Reviewed by Eric & Oliver.

Fixes: http://bugs.webkit.org/show_bug.cgi?id=14198
Reeanble <foreignObject>. Explicitely disallow <use> on <foreignObject>
as it may lead to bad problems.

While I'm at it disallow <use> on any non-svg element.

Not reviewed.
Forgot to commit new layout tests results, now that <foreignObject> is enabled again.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@26412 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index 1df5efa53cebf5bb56d336c77e6858fb25288de0..55b73505d4c66a0eb4f76f1f0ec4b7f4b31b2c8c 100644 (file)
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,62 @@
+2007-06-20  Nikolas Zimmermann  <zimmermann@kde.org>
+
+        Not reviewed.
+        
+        Forgot to commit new layout tests results, now that <foreignObject> is enabled again.
+
+        * svg/W3C-SVG-1.1/masking-mask-01-b-expected.checksum:
+        * svg/W3C-SVG-1.1/masking-mask-01-b-expected.png:
+        * svg/custom/baseval-animval-equality-expected.checksum:
+        * svg/custom/baseval-animval-equality-expected.png:
+        * svg/custom/baseval-animval-equality-expected.txt:
+        * svg/custom/dynamic-svg-document-creation-expected.checksum:
+        * svg/custom/dynamic-svg-document-creation-expected.png:
+        * svg/custom/dynamic-svg-document-creation-expected.txt:
+        * svg/custom/foreign-object-skew-expected.checksum:
+        * svg/custom/foreign-object-skew-expected.png:
+        * svg/custom/foreign-object-skew-expected.txt:
+        * svg/custom/grayscale-gradient-mask-expected.checksum:
+        * svg/custom/grayscale-gradient-mask-expected.png:
+        * svg/custom/stroke-width-click-expected.txt:
+        * svg/hixie/mixed/006-expected.checksum:
+        * svg/hixie/mixed/006-expected.png:
+        * svg/hixie/mixed/006-expected.txt:
+        * svg/hixie/mixed/007-expected.checksum:
+        * svg/hixie/mixed/007-expected.png:
+        * svg/hixie/mixed/007-expected.txt:
+        * svg/hixie/mixed/008-expected.checksum:
+        * svg/hixie/mixed/008-expected.png:
+        * svg/hixie/mixed/008-expected.txt:
+        * svg/hixie/mixed/009-expected.checksum:
+        * svg/hixie/mixed/009-expected.png:
+        * svg/hixie/mixed/009-expected.txt:
+        * svg/hixie/mixed/011-expected.checksum:
+        * svg/hixie/mixed/011-expected.png:
+        * svg/hixie/mixed/011-expected.txt:
+
+2007-06-20  Nikolas Zimmermann  <zimmermann@kde.org>
+
+        Reviewed by Eric & Oliver.
+
+        Adding new testcase assuring <use> on <foreignObject> doesn't work.
+
+        * svg/custom/use-on-disallowed-foreign-object-1-expected.checksum: Added.
+        * svg/custom/use-on-disallowed-foreign-object-1-expected.png: Added.
+        * svg/custom/use-on-disallowed-foreign-object-1-expected.txt: Added.
+        * svg/custom/use-on-disallowed-foreign-object-1.svg: Added.
+        * svg/custom/use-on-disallowed-foreign-object-2-expected.checksum: Added.
+        * svg/custom/use-on-disallowed-foreign-object-2-expected.png: Added.
+        * svg/custom/use-on-disallowed-foreign-object-2-expected.txt: Added.
+        * svg/custom/use-on-disallowed-foreign-object-2.svg: Added.
+        * svg/custom/use-on-disallowed-foreign-object-3-expected.checksum: Added.
+        * svg/custom/use-on-disallowed-foreign-object-3-expected.png: Added.
+        * svg/custom/use-on-disallowed-foreign-object-3-expected.txt: Added.
+        * svg/custom/use-on-disallowed-foreign-object-3.svg: Added.
+        * svg/custom/use-on-disallowed-foreign-object-4-expected.checksum: Added.
+        * svg/custom/use-on-disallowed-foreign-object-4-expected.png: Added.
+        * svg/custom/use-on-disallowed-foreign-object-4-expected.txt: Added.
+        * svg/custom/use-on-disallowed-foreign-object-4.svg: Added.
+
 2007-06-19  Rob Buis  <buis@kde.org>
 
         Reviewed by Oliver.

