Title: [117957] trunk
- Revision
- 117957
- Author
- hay...@chromium.org
- Date
- 2012-05-22 05:14:41 -0700 (Tue, 22 May 2012)
Log Message
Fix crashes when a mouse points a <svg> element in shadow DOM subtree.
https://bugs.webkit.org/show_bug.cgi?id=86795
Reviewed by Nikolas Zimmermann.
Source/WebCore:
<svg> elements in shadow dom subtree are still not supported.
This fixes only crashes.
Test: fast/dom/shadow/shadow-dom-event-dispatching.html
* dom/EventDispatcher.cpp:
(WebCore::eventTargetRespectingSVGTargetRules):
* page/EventHandler.cpp:
(WebCore::instanceAssociatedWithShadowTreeElement):
LayoutTests:
* fast/dom/shadow/shadow-dom-event-dispatching.html:
Modified Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (117956 => 117957)
--- trunk/LayoutTests/ChangeLog 2012-05-22 12:06:24 UTC (rev 117956)
+++ trunk/LayoutTests/ChangeLog 2012-05-22 12:14:41 UTC (rev 117957)
@@ -1,3 +1,12 @@
+2012-05-22 Hayato Ito <hay...@chromium.org>
+
+ Fix crashes when a mouse points a <svg> element in shadow DOM subtree.
+ https://bugs.webkit.org/show_bug.cgi?id=86795
+
+ Reviewed by Nikolas Zimmermann.
+
+ * fast/dom/shadow/shadow-dom-event-dispatching.html:
+
2012-05-22 Andreas Kling <kl...@webkit.org>
DOM Attr objects pointing to "style" attribute should force reification when read.
Modified: trunk/LayoutTests/fast/dom/shadow/shadow-dom-event-dispatching-expected.txt (117956 => 117957)
--- trunk/LayoutTests/fast/dom/shadow/shadow-dom-event-dispatching-expected.txt 2012-05-22 12:06:24 UTC (rev 117956)
+++ trunk/LayoutTests/fast/dom/shadow/shadow-dom-event-dispatching-expected.txt 2012-05-22 12:14:41 UTC (rev 117957)
@@ -240,6 +240,24 @@
mouseover
@A (target: A) (related: D)
@top (target: A) (related: D)
+
+
+Composed Shadow Tree will be:
+DIV id=sandbox
+ DIV id=top
+ DIV id=shadow-host
+ svg id=svg-in-shadow-tree class=[object SVGAnimatedString]
+
+
+Moving mouse from shadow-host/svg-in-shadow-tree to top
+
+ mouseout
+ @svg-in-shadow-tree (target: svg-in-shadow-tree) (related: top)
+ @shadow-root (target: svg-in-shadow-tree) (related: top)
+ @top (target: svg-in-shadow-tree) (related: top)
+
+ mouseover
+ @top (target: top) (related: shadow-host)
PASS successfullyParsed is true
TEST COMPLETE
Modified: trunk/LayoutTests/fast/dom/shadow/shadow-dom-event-dispatching.html (117956 => 117957)
--- trunk/LayoutTests/fast/dom/shadow/shadow-dom-event-dispatching.html 2012-05-22 12:06:24 UTC (rev 117956)
+++ trunk/LayoutTests/fast/dom/shadow/shadow-dom-event-dispatching.html 2012-05-22 12:14:41 UTC (rev 117957)
@@ -157,6 +157,23 @@
debug('\n\nComposed Shadow Tree will be:\n' + dumpComposedShadowTree(parent));
}
+function prepareDOMTree4(parent)
+{
+ // Makes sure that <svg> in shadow DOM subtree, which is not supported at this time, does not crash.
