Attachment 357647 Details for Bug 192840 – Cleanup

[patch] Cleanup

bug-192840-20181218194901.patch (text/plain), 2.35 KB, created by Ryosuke Niwa on 2018-12-18 19:49:01 PST

(hide)

Description:

Filename:

MIME Type:

Creator: Ryosuke Niwa

Created: 2018-12-18 19:49:01 PST

Size: 2.35 KB

patch

obsolete

>Index: Source/WebCore/ChangeLog
>===================================================================
>--- Source/WebCore/ChangeLog	(revision 239365)
>+++ Source/WebCore/ChangeLog	(working copy)
>@@ -1,3 +1,20 @@
>+2018-12-18  Ryosuke Niwa  <rniwa@webkit.org>
>+
>+        SVGUseElement::findTarget should return nullptr when there is a cycle
>+        https://bugs.webkit.org/show_bug.cgi?id=192840
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        r233366 added an early return to updateShadowTree() when there is a cycle between an use element and its target.
>+        Consolidate this cycle detection code with the one in SVGUseElement::findTarget which detected cycles when
>+        the SVG use element itself had a corresponding element.
>+
>+        No new tests since there shoul be no behavioral change.
>+
>+        * svg/SVGUseElement.cpp:
>+        (WebCore::SVGUseElement::updateShadowTree):
>+        (WebCore::SVGUseElement::findTarget const):
>+
> 2018-12-18  Justin Michaud  <justin_michaud@apple.com>
> 
>         Update CSS Properties and Values API to use new cycle fallback behaviour
>Index: Source/WebCore/svg/SVGUseElement.cpp
>===================================================================
>--- Source/WebCore/svg/SVGUseElement.cpp	(revision 239364)
>+++ Source/WebCore/svg/SVGUseElement.cpp	(working copy)
>@@ -244,9 +244,7 @@ void SVGUseElement::updateShadowTree()
>         return;
>     }
> 
>-    if (isDescendantOf(target))
>-        return;
>-    
>+    RELEASE_ASSERT(!isDescendantOf(target));
>     {
>         auto& shadowRoot = ensureUserAgentShadowRoot();
>         cloneTarget(shadowRoot, *target);
>@@ -423,13 +421,16 @@ SVGElement* SVGUseElement::findTarget(St
>     if (!target.isConnected() || isDisallowedElement(target))
>         return nullptr;
> 
>-    // Reject any target that has already been cloned to create one of the ancestors of this element,
>-    // already in the shadow tree. This is sufficient to prevent cycles.
>     if (correspondingElement) {
>         for (auto& ancestor : lineageOfType<SVGElement>(*this)) {
>             if (ancestor.correspondingElement() == &target)
>                 return nullptr;
>         }
>+    } else {
>+        if (target.contains(this))
>+            return nullptr;
>+        // Target should only refer to a node in the same tree or a node in another document.
>+        ASSERT(!isDescendantOrShadowDescendantOf(&target));
>     }
> 
>     return &target;

Flags:

thorton: review+

Actions: View | Formatted Diff | Diff

Attachments on bug 192840: 357647