diff --git a/LayoutTests/svg/custom/stroke-width-click-expected.txt b/LayoutTests/svg/custom/stroke-width-click-expected.txt
index 8b137891791fe96927ad78e64b0aad7bded08bdc..511d62f61e15e240915006b1f73403589690d623 100644 (file)
--- a/LayoutTests/svg/custom/stroke-width-click-expected.txt
+++ b/LayoutTests/svg/custom/stroke-width-click-expected.txt
@@ -1 +1,14 @@
+SUCCESS: click at 10, 10 was correctly ignored
+SUCCESS: click received at: 30, 100
+SUCCESS: click at 29, 100 was correctly ignored
+SUCCESS: click received at: 30, 50
+SUCCESS: click at 30, 49 was correctly ignored
+SUCCESS: click received at: 30, 150
+SUCCESS: click at 30, 151 was correctly ignored
+SUCCESS: click received at: 300, 100
+SUCCESS: click at 301, 100 was correctly ignored
+SUCCESS: click received at: 300, 50
+SUCCESS: click at 300, 49 was correctly ignored
+SUCCESS: click received at: 300, 150
+SUCCESS: click at 300, 151 was correctly ignored
 

diff --git a/LayoutTests/svg/custom/use-on-disallowed-foreign-object-1-expected.checksum b/LayoutTests/svg/custom/use-on-disallowed-foreign-object-1-expected.checksum
new file mode 100644 (file)
index 0000000..b37244e
--- /dev/null
+++ b/LayoutTests/svg/custom/use-on-disallowed-foreign-object-1-expected.checksum
@@ -0,0 +1 @@
+e81802f52a73f3e6016c64d62aa87239
\ No newline at end of file

diff --git a/LayoutTests/svg/custom/use-on-disallowed-foreign-object-1-expected.png b/LayoutTests/svg/custom/use-on-disallowed-foreign-object-1-expected.png
new file mode 100644 (file)
index 0000000..898ba89
Binary files /dev/null and b/LayoutTests/svg/custom/use-on-disallowed-foreign-object-1-expected.png differ

diff --git a/LayoutTests/svg/custom/use-on-disallowed-foreign-object-1-expected.txt b/LayoutTests/svg/custom/use-on-disallowed-foreign-object-1-expected.txt
new file mode 100644 (file)
index 0000000..7707688
--- /dev/null
+++ b/LayoutTests/svg/custom/use-on-disallowed-foreign-object-1-expected.txt
@@ -0,0 +1,8 @@
+layer at (0,0) size 800x600
+  RenderView at (0,0) size 800x600
+    RenderSVGContainer {svg} at (0,0) size 0x0
+      RenderForeignObject {foreignObject} at (0,0) size 480x360
+        RenderBlock {xhtml:div} at (0,0) size 480x18
+          RenderText {#text} at (0,0) size 244x18
+            text run at (0,0) width 244: "You should only see this string ONCE"
+      RenderSVGContainer {use} at (250,-50) size 0x0 [transform={m=((0.71,0.71)(-0.71,0.71)) t=(250.00,-50.00)}]

diff --git a/LayoutTests/svg/custom/use-on-disallowed-foreign-object-1.svg b/LayoutTests/svg/custom/use-on-disallowed-foreign-object-1.svg
new file mode 100644 (file)
index 0000000..561ac00
--- /dev/null
+++ b/LayoutTests/svg/custom/use-on-disallowed-foreign-object-1.svg
@@ -0,0 +1,11 @@
+<?xml version="1.0"?>
+<svg xmlns="http://www.w3.org/2000/svg"
+     xmlns:xlink="http://www.w3.org/1999/xlink"
+     xmlns:xhtml="http://www.w3.org/1999/xhtml">
+
+<foreignObject id="foreign" x="10" y="10" width="480" height="360" transform="scale(5) skewY(5) skewX(5)">
+<xhtml:div>You should only see this string ONCE</xhtml:div>
+</foreignObject>
+
+<use xlink:href="#foreign" x="10" y="10" width="200" height="200" transform="translate(250 -50) rotate(45)"/>
+</svg>

diff --git a/LayoutTests/svg/custom/use-on-disallowed-foreign-object-2-expected.checksum b/LayoutTests/svg/custom/use-on-disallowed-foreign-object-2-expected.checksum
new file mode 100644 (file)
index 0000000..b37244e
--- /dev/null
+++ b/LayoutTests/svg/custom/use-on-disallowed-foreign-object-2-expected.checksum
@@ -0,0 +1 @@
+e81802f52a73f3e6016c64d62aa87239
\ No newline at end of file

diff --git a/LayoutTests/svg/custom/use-on-disallowed-foreign-object-2-expected.png b/LayoutTests/svg/custom/use-on-disallowed-foreign-object-2-expected.png
new file mode 100644 (file)
index 0000000..898ba89
Binary files /dev/null and b/LayoutTests/svg/custom/use-on-disallowed-foreign-object-2-expected.png differ

