<rdar://problem/5692940> Crash when attempting to get text properties in SVG with...
authoroliver@apple.com <oliver@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Thu, 17 Jan 2008 21:33:13 +0000 (21:33 +0000)
committeroliver@apple.com <oliver@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Thu, 17 Jan 2008 21:33:13 +0000 (21:33 +0000)
Reviewed by Anders

We use the element renderer to calculate the text element bounds,
however there was no check against the possibility of the text dimension
properties being requested on a element with no renderer (eg. unattached,
display: none).

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@29594 268f45cc-cd09-0410-ab3c-d52691b4dbfc

LayoutTests/ChangeLog
LayoutTests/svg/text/text-property-with-display-none-expected.txt [new file with mode: 0644]
LayoutTests/svg/text/text-property-with-display-none.html [new file with mode: 0644]
WebCore/ChangeLog
WebCore/svg/SVGTextContentElement.cpp

index c4b84d9..21ad7c7 100644 (file)
@@ -1,3 +1,12 @@
+2008-01-17  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Anders.
+
+        Layout tests for <rdar://problem/5692940> Crash when attempting to get text properties in SVG with no renderer
+
+        * svg/text/text-property-with-display-none-expected.txt: Added.
+        * svg/text/text-property-with-display-none.html: Added.
+
 2008-01-17  Alexey Proskuryakov  <ap@webkit.org>
 
         Reviewed by Darin.
diff --git a/LayoutTests/svg/text/text-property-with-display-none-expected.txt b/LayoutTests/svg/text/text-property-with-display-none-expected.txt
new file mode 100644 (file)
index 0000000..b2cdf1f
--- /dev/null
@@ -0,0 +1,2 @@
+This test is to ensure that we do not crash when attempting to determine the dimension properties of an SVG text element with no renderer.
+PASS: Did not crash when attempting to access SVG text dimensions.
diff --git a/LayoutTests/svg/text/text-property-with-display-none.html b/LayoutTests/svg/text/text-property-with-display-none.html
new file mode 100644 (file)
index 0000000..41acbf0
--- /dev/null
@@ -0,0 +1,27 @@
+<html>
+<body>
+    This test is to ensure that we do not crash when attempting to determine the dimension properties of an SVG text element with no renderer.
+    <div id="log"><span style='color: red;'>FAIL:</span> Did not complete test</div>
+<script>
+    if (window.layoutTestController)
+        layoutTestController.dumpAsText();
+    var svgns = "http://www.w3.org/2000/svg";
+    var svg = document.createElementNS(svgns, "svg");
+    svg.setAttribute("style", "width:100px;height:100px;display:none;");
+    var text = document.createElementNS(svgns, "text");
+    var textContent = document.createTextNode("text");
+    text.getNumberOfChars();
+    text.getComputedTextLength();
+    text.appendChild(textContent);
+    text.getNumberOfChars();
+    text.getComputedTextLength();
+    svg.appendChild(text);
+    text.getNumberOfChars();
+    text.getComputedTextLength();
+    document.body.appendChild(svg);
+    text.getNumberOfChars();
+    text.getComputedTextLength();
+    document.getElementById("log").innerHTML = "<span style='color: green;'>PASS:</span> Did not crash when attempting to access SVG text dimensions.";
+</script>
+</body>
+</html>
index c9b5457..bfd8b3c 100644 (file)
@@ -1,3 +1,20 @@
+2008-01-17  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Anders.
+
+        <rdar://problem/5692940> Crash when attempting to get text properties in
+        SVG with no renderer
+
+        We use the element renderer to calculate the text element bounds,
+        however there was no check against the possibility of the text dimension
+        properties being requested on a element with no renderer (eg. unattached, 
+        display: none).
+
+        Test: svg/text/text-property-with-display-none.html
+
+        * svg/SVGTextContentElement.cpp:
+        (WebCore::rootInlineBoxForTextContentElement):
+
 2008-01-17  Anders Carlsson  <andersca@apple.com>
 
         Reviewed by Oliver.
index 56fa0a1..29e22f7 100644 (file)
@@ -314,9 +314,8 @@ static Vector<SVGInlineTextBox*> findInlineTextBoxInTextChunks(const SVGTextCont
 static inline SVGRootInlineBox* rootInlineBoxForTextContentElement(const SVGTextContentElement* element)
 {
     RenderObject* object = element->renderer();
-    ASSERT(object);
-
-    if (!object->isSVGText() || object->isText())
+    
+    if (!object || !object->isSVGText() || object->isText())
         return 0;
 
     RenderSVGText* svgText = static_cast<RenderSVGText*>(object);