool hasInvalidCSSAttributeType() const { return m_hasInvalidCSSAttributeType; }
+
private:
virtual void animationAttributeChanged() OVERRIDE;
+ virtual void setAttributeName(const QualifiedName&) OVERRIDE;
+ void setAttributeType(const AtomicString&);
+
+ void checkInvalidCSSAttributeType(SVGElement*);
virtual bool calculateToAtEndOfDurationValue(const String& toAtEndOfDurationString) = 0;
virtual bool calculateFromAndToValues(const String& fromString, const String& toString) = 0;
bool m_animationValid;
+ AttributeType m_attributeType;
Vector<String> m_values;
Vector<float> m_keyTimes;
Vector<float> m_keyPoints;
Vector<UnitBezier> m_keySplines;
String m_lastValuesAnimationFrom;
String m_lastValuesAnimationTo;
+ bool m_hasInvalidCSSAttributeType;
};
} // namespace WebCore
m_attributeName = attributeName;
}
-SVGElement* SVGSMILElement::targetElement()
+SVGElement* SVGSMILElement::targetElement(ResolveTarget resolveTarget)
{
if (m_targetElement)
return m_targetElement;
- if (!inDocument())
+ if (!inDocument() || resolveTarget == DoNotResolveNewTarget)
return 0;
String href = getAttribute(XLinkNames::hrefAttr);
SMILTimeContainer* timeContainer() const { return m_timeContainer.get(); }
- SVGElement* targetElement();
+ SVGElement* targetElement(ResolveTarget = ResolveNewTarget);
void resetTargetElement(ResolveTarget = ResolveNewTarget);
const QualifiedName& attributeName() const { return m_attributeName; }
// Sub-classes may need to take action when the target is changed.
virtual void targetElementWillChange(SVGElement* currentTarget, SVGElement* newTarget);
+ virtual void setAttributeName(const QualifiedName&);
private:
virtual void startedActiveInterval() = 0;
void beginListChanged(SMILTime eventTime);
void endListChanged(SMILTime eventTime);
- void setAttributeName(const QualifiedName&);
-
// This represents conditions on elements begin or end list that need to be resolved on runtime
// for example <animate begin="otherElement.begin + 8s; button.click" ... />
struct Condition {