diff --git a/LayoutTests/svg/custom/use-on-disallowed-foreign-object-2-expected.txt b/LayoutTests/svg/custom/use-on-disallowed-foreign-object-2-expected.txt
new file mode 100644 (file)
index 0000000..8c598bb
--- /dev/null
+++ b/LayoutTests/svg/custom/use-on-disallowed-foreign-object-2-expected.txt
@@ -0,0 +1,10 @@
+layer at (0,0) size 800x600
+  RenderView at (0,0) size 800x600
+    RenderSVGContainer {svg} at (0,0) size 0x0
+      RenderSVGContainer {g} at (0,0) size 0x0
+        RenderSVGContainer {g} at (0,0) size 0x0
+          RenderForeignObject {foreignObject} at (0,0) size 580x380
+            RenderBlock {xhtml:div} at (0,0) size 580x18
+              RenderText {#text} at (0,0) size 244x18
+                text run at (0,0) width 244: "You should only see this string ONCE"
+      RenderSVGContainer {use} at (250,-50) size 0x0 [transform={m=((0.71,0.71)(-0.71,0.71)) t=(250.00,-50.00)}]

diff --git a/LayoutTests/svg/custom/use-on-disallowed-foreign-object-2.svg b/LayoutTests/svg/custom/use-on-disallowed-foreign-object-2.svg
new file mode 100644 (file)
index 0000000..fb9c2bd
--- /dev/null
+++ b/LayoutTests/svg/custom/use-on-disallowed-foreign-object-2.svg
@@ -0,0 +1,14 @@
+<?xml version="1.0"?>
+<svg xmlns="http://www.w3.org/2000/svg"
+     xmlns:xlink="http://www.w3.org/1999/xlink"
+     xmlns:xhtml="http://www.w3.org/1999/xhtml">
+
+<g id="foreign"><g>
+<foreignObject x="10" y="10" width="580" height="380" transform="scale(5) skewY(5) skewX(5)">
+<xhtml:div>You should only see this string ONCE</xhtml:div>
+</foreignObject>
+</g></g>
+
+<use xlink:href="#foreign" x="10" y="10" width="200" height="200" transform="translate(250 -50) rotate(45)"/>
+
+</svg>

diff --git a/LayoutTests/svg/custom/use-on-disallowed-foreign-object-3-expected.checksum b/LayoutTests/svg/custom/use-on-disallowed-foreign-object-3-expected.checksum
new file mode 100644 (file)
index 0000000..b37244e
--- /dev/null
+++ b/LayoutTests/svg/custom/use-on-disallowed-foreign-object-3-expected.checksum
@@ -0,0 +1 @@
+e81802f52a73f3e6016c64d62aa87239
\ No newline at end of file

diff --git a/LayoutTests/svg/custom/use-on-disallowed-foreign-object-3-expected.png b/LayoutTests/svg/custom/use-on-disallowed-foreign-object-3-expected.png
new file mode 100644 (file)
index 0000000..898ba89
Binary files /dev/null and b/LayoutTests/svg/custom/use-on-disallowed-foreign-object-3-expected.png differ

diff --git a/LayoutTests/svg/custom/use-on-disallowed-foreign-object-3-expected.txt b/LayoutTests/svg/custom/use-on-disallowed-foreign-object-3-expected.txt
new file mode 100644 (file)
index 0000000..c788872
--- /dev/null
+++ b/LayoutTests/svg/custom/use-on-disallowed-foreign-object-3-expected.txt
@@ -0,0 +1,9 @@
+layer at (0,0) size 800x600
+  RenderView at (0,0) size 800x600
+    RenderSVGContainer {svg} at (0,0) size 0x0
+      RenderForeignObject {foreignObject} at (0,0) size 580x380
+        RenderBlock {xhtml:div} at (0,0) size 580x18
+          RenderText {#text} at (0,0) size 244x18
+            text run at (0,0) width 244: "You should only see this string ONCE"
+      RenderSVGContainer {use} at (250,-50) size 0x0 [transform={m=((0.71,0.71)(-0.71,0.71)) t=(250.00,-50.00)}]
+      RenderSVGContainer {use} at (250,-50) size 0x0 [transform={m=((0.71,0.71)(-0.71,0.71)) t=(250.00,-50.00)}]

