2011-04-25 Leo Yang <leo.yang@torchmobile.com.cn>

        Reviewed by Nikolas Zimmermann.

        ASSERT failure in SVGUseElement
        https://bugs.webkit.org/show_bug.cgi?id=59313

        In SVGUseElement::insertedIntoDocument(), ASSERT(!m_isPendingResource)
        was wrong because the document may not be well-formed.

        This patch asserts the element is not pending on resource or the
        document is not well-formed.

        Test: svg/custom/use-crash-in-non-wellformed-document.svg

        * svg/SVGUseElement.cpp:
        (WebCore::isWellFormedDocument):
        (WebCore::SVGUseElement::insertedIntoDocument):
2011-04-25  Leo Yang  <leo.yang@torchmobile.com.cn>

        Reviewed by Nikolas Zimmermann.

        ASSERT failure in SVGUseElement
        https://bugs.webkit.org/show_bug.cgi?id=59313

        Test case to verify webkit doesn't crash when a <use> element
        is pending on resource and the document is not well-formed.
        Test passes if no crash occurs in debug mode.

        * svg/custom/use-crash-in-non-wellformed-document-expected.txt: Added.
        * svg/custom/use-crash-in-non-wellformed-document.svg: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@84864 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index 6d8ffc404b922728f96ecaa8f205f3444882ee06..8f9e65e762d8c7b0f9322680e29334664aa40d59 100644 (file)
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,17 @@
+2011-04-25  Leo Yang  <leo.yang@torchmobile.com.cn>
+
+        Reviewed by Nikolas Zimmermann.
+
+        ASSERT failure in SVGUseElement
+        https://bugs.webkit.org/show_bug.cgi?id=59313
+
+        Test case to verify webkit doesn't crash when a <use> element
+        is pending on resource and the document is not well-formed.
+        Test passes if no crash occurs in debug mode.
+
+        * svg/custom/use-crash-in-non-wellformed-document-expected.txt: Added.
+        * svg/custom/use-crash-in-non-wellformed-document.svg: Added.
+
 2011-04-25  Mihai Parparita  <mihaip@chromium.org>
 
         Reviewed by Tony Chang.

diff --git a/LayoutTests/svg/custom/use-crash-in-non-wellformed-document-expected.txt b/LayoutTests/svg/custom/use-crash-in-non-wellformed-document-expected.txt
new file mode 100644 (file)
index 0000000..6d9d324
--- /dev/null
+++ b/LayoutTests/svg/custom/use-crash-in-non-wellformed-document-expected.txt
@@ -0,0 +1,6 @@
+This page contains the following errors:
+
+error on line 8 at column 6: Opening and ending tag mismatch.
+Below is a rendering of the page up to the first error.
+
+

diff --git a/LayoutTests/svg/custom/use-crash-in-non-wellformed-document.svg b/LayoutTests/svg/custom/use-crash-in-non-wellformed-document.svg
new file mode 100644 (file)
index 0000000..0e07eaa
--- /dev/null
+++ b/LayoutTests/svg/custom/use-crash-in-non-wellformed-document.svg
@@ -0,0 +1,8 @@
+<?xml version="1.0" standalone="no"?>
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="1.0" width="400" height="400">
+    <script>
+        if (window.layoutTestController)
+            layoutTestController.dumpAsText();
+    </script>
+    <use xlink:href="#undefined">
+</svg>

diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
index 32534bd02d1e32b09d1428b450bd28e42e62c9cb..fea878c5217677e5d671db32a63b7a62139c0d09 100644 (file)
--- a/Source/WebCore/ChangeLog
+++ b/Source/WebCore/ChangeLog
@@ -1,3 +1,22 @@
+2011-04-25  Leo Yang  <leo.yang@torchmobile.com.cn>
+
+        Reviewed by Nikolas Zimmermann.
+
+        ASSERT failure in SVGUseElement
+        https://bugs.webkit.org/show_bug.cgi?id=59313
+
+        In SVGUseElement::insertedIntoDocument(), ASSERT(!m_isPendingResource)
+        was wrong because the document may not be well-formed.
+
+        This patch asserts the element is not pending on resource or the
+        document is not well-formed.
+
+        Test: svg/custom/use-crash-in-non-wellformed-document.svg
+
+        * svg/SVGUseElement.cpp:
+        (WebCore::isWellFormedDocument):
+        (WebCore::SVGUseElement::insertedIntoDocument):
+
 2011-04-25  Igor Oliveira  <igor.oliveira@openbossa.org>
 
         Reviewed by Tony Chang.

diff --git a/Source/WebCore/svg/SVGUseElement.cpp b/Source/WebCore/svg/SVGUseElement.cpp
index f9bbcb26f128e953dbdc8a8226eefbd741766ffc..e50ae85b71a7c6f5bf628b24d90f39afa703554c 100644 (file)
--- a/Source/WebCore/svg/SVGUseElement.cpp
+++ b/Source/WebCore/svg/SVGUseElement.cpp
@@ -127,12 +127,19 @@ void SVGUseElement::parseMappedAttribute(Attribute* attr)
     }
 }
 
+static inline bool isWellFormedDocument(Document* document)
+{
+    if (document->isSVGDocument() || document->isXHTMLDocument())
+        return static_cast<XMLDocumentParser*>(document->parser())->wellFormed();
+    return true;
+}
+
 void SVGUseElement::insertedIntoDocument()
 {
     // This functions exists to assure assumptions made in the code regarding SVGElementInstance creation/destruction are satisfied.
     SVGStyledTransformableElement::insertedIntoDocument();
-    ASSERT(!m_targetElementInstance || ((document()->isSVGDocument() || document()->isXHTMLDocument()) && !static_cast<XMLDocumentParser*>(document()->parser())->wellFormed()));
-    ASSERT(!m_isPendingResource);
+    ASSERT(!m_targetElementInstance || !isWellFormedDocument(document()));
+    ASSERT(!m_isPendingResource || !isWellFormedDocument(document()));
 }
 
 void SVGUseElement::removedFromDocument()