Rolling out r187463, because it caused memory corruption on multiple tests.
authorap@apple.com <ap@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Tue, 28 Jul 2015 16:29:44 +0000 (16:29 +0000)
committerap@apple.com <ap@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Tue, 28 Jul 2015 16:29:44 +0000 (16:29 +0000)
Original bug:
Crash happens when calling removeEventListener for an SVG element which has an instance inside a <defs> element of shadow tree
https://bugs.webkit.org/show_bug.cgi?id=147290

* svg/custom/remove-event-listener-shadow-disallowed-element-expected.txt: Removed.
* svg/custom/remove-event-listener-shadow-disallowed-element.svg: Removed.
Source/WebCore:

* svg/SVGUseElement.cpp:
(WebCore::removeDisallowedElementsFromSubtree):
(WebCore::associateClonesWithOriginals):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@187486 268f45cc-cd09-0410-ab3c-d52691b4dbfc

LayoutTests/ChangeLog
LayoutTests/svg/custom/remove-event-listener-shadow-disallowed-element-expected.txt [deleted file]
LayoutTests/svg/custom/remove-event-listener-shadow-disallowed-element.svg [deleted file]
Source/WebCore/ChangeLog
Source/WebCore/svg/SVGUseElement.cpp

index 27bf53d..3eb31ea 100644 (file)
@@ -1,3 +1,14 @@
+2015-07-28  Alexey Proskuryakov  <ap@apple.com>
+
+        Rolling out r187463, because it caused memory corruption on multiple tests.
+
+        Original bug:
+        Crash happens when calling removeEventListener for an SVG element which has an instance inside a <defs> element of shadow tree
+        https://bugs.webkit.org/show_bug.cgi?id=147290
+
+        * svg/custom/remove-event-listener-shadow-disallowed-element-expected.txt: Removed.
+        * svg/custom/remove-event-listener-shadow-disallowed-element.svg: Removed.
+
 2015-07-27  Yusuke Suzuki  <utatane.tea@gmail.com>
 
         SparseValueMap check is skipped when the butterfly's vectorLength is larger than the access-requested index
 2015-07-27  Yusuke Suzuki  <utatane.tea@gmail.com>
 
         SparseValueMap check is skipped when the butterfly's vectorLength is larger than the access-requested index
diff --git a/LayoutTests/svg/custom/remove-event-listener-shadow-disallowed-element-expected.txt b/LayoutTests/svg/custom/remove-event-listener-shadow-disallowed-element-expected.txt
deleted file mode 100644 (file)
index a567c4b..0000000
+++ /dev/null
@@ -1 +0,0 @@
-Pass.
diff --git a/LayoutTests/svg/custom/remove-event-listener-shadow-disallowed-element.svg b/LayoutTests/svg/custom/remove-event-listener-shadow-disallowed-element.svg
deleted file mode 100644 (file)
index 79ae24a..0000000
+++ /dev/null
@@ -1,37 +0,0 @@
-<svg version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
-
-  <defs>
-    <svg id="green-svg" width="100" height="100">
-      <defs>
-         <rect id="green-rect" fill="green" width="100" height="100"/>
-      </defs>
-      <use id="use-green-rect" xlink:href="#green-rect"/>
-    </svg>
-  </defs>  
-
-  <use id="use-green-svg" x="10" y="10" xlink:href="#green-svg"/>
-  <text>Pass.</text>
-
-  <script>
-   if (window.testRunner)
-      testRunner.dumpAsText();
-    
-    var onAlert = function() {
-      alert("test");
-    }
-
-    // This removeEventListener() has to be called before the onload fires. Before
-    // onload fires, the shadow tree of the SVGUseElement is not built. So this
-    // call should affect the original element only. Once the shadow tree is built,
-    // the SVGUseElement calls updateShadowTree() and this is where we want to make
-    // sure the eventListeners of all the cloned elements in the shadow tree are
-    // updated correctly and the disallowed cloned elements and their descendants
-    //  are disconnected from their corresponding elements.
-    document.getElementById("green-rect").addEventListener("click", onAlert);
-    
-    window.addEventListener("load", function () {
-      document.getElementById("green-rect").removeEventListener("click", onAlert);
-    }, false);
-  </script>
-
-</svg>
\ No newline at end of file
index 0022171..a64ec4d 100644 (file)
@@ -1,3 +1,18 @@
+2015-07-28  Alexey Proskuryakov  <ap@apple.com>
+
+        Rolling out r187463, because it caused memory corruption on multiple tests.
+
+        Original bug:
+        Crash happens when calling removeEventListener for an SVG element which has an instance inside a <defs> element of shadow tree
+        https://bugs.webkit.org/show_bug.cgi?id=147290
+
+        * svg/custom/remove-event-listener-shadow-disallowed-element-expected.txt: Removed.
+        * svg/custom/remove-event-listener-shadow-disallowed-element.svg: Removed.
+
+        * svg/SVGUseElement.cpp:
+        (WebCore::removeDisallowedElementsFromSubtree):
+        (WebCore::associateClonesWithOriginals):
+
 2015-07-28  Carlos Garcia Campos  <cgarcia@igalia.com>
 
         [GTK] Use fastMalloc instead of g_slice
 2015-07-28  Carlos Garcia Campos  <cgarcia@igalia.com>
 
         [GTK] Use fastMalloc instead of g_slice
index 4db5be0..6897cdc 100644 (file)
@@ -329,11 +329,8 @@ static void removeDisallowedElementsFromSubtree(SVGElement& subtree)
         }
         ++it;
     }
         }
         ++it;
     }
-    for (auto* element : disallowedElements) {
+    for (auto* element : disallowedElements)
         element->parentNode()->removeChild(element);
         element->parentNode()->removeChild(element);
-        for (auto& descendant : descendantsOfType<SVGElement>(*element))
-            descendant.setCorrespondingElement(nullptr);
-    }
 }
 
 static void associateClonesWithOriginals(SVGElement& clone, SVGElement& original)
 }
 
 static void associateClonesWithOriginals(SVGElement& clone, SVGElement& original)