diff --git a/LayoutTests/svg/custom/use-on-disallowed-foreign-object-3.svg b/LayoutTests/svg/custom/use-on-disallowed-foreign-object-3.svg
new file mode 100644 (file)
index 0000000..a0cdb12
--- /dev/null
+++ b/LayoutTests/svg/custom/use-on-disallowed-foreign-object-3.svg
@@ -0,0 +1,13 @@
+<?xml version="1.0"?>
+<svg xmlns="http://www.w3.org/2000/svg"
+     xmlns:xlink="http://www.w3.org/1999/xlink"
+     xmlns:xhtml="http://www.w3.org/1999/xhtml">
+
+<foreignObject id="foreign" x="10" y="10" width="580" height="380" transform="scale(5) skewY(5) skewX(5)">
+<xhtml:div>You should only see this string ONCE</xhtml:div>
+</foreignObject>
+
+<use id="test" xlink:href="#foreign" x="10" y="10" width="200" height="200" transform="translate(250 -50) rotate(45)"/>
+<use xlink:href="#test" x="10" y="10" width="200" height="200" transform="translate(250 -50) rotate(45)"/>
+
+</svg>

diff --git a/LayoutTests/svg/custom/use-on-disallowed-foreign-object-4-expected.checksum b/LayoutTests/svg/custom/use-on-disallowed-foreign-object-4-expected.checksum
new file mode 100644 (file)
index 0000000..b37244e
--- /dev/null
+++ b/LayoutTests/svg/custom/use-on-disallowed-foreign-object-4-expected.checksum
@@ -0,0 +1 @@
+e81802f52a73f3e6016c64d62aa87239
\ No newline at end of file

diff --git a/LayoutTests/svg/custom/use-on-disallowed-foreign-object-4-expected.png b/LayoutTests/svg/custom/use-on-disallowed-foreign-object-4-expected.png
new file mode 100644 (file)
index 0000000..898ba89
Binary files /dev/null and b/LayoutTests/svg/custom/use-on-disallowed-foreign-object-4-expected.png differ

diff --git a/LayoutTests/svg/custom/use-on-disallowed-foreign-object-4-expected.txt b/LayoutTests/svg/custom/use-on-disallowed-foreign-object-4-expected.txt
new file mode 100644 (file)
index 0000000..554295c
--- /dev/null
+++ b/LayoutTests/svg/custom/use-on-disallowed-foreign-object-4-expected.txt
@@ -0,0 +1,11 @@
+layer at (0,0) size 800x600
+  RenderView at (0,0) size 800x600
+    RenderSVGContainer {svg} at (0,0) size 0x0
+      RenderSVGContainer {g} at (0,0) size 0x0
+        RenderSVGContainer {g} at (0,0) size 0x0
+          RenderForeignObject {foreignObject} at (0,0) size 580x380
+            RenderBlock {xhtml:div} at (0,0) size 580x18
+              RenderText {#text} at (0,0) size 244x18
+                text run at (0,0) width 244: "You should only see this string ONCE"
+      RenderSVGContainer {use} at (250,-50) size 0x0 [transform={m=((0.71,0.71)(-0.71,0.71)) t=(250.00,-50.00)}]
+      RenderSVGContainer {use} at (250,-50) size 0x0 [transform={m=((0.71,0.71)(-0.71,0.71)) t=(250.00,-50.00)}]

diff --git a/LayoutTests/svg/custom/use-on-disallowed-foreign-object-4.svg b/LayoutTests/svg/custom/use-on-disallowed-foreign-object-4.svg
new file mode 100644 (file)
index 0000000..a350f3f
--- /dev/null
+++ b/LayoutTests/svg/custom/use-on-disallowed-foreign-object-4.svg
@@ -0,0 +1,15 @@
+<?xml version="1.0"?>
+<svg xmlns="http://www.w3.org/2000/svg"
+     xmlns:xlink="http://www.w3.org/1999/xlink"
+     xmlns:xhtml="http://www.w3.org/1999/xhtml">
+
+<g id="foreign"><g>
+<foreignObject x="10" y="10" width="580" height="380" transform="scale(5) skewY(5) skewX(5)">
+<xhtml:div>You should only see this string ONCE</xhtml:div>
+</foreignObject>
+</g></g>
+
+<use id="test" xlink:href="#foreign" x="10" y="10" width="200" height="200" transform="translate(250 -50) rotate(45)"/>
+<use xlink:href="#test" x="10" y="10" width="200" height="200" transform="translate(250 -50) rotate(45)"/>
+
+</svg>

diff --git a/LayoutTests/svg/custom/use-on-non-svg-namespaced-element-expected.checksum b/LayoutTests/svg/custom/use-on-non-svg-namespaced-element-expected.checksum
new file mode 100644 (file)
index 0000000..b37244e
--- /dev/null
+++ b/LayoutTests/svg/custom/use-on-non-svg-namespaced-element-expected.checksum
@@ -0,0 +1 @@
+e81802f52a73f3e6016c64d62aa87239
\ No newline at end of file

diff --git a/LayoutTests/svg/custom/use-on-non-svg-namespaced-element-expected.png b/LayoutTests/svg/custom/use-on-non-svg-namespaced-element-expected.png
new file mode 100644 (file)
index 0000000..898ba89
Binary files /dev/null and b/LayoutTests/svg/custom/use-on-non-svg-namespaced-element-expected.png differ

