Title: [88837] branches/chromium/782
- Revision
- 88837
- Author
- [email protected]
- Date
- 2011-06-14 11:43:29 -0700 (Tue, 14 Jun 2011)
Log Message
Merge 88549
BUG=85211
Review URL: http://codereview.chromium.org/7163002
Modified Paths
Added Paths
Diff
Copied: branches/chromium/782/LayoutTests/svg/dom/use-style-recalc-script-execute-crash-expected.txt (from rev 88549, trunk/LayoutTests/svg/dom/use-style-recalc-script-execute-crash-expected.txt) (0 => 88837)
--- branches/chromium/782/LayoutTests/svg/dom/use-style-recalc-script-execute-crash-expected.txt (rev 0)
+++ branches/chromium/782/LayoutTests/svg/dom/use-style-recalc-script-execute-crash-expected.txt 2011-06-14 18:43:29 UTC (rev 88837)
@@ -0,0 +1 @@
+Test passes if it does not crash and "script" inside "rect" does not execute.
Copied: branches/chromium/782/LayoutTests/svg/dom/use-style-recalc-script-execute-crash.html (from rev 88549, trunk/LayoutTests/svg/dom/use-style-recalc-script-execute-crash.html) (0 => 88837)
--- branches/chromium/782/LayoutTests/svg/dom/use-style-recalc-script-execute-crash.html (rev 0)
+++ branches/chromium/782/LayoutTests/svg/dom/use-style-recalc-script-execute-crash.html 2011-06-14 18:43:29 UTC (rev 88837)
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html>
+Test passes if it does not crash and "script" inside "rect" does not execute.
+<script>
+if (window.layoutTestController)
+ layoutTestController.dumpAsText();
+</script>
+<svg>
+<g>
+<use xlink:href=""
+<rect id="test">
+<script>
+document.body.innerHTML = "FAIL";
+</script>
+</rect>
+</g>
+</svg>
+</html>
+
Modified: branches/chromium/782/Source/WebCore/dom/ScriptElement.cpp (88836 => 88837)
--- branches/chromium/782/Source/WebCore/dom/ScriptElement.cpp 2011-06-14 18:42:00 UTC (rev 88836)
+++ branches/chromium/782/Source/WebCore/dom/ScriptElement.cpp 2011-06-14 18:43:29 UTC (rev 88837)
@@ -203,6 +203,14 @@
if (!m_element->document()->frame()->script()->canExecuteScripts(AboutToExecuteScript))
return false;
+ // FIXME: This is non-standard. Remove this after https://bugs.webkit.org/show_bug.cgi?id=62412.
+ Node* ancestor = m_element->parentNode();
+ while (ancestor) {
+ if (ancestor->isSVGShadowRoot())
+ return false;
+ ancestor = ancestor->parentNode();
+ }
+
if (!isScriptForEventSupported())
return false;
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
