Title: [99885] branches/chromium/912/Source/WebCore
- Revision
- 99885
- Author
- [email protected]
- Date
- 2011-11-10 11:36:23 -0800 (Thu, 10 Nov 2011)
Log Message
Infinite recursion in RenderSVGResourceContainer::markAllClientsForInvalidation
https://bugs.webkit.org/show_bug.cgi?id=71384
Reviewed by Darin Adler.
Adding a reentrancy guard to RenderSVGResourceContainer to prevent infinite recursion when
resources reference one another and share ids.
Test: svg/custom/resource-invalidation-crash.svg
* rendering/svg/RenderSVGResourceContainer.cpp:
(WebCore::RenderSVGResourceContainer::RenderSVGResourceContainer):
(WebCore::RenderSVGResourceContainer::markAllClientsForInvalidation):
* rendering/svg/RenderSVGResourceContainer.h:
Modified Paths
Diff
Modified: branches/chromium/912/Source/WebCore/ChangeLog (99884 => 99885)
--- branches/chromium/912/Source/WebCore/ChangeLog 2011-11-10 19:27:47 UTC (rev 99884)
+++ branches/chromium/912/Source/WebCore/ChangeLog 2011-11-10 19:36:23 UTC (rev 99885)
@@ -1,3 +1,20 @@
+2011-11-02 Levi Weintraub <[email protected]>
+
+ Infinite recursion in RenderSVGResourceContainer::markAllClientsForInvalidation
+ https://bugs.webkit.org/show_bug.cgi?id=71384
+
+ Reviewed by Darin Adler.
+
+ Adding a reentrancy guard to RenderSVGResourceContainer to prevent infinite recursion when
+ resources reference one another and share ids.
+
+ Test: svg/custom/resource-invalidation-crash.svg
+
+ * rendering/svg/RenderSVGResourceContainer.cpp:
+ (WebCore::RenderSVGResourceContainer::RenderSVGResourceContainer):
+ (WebCore::RenderSVGResourceContainer::markAllClientsForInvalidation):
+ * rendering/svg/RenderSVGResourceContainer.h:
+
2011-11-02 Ryosuke Niwa <[email protected]>
REGRESSION(r96870): WebKit generates background: transparent on blogger.com
Modified: branches/chromium/912/Source/WebCore/rendering/svg/RenderSVGResourceContainer.cpp (99884 => 99885)
--- branches/chromium/912/Source/WebCore/rendering/svg/RenderSVGResourceContainer.cpp 2011-11-10 19:27:47 UTC (rev 99884)
+++ branches/chromium/912/Source/WebCore/rendering/svg/RenderSVGResourceContainer.cpp 2011-11-10 19:36:23 UTC (rev 99885)
@@ -38,6 +38,7 @@
: RenderSVGHiddenContainer(node)
, m_id(node->hasID() ? node->getIdAttribute() : nullAtom)
, m_registered(false)
+ , m_isInvalidating(false)
{
}
@@ -87,9 +88,10 @@
void RenderSVGResourceContainer::markAllClientsForInvalidation(InvalidationMode mode)
{
- if (m_clients.isEmpty())
+ if (m_clients.isEmpty() || m_isInvalidating)
return;
+ m_isInvalidating = true;
bool needsLayout = mode == LayoutAndBoundariesInvalidation;
bool markForInvalidation = mode != ParentOnlyInvalidation;
@@ -118,6 +120,7 @@
current = current->parent();
}
}
+ m_isInvalidating = false;
}
void RenderSVGResourceContainer::markClientForInvalidation(RenderObject* client, InvalidationMode mode)
Modified: branches/chromium/912/Source/WebCore/rendering/svg/RenderSVGResourceContainer.h (99884 => 99885)
--- branches/chromium/912/Source/WebCore/rendering/svg/RenderSVGResourceContainer.h 2011-11-10 19:27:47 UTC (rev 99884)
+++ branches/chromium/912/Source/WebCore/rendering/svg/RenderSVGResourceContainer.h 2011-11-10 19:36:23 UTC (rev 99885)
@@ -64,7 +64,8 @@
void registerResource();
AtomicString m_id;
- bool m_registered;
+ bool m_registered : 1;
+ bool m_isInvalidating : 1;
HashSet<RenderObject*> m_clients;
};
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