diff --git a/LayoutTests/svg/custom/use-on-non-svg-namespaced-element-expected.txt b/LayoutTests/svg/custom/use-on-non-svg-namespaced-element-expected.txt
new file mode 100644 (file)
index 0000000..7707688
--- /dev/null
+++ b/LayoutTests/svg/custom/use-on-non-svg-namespaced-element-expected.txt
@@ -0,0 +1,8 @@
+layer at (0,0) size 800x600
+  RenderView at (0,0) size 800x600
+    RenderSVGContainer {svg} at (0,0) size 0x0
+      RenderForeignObject {foreignObject} at (0,0) size 480x360
+        RenderBlock {xhtml:div} at (0,0) size 480x18
+          RenderText {#text} at (0,0) size 244x18
+            text run at (0,0) width 244: "You should only see this string ONCE"
+      RenderSVGContainer {use} at (250,-50) size 0x0 [transform={m=((0.71,0.71)(-0.71,0.71)) t=(250.00,-50.00)}]

diff --git a/LayoutTests/svg/custom/use-on-non-svg-namespaced-element.svg b/LayoutTests/svg/custom/use-on-non-svg-namespaced-element.svg
new file mode 100644 (file)
index 0000000..61b2792
--- /dev/null
+++ b/LayoutTests/svg/custom/use-on-non-svg-namespaced-element.svg
@@ -0,0 +1,11 @@
+<?xml version="1.0"?>
+<svg xmlns="http://www.w3.org/2000/svg"
+     xmlns:xlink="http://www.w3.org/1999/xlink"
+     xmlns:xhtml="http://www.w3.org/1999/xhtml">
+
+<foreignObject x="10" y="10" width="480" height="360" transform="scale(5) skewY(5) skewX(5)">
+<xhtml:div id="foreign">You should only see this string ONCE</xhtml:div>
+</foreignObject>
+
+<use xlink:href="#foreign" x="10" y="10" width="200" height="200" transform="translate(250 -50) rotate(45)"/>
+</svg>

diff --git a/WebCore/ChangeLog b/WebCore/ChangeLog
index 05d06490f1559a8871a0a2a7725b2db42f3c5da5..206bb54b991226a87f4c9a5a9161e6b3d47d3d5a 100644 (file)
--- a/WebCore/ChangeLog
+++ b/WebCore/ChangeLog
@@ -1,3 +1,28 @@
+2007-06-20  Nikolas Zimmermann  <zimmermann@kde.org>
+
+        Reviewed by Eric & Oliver.
+
+        Fixes: http://bugs.webkit.org/show_bug.cgi?id=14198
+
+        Reeanble <foreignObject>. Explicitely disallow <use> on <foreignObject>
+        as it may lead to bad problems. 
+
+        While I'm at it disallow <use> on any non-svg element.
+
+        * bindings/js/JSSVGElementWrapperFactory.cpp:
+        * bindings/objc/DOM.mm:
+        (WebCore::createElementClassMap):
+        * ksvg2/svg/SVGForeignObjectElement.cpp:
+        * ksvg2/svg/SVGForeignObjectElement.h:
+        * ksvg2/svg/SVGForeignObjectElement.idl:
+        * ksvg2/svg/SVGLocatable.cpp:
+        (WebCore::SVGLocatable::nearestViewportElement):
+        (WebCore::SVGLocatable::farthestViewportElement):
+        * ksvg2/svg/SVGUseElement.cpp:
+        (WebCore::SVGUseElement::buildPendingResource):
+        * ksvg2/svg/svgtags.in:
+        * rendering/RenderForeignObject.cpp:
+
 2007-06-19  Rob Buis  <buis@kde.org>
 
         Reviewed by Oliver.

diff --git a/WebCore/bindings/js/JSSVGElementWrapperFactory.cpp b/WebCore/bindings/js/JSSVGElementWrapperFactory.cpp
index ee3c7d2569e347d7ab1cc5e048942e899b52e6d1..e47bad30e63e55695ab803fe72abdd060f3ed347 100644 (file)
--- a/WebCore/bindings/js/JSSVGElementWrapperFactory.cpp
+++ b/WebCore/bindings/js/JSSVGElementWrapperFactory.cpp
@@ -230,6 +230,7 @@ typedef JSNode* (*CreateSVGElementWrapperFunction)(ExecState*, PassRefPtr<SVGEle
     macro(defs, Defs) \
     macro(desc, Desc) \
     macro(ellipse, Ellipse) \
+    macro(foreignObject, ForeignObject) \
     macro(g, G) \
     macro(image, Image) \
     macro(linearGradient, LinearGradient) \

