Reviewed by Eric.
authorrwlbuis <rwlbuis@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Tue, 22 Aug 2006 18:56:33 +0000 (18:56 +0000)
committerrwlbuis <rwlbuis@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Tue, 22 Aug 2006 18:56:33 +0000 (18:56 +0000)
        http://bugzilla.opendarwin.org/show_bug.cgi?id=10402
        REPRO: SVG crashes inside gradient code

        Make sure we do not try to update the canvas resource/gradient paintserver when it is not yet built.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@15968 268f45cc-cd09-0410-ab3c-d52691b4dbfc

LayoutTests/ChangeLog
LayoutTests/svg/custom/gradient-attr-update-expected.checksum [new file with mode: 0644]
LayoutTests/svg/custom/gradient-attr-update-expected.png [new file with mode: 0644]
LayoutTests/svg/custom/gradient-attr-update-expected.txt [new file with mode: 0644]
LayoutTests/svg/custom/gradient-attr-update.svg [new file with mode: 0644]
WebCore/ChangeLog
WebCore/ksvg2/svg/SVGGradientElement.cpp

index a14974e245b88a36cabcaad77aa263d12eff029f..3ccd936645ef9dddec74eed6c11dbb24144e4312 100644 (file)
@@ -1,3 +1,16 @@
+2006-08-22  Rob Buis  <buis@kde.org>
+
+        Reviewed by Eric.
+
+        Testcase for:
+        http://bugzilla.opendarwin.org/show_bug.cgi?id=10402
+        REPRO: SVG crashes inside gradient code
+
+        * svg/custom/gradient-attr-update-expected.checksum: Added.
+        * svg/custom/gradient-attr-update-expected.png: Added.
+        * svg/custom/gradient-attr-update-expected.txt: Added.
+        * svg/custom/gradient-attr-update.svg: Added.
+
 2006-08-22  Rob Buis  <buis@kde.org>
 
         Reviewed by Eric.
diff --git a/LayoutTests/svg/custom/gradient-attr-update-expected.checksum b/LayoutTests/svg/custom/gradient-attr-update-expected.checksum
new file mode 100644 (file)
index 0000000..3a4f1f7
--- /dev/null
@@ -0,0 +1 @@
+16310588467cfc20d551635abc59b784
\ No newline at end of file
diff --git a/LayoutTests/svg/custom/gradient-attr-update-expected.png b/LayoutTests/svg/custom/gradient-attr-update-expected.png
new file mode 100644 (file)
index 0000000..3db2634
Binary files /dev/null and b/LayoutTests/svg/custom/gradient-attr-update-expected.png differ
diff --git a/LayoutTests/svg/custom/gradient-attr-update-expected.txt b/LayoutTests/svg/custom/gradient-attr-update-expected.txt
new file mode 100644 (file)
index 0000000..744bb3a
--- /dev/null
@@ -0,0 +1,6 @@
+KRenderingPaintServer {id="gradient1" [type=RADIAL-GRADIENT] [stops=[(0.00,#008000), (1.00,#008000)]][method=REFLECT] [bounding box mode=0] [center=(360,288)] [focal=(400,312)] [radius=200.00]}
+layer at (0,0) size 800x600
+  RenderView at (0,0) size 800x600
+    KCanvasContainer {svg} at (0,0) size 100x100
+      KCanvasContainer {defs} at (0,0) size 0x0
+      KCanvasItem {rect} at (0,0) size 100x100 [fill={[type=RADIAL-GRADIENT] [stops=[(0.00,#008000), (1.00,#008000)]][method=REFLECT] [bounding box mode=0] [center=(360,288)] [focal=(400,312)] [radius=200.00]}] [data="M0.00,0.00L100.00,0.00L100.00,100.00L0.00,100.00"]
diff --git a/LayoutTests/svg/custom/gradient-attr-update.svg b/LayoutTests/svg/custom/gradient-attr-update.svg
new file mode 100644 (file)
index 0000000..7b717ca
--- /dev/null
@@ -0,0 +1,35 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1 Basic//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11-basic.dtd">
+<svg version="1.1" baseProfile="basic" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" id="svg-root" width="100%" height="100%" onload="myfunc()">
+     <script>
+if (window.layoutTestController)
+    window.layoutTestController.waitUntilDone();
+
+window.setTimeout("clickNow()", 0);
+
+function myfunc() {
+        var myRect = document.getElementById("rect");
+        myRect.setAttributeNS(null, 'fill', "url(#gradient1)");
+        var myStop = document.getElementById("OF");
+        myStop.setAttributeNS(null, 'stop-color', 'green');
+        if (window.layoutTestController)
+            layoutTestController.notifyDone();
+}
+
+function clickNow() {
+    if (window.eventSender) {
+        eventSender.mouseMoveTo(20, 10);
+        eventSender.mouseDown();
+        eventSender.mouseUp();
+    }
+}
+     </script>
+     <defs>
+         <radialGradient id="gradient1" cx="45%" cy="48%" r="200" fx="50%" fy="52%" spreadMethod="reflect" gradientUnits="userSpaceOnUse">
+             <stop  offset="0.0" stop-color="green"/>
+             <stop  id="OF" offset="1" stop-color="red"/>
+         </radialGradient>
+     </defs>
+ <rect id="rect" x="0" y="0" width="100" height="100" fill="red" onclick="myfunc()"/>
+</svg>
+
index bf9326a08ebfabf3067f8079ccbc9a0091442094..cfe96061e4a5bb92e396b432a28c14b35f6a569c 100644 (file)
@@ -1,3 +1,16 @@
+2006-08-22  Rob Buis  <buis@kde.org>
+
+        Reviewed by Eric.
+
+        http://bugzilla.opendarwin.org/show_bug.cgi?id=10402
+        REPRO: SVG crashes inside gradient code
+
+        Make sure we do not try to update the canvas resource/gradient paintserver when it is not yet built.
+
+        * ksvg2/svg/SVGGradientElement.cpp:
+        (SVGGradientElement::notifyAttributeChange):
+        (SVGGradientElement::resourceNotification):
+
 2006-08-22  David Harrison  <harrison@apple.com>
 
         Reviewed by John.
index 6a14880cfe7541dbf11f62dd8a30f7a414743c6b..abe7c92b23a1a5f30d6aa110d84b7ef080c3358a 100644 (file)
@@ -103,7 +103,7 @@ void SVGGradientElement::parseMappedAttribute(MappedAttribute *attr)
 
 void SVGGradientElement::notifyAttributeChange() const
 {
-    if(ownerDocument()->parsing() || !attached())
+    if(ownerDocument()->parsing() || !attached() || !m_resource)
         return;
 
     // Update clients of this gradient resource...
@@ -135,7 +135,7 @@ KRenderingPaintServerGradient *SVGGradientElement::canvasResource()
 void SVGGradientElement::resourceNotification() const
 {
     // We're referenced by a "client", build the gradient now...
-    buildGradient(m_resource);
+    buildGradient(const_cast<SVGGradientElement*>(this)->canvasResource());
 }
 
 void SVGGradientElement::rebuildStops() const