diff --git a/WebCore/bindings/objc/DOM.mm b/WebCore/bindings/objc/DOM.mm
index 952e1782ddd066aca66a6e80b666982fba9ce61a..45f015b37da270753dba8ba568da83e919a305cc 100644 (file)
--- a/WebCore/bindings/objc/DOM.mm
+++ b/WebCore/bindings/objc/DOM.mm
@@ -222,8 +222,8 @@ static void createElementClassMap()
     addElementClass(SVGNames::feTileTag, [DOMSVGFETileElement class]);
     addElementClass(SVGNames::feTurbulenceTag, [DOMSVGFETurbulenceElement class]);
     addElementClass(SVGNames::filterTag, [DOMSVGFilterElement class]);
-    addElementClass(SVGNames::foreignObjectTag, [DOMSVGForeignObjectElement class]);
 #endif
+    addElementClass(SVGNames::foreignObjectTag, [DOMSVGForeignObjectElement class]);
     addElementClass(SVGNames::gTag, [DOMSVGGElement class]);
     addElementClass(SVGNames::imageTag, [DOMSVGImageElement class]);
     addElementClass(SVGNames::lineTag, [DOMSVGLineElement class]);

diff --git a/WebCore/ksvg2/svg/SVGForeignObjectElement.cpp b/WebCore/ksvg2/svg/SVGForeignObjectElement.cpp
index 698b54671ff9102f48876b7b2797ebc6efce91da..c9ff6354be2d1ac94f74e502178b6affd2e8be60 100644 (file)
--- a/WebCore/ksvg2/svg/SVGForeignObjectElement.cpp
+++ b/WebCore/ksvg2/svg/SVGForeignObjectElement.cpp
@@ -21,18 +21,16 @@
 
 #include "config.h"
 
-#if ENABLE(SVG) && ENABLE(SVG_EXPERIMENTAL_FEATURES)
-
+#if ENABLE(SVG)
 #include "SVGForeignObjectElement.h"
 
+#include "CSSPropertyNames.h"
+#include "RenderForeignObject.h"
 #include "SVGNames.h"
 #include "SVGLength.h"
-#include "RenderForeignObject.h"
 
 #include <wtf/Assertions.h>
 
-#include "CSSPropertyNames.h"
-
 namespace WebCore {
 
 SVGForeignObjectElement::SVGForeignObjectElement(const QualifiedName& tagName, Document *doc)

diff --git a/WebCore/ksvg2/svg/SVGForeignObjectElement.h b/WebCore/ksvg2/svg/SVGForeignObjectElement.h
index a50df3a2ad5321831864c8609d8d2b56e138fc7b..133c7b399b49a96d8bfb255884eb2a496b0e8843 100644 (file)
--- a/WebCore/ksvg2/svg/SVGForeignObjectElement.h
+++ b/WebCore/ksvg2/svg/SVGForeignObjectElement.h
@@ -22,7 +22,7 @@
 #ifndef SVGForeignObjectElement_h
 #define SVGForeignObjectElement_h
 
-#if ENABLE(SVG) && ENABLE(SVG_EXPERIMENTAL_FEATURES)
+#if ENABLE(SVG)
 
 #include "SVGTests.h"
 #include "SVGLangSpace.h"

diff --git a/WebCore/ksvg2/svg/SVGForeignObjectElement.idl b/WebCore/ksvg2/svg/SVGForeignObjectElement.idl
index 3b7ceb1d4247a1989f76e2fa137dd543c492dce9..2f1af2c5f9727568e1326c819c2523f7f63c9e16 100644 (file)
--- a/WebCore/ksvg2/svg/SVGForeignObjectElement.idl
+++ b/WebCore/ksvg2/svg/SVGForeignObjectElement.idl
@@ -25,7 +25,7 @@
 
 module svg {
 
-    interface [Conditional=SVG&SVG_EXPERIMENTAL_FEATURES] SVGForeignObjectElement : SVGElement,
+    interface [Conditional=SVG] SVGForeignObjectElement : SVGElement,
                                                           SVGTests,
                                                           SVGLangSpace,
                                                           SVGExternalResourcesRequired,

diff --git a/WebCore/ksvg2/svg/SVGLocatable.cpp b/WebCore/ksvg2/svg/SVGLocatable.cpp
index eace5a52ca204d20d08728c1d1d6a23534f09afc..28d2a3aec192af7acb1bf75073edcd2eaadd251d 100644 (file)
--- a/WebCore/ksvg2/svg/SVGLocatable.cpp
+++ b/WebCore/ksvg2/svg/SVGLocatable.cpp
@@ -45,11 +45,7 @@ SVGElement* SVGLocatable::nearestViewportElement(const SVGStyledElement* e)
     Node* n = e->parentNode();
     while (n && !n->isDocumentNode()) {
         if (n->hasTagName(SVGNames::svgTag) || n->hasTagName(SVGNames::symbolTag) ||
-            n->hasTagName(SVGNames::imageTag)
-#if ENABLE(SVG_EXPERIMENTAL_FEATURES)
-            || n->hasTagName(SVGNames::foreignObjectTag)
-#endif
-            )
+            n->hasTagName(SVGNames::imageTag) || n->hasTagName(SVGNames::foreignObjectTag))
             return static_cast<SVGElement*>(n);
 
         n = n->parentNode();
@@ -68,11 +64,7 @@ SVGElement* SVGLocatable::farthestViewportElement(const SVGStyledElement* e)
     Node* n = e->parentNode();
     while (n && !n->isDocumentNode()) {
         if (n->hasTagName(SVGNames::svgTag) || n->hasTagName(SVGNames::symbolTag) ||
-            n->hasTagName(SVGNames::imageTag) 
-#if ENABLE(SVG_EXPERIMENTAL_FEATURES)
-            || n->hasTagName(SVGNames::foreignObjectTag)
-#endif
-            )
+            n->hasTagName(SVGNames::imageTag) || n->hasTagName(SVGNames::foreignObjectTag))
             farthest = static_cast<SVGElement*>(n);
 
         n = n->parentNode();

diff --git a/WebCore/ksvg2/svg/SVGUseElement.cpp b/WebCore/ksvg2/svg/SVGUseElement.cpp
index 5f9aaf6fa0cea6d1c4c4cf23c667bce845d67e51..2619deddcc0d14e403812cc7ecd2122258a93a75 100644 (file)
--- a/WebCore/ksvg2/svg/SVGUseElement.cpp
+++ b/WebCore/ksvg2/svg/SVGUseElement.cpp
@@ -223,6 +223,19 @@ void dumpInstanceTree(unsigned int& depth, String& text, SVGElementInstance* tar
 }
 #endif
 
+static bool subtreeContainsDisallowedElement(Node* start)
+{
+    if (start->hasTagName(SVGNames::foreignObjectTag))
+        return true;
+
+    for (Node* cur = start->firstChild(); cur; cur = cur->nextSibling()) {
+        if (subtreeContainsDisallowedElement(cur))
+            return true;
+    }
+
+    return false;
+}
+
 void SVGUseElement::buildPendingResource()
 {
     // Do not build the shadow/instance tree for <use> elements living in a shadow tree.
@@ -239,8 +252,10 @@ void SVGUseElement::buildPendingResource()
     Element* targetElement = ownerDocument()->getElementById(id); 
     SVGElement* target = svg_dynamic_cast(targetElement);
 
-    // Do not allow self-referencing.
-    if (!target || target == this)
+    // Do not allow self-referencing. Also explicitely disallow
+    // <use> on <foreignObject>, as that could lead to nasty bugs.
+    // 'target' may be null, if it's a non SVG namespaced element.
+    if (!target || target == this || subtreeContainsDisallowedElement(target))
         return;
 
     // Why a seperated instance/shadow tree? SVG demands it:
@@ -256,12 +271,12 @@ void SVGUseElement::buildPendingResource()
     m_targetElementInstance = new SVGElementInstance(this, target);
 
     // Eventually enter recursion to build SVGElementInstance objects for the sub-tree children
-    bool foundCycle = false;
-    buildInstanceTree(target, m_targetElementInstance.get(), foundCycle);
+    bool foundProblem = false;
+    buildInstanceTree(target, m_targetElementInstance.get(), foundProblem);
 
     // SVG specification does not say a word about <use> & cycles. My view on this is: just ignore it!
     // Non-appearing <use> content is easier to debug, then half-appearing content.
-    if (foundCycle) {
+    if (foundProblem) {
         m_targetElementInstance = 0;
         m_shadowTreeRootElement = 0;
         return;
@@ -336,11 +351,16 @@ void SVGUseElement::attach()
     attachShadowTree();
 }
 
-void SVGUseElement::buildInstanceTree(SVGElement* target, SVGElementInstance* targetInstance, bool& foundCycle)
+void SVGUseElement::buildInstanceTree(SVGElement* target, SVGElementInstance* targetInstance, bool& foundProblem)
 {
     ASSERT(target);
     ASSERT(targetInstance);
 
+    if (subtreeContainsDisallowedElement(target)) {
+        foundProblem = true;
+        return;
+    }
+
     // A general description from the SVG spec, describing what buildInstanceTree() actually does.
     //
     // Spec: If the 'use' element references a 'g' which contains two 'rect' elements, then the instance tree
@@ -351,7 +371,7 @@ void SVGUseElement::buildInstanceTree(SVGElement* target, SVGElementInstance* ta
     for (Node* node = target->firstChild(); node; node = node->nextSibling()) {
         SVGElement* element = svg_dynamic_cast(node);
 
-        // Skip any non-svg nodes.
+        // Skip any non-svg nodes or any disallowed element.
         if (!element)
             continue;
 
@@ -363,21 +383,21 @@ void SVGUseElement::buildInstanceTree(SVGElement* target, SVGElementInstance* ta
 
         // Enter recursion, appending new instance tree nodes to the "instance" object.
         if (element->hasChildNodes())
-            buildInstanceTree(element, instancePtr, foundCycle);
+            buildInstanceTree(element, instancePtr, foundProblem);
 
         // Spec: If the referenced object is itself a 'use', or if there are 'use' subelements within the referenced
         // object, the instance tree will contain recursive expansion of the indirect references to form a complete tree.
         if (element->hasTagName(SVGNames::useTag))
-            handleDeepUseReferencing(element, instancePtr, foundCycle);
+            handleDeepUseReferencing(element, instancePtr, foundProblem);
     }
 
     // Spec: If the referenced object is itself a 'use', or if there are 'use' subelements within the referenced
     // object, the instance tree will contain recursive expansion of the indirect references to form a complete tree.
     if (target->hasTagName(SVGNames::useTag))
-        handleDeepUseReferencing(target, targetInstance, foundCycle);
+        handleDeepUseReferencing(target, targetInstance, foundProblem);
 }
 
-void SVGUseElement::handleDeepUseReferencing(SVGElement* use, SVGElementInstance* targetInstance, bool& foundCycle)
+void SVGUseElement::handleDeepUseReferencing(SVGElement* use, SVGElementInstance* targetInstance, bool& foundProblem)
 {
     String id = SVGURIReference::getTarget(use->href());
     Element* targetElement = ownerDocument()->getElementById(id); 
@@ -387,10 +407,10 @@ void SVGUseElement::handleDeepUseReferencing(SVGElement* use, SVGElementInstance
         return;
 
     // Cycle detection first!
-    foundCycle = (target == this);
+    foundProblem = (target == this);
 
     // Shortcut for self-references
-    if (foundCycle)
+    if (foundProblem)
         return;
 
     SVGElementInstance* instance = targetInstance->parentNode();
@@ -398,7 +418,7 @@ void SVGUseElement::handleDeepUseReferencing(SVGElement* use, SVGElementInstance
         SVGElement* element = instance->correspondingElement();
 
         if (element->getIDAttribute() == id) {
-            foundCycle = true;
+            foundProblem = true;
             return;
         }
     
@@ -410,7 +430,7 @@ void SVGUseElement::handleDeepUseReferencing(SVGElement* use, SVGElementInstance
     targetInstance->appendChild(newInstance);
 
     // Eventually enter recursion to build SVGElementInstance objects for the sub-tree children
-    buildInstanceTree(target, newInstance, foundCycle);
+    buildInstanceTree(target, newInstance, foundProblem);
 }
 
 PassRefPtr<SVGSVGElement> SVGUseElement::buildShadowTreeForSymbolTag(SVGElement* target, SVGElementInstance* targetInstance)

diff --git a/WebCore/ksvg2/svg/svgtags.in b/WebCore/ksvg2/svg/svgtags.in
index 6f503f0c3d52183611befcf25c18197c7def8912..3fc021979eafa8e9c33eebda2afeb40ba6a8cb5d 100644 (file)
--- a/WebCore/ksvg2/svg/svgtags.in
+++ b/WebCore/ksvg2/svg/svgtags.in
@@ -61,9 +61,7 @@ font_face_name
 font_face_src
 font_face_uri
 #endif
-#ifdef ENABLE_SVG_EXPERIMENTAL_FEATURES
 foreignObject
-#endif
 g
 #if 0
 glyph

diff --git a/WebCore/rendering/RenderForeignObject.cpp b/WebCore/rendering/RenderForeignObject.cpp
index bc847394f7baf4e56bd6aeeeb5ec319cd26f5bce..1cd0ec41eae726f2a9cf8ff796380d11164b2026 100644 (file)
--- a/WebCore/rendering/RenderForeignObject.cpp
+++ b/WebCore/rendering/RenderForeignObject.cpp
@@ -22,8 +22,7 @@
 
 #include "config.h"
 
-#if ENABLE(SVG) && ENABLE(SVG_EXPERIMENTAL_FEATURES)
-
+#if ENABLE(SVG)
 #include "RenderForeignObject.h"
 
 #include "GraphicsContext.h"