+ parent.appendChild(
+ createDOM('div', {'id': 'top'},
+ createDOM('div', {'id': 'shadow-host'},
+ createShadowRoot())));
+ var svg = document.createElementNS('http://www.w3.org/2000/svg', 'svg');
+ svg.id = 'svg-in-shadow-tree';
+ getNodeInShadowTreeStack('shadow-host/').appendChild(svg);
+
+ addEventListeners(['top', 'shadow-host/', 'shadow-host/svg-in-shadow-tree']);
+ getNodeInShadowTreeStack('shadow-host/').id = 'shadow-root';
+ parent.offsetLeft;
+ debug('\n\nComposed Shadow Tree will be:\n' + dumpComposedShadowTree(parent));
+}
+
function debugDispatchedEvent(eventType)
{
debug('\n ' + eventType);
@@ -212,6 +229,10 @@
moveMouse('B/G/L', 'B/G/J');
moveMouse('A', 'D');
moveMouse('D', 'A');
+
+ sandbox.innerHTML = '';
+ prepareDOMTree4(sandbox);
+ moveMouse('shadow-host/svg-in-shadow-tree', 'top');
}
test();
Modified: trunk/Source/WebCore/ChangeLog (117956 => 117957)
--- trunk/Source/WebCore/ChangeLog 2012-05-22 12:06:24 UTC (rev 117956)
+++ trunk/Source/WebCore/ChangeLog 2012-05-22 12:14:41 UTC (rev 117957)
@@ -1,3 +1,20 @@
+2012-05-22 Hayato Ito <hay...@chromium.org>
+
+ Fix crashes when a mouse points a <svg> element in shadow DOM subtree.
+ https://bugs.webkit.org/show_bug.cgi?id=86795
+
+ Reviewed by Nikolas Zimmermann.
+
+ <svg> elements in shadow dom subtree are still not supported.
+ This fixes only crashes.
+
+ Test: fast/dom/shadow/shadow-dom-event-dispatching.html
+
+ * dom/EventDispatcher.cpp:
+ (WebCore::eventTargetRespectingSVGTargetRules):
+ * page/EventHandler.cpp:
+ (WebCore::instanceAssociatedWithShadowTreeElement):
+
2012-05-22 Andreas Kling <kl...@webkit.org>
DOM Attr objects pointing to "style" attribute should force reification when read.
Modified: trunk/Source/WebCore/dom/EventDispatcher.cpp (117956 => 117957)
--- trunk/Source/WebCore/dom/EventDispatcher.cpp 2012-05-22 12:06:24 UTC (rev 117956)
+++ trunk/Source/WebCore/dom/EventDispatcher.cpp 2012-05-22 12:14:41 UTC (rev 117957)
@@ -127,16 +127,12 @@
// Spec: The event handling for the non-exposed tree works as if the referenced element had been textually included
// as a deeply cloned child of the 'use' element, except that events are dispatched to the SVGElementInstance objects
Element* shadowHostElement = toShadowRoot(referenceNode->treeScope()->rootNode())->host();
- // At this time, SVG nodes are not allowed in non-<use> shadow trees, so any shadow root we do
- // have should be a use. The assert and following test is here to catch future shadow DOM changes
- // that do enable SVG in a shadow tree.
- ASSERT(!shadowHostElement || shadowHostElement->hasTagName(SVGNames::useTag));
- if (shadowHostElement && shadowHostElement->hasTagName(SVGNames::useTag)) {
- SVGUseElement* useElement = static_cast<SVGUseElement*>(shadowHostElement);
-
- if (SVGElementInstance* instance = useElement->instanceForShadowTreeElement(referenceNode))
- return instance;
- }
+ // At this time, SVG nodes are not supported in non-<use> shadow trees.
+ if (!shadowHostElement || !shadowHostElement->hasTagName(SVGNames::useTag))
+ return referenceNode;
+ SVGUseElement* useElement = static_cast<SVGUseElement*>(shadowHostElement);
+ if (SVGElementInstance* instance = useElement->instanceForShadowTreeElement(referenceNode))
+ return instance;
#endif
return referenceNode;
Modified: trunk/Source/WebCore/page/EventHandler.cpp (117956 => 117957)
--- trunk/Source/WebCore/page/EventHandler.cpp 2012-05-22 12:06:24 UTC (rev 117956)
+++ trunk/Source/WebCore/page/EventHandler.cpp 2012-05-22 12:14:41 UTC (rev 117957)
@@ -2097,10 +2097,9 @@
return 0;
Element* shadowTreeParentElement = shadowRoot->host();
- if (!shadowTreeParentElement)
+ if (!shadowTreeParentElement || !shadowTreeParentElement->hasTagName(useTag))
return 0;
- ASSERT(shadowTreeParentElement->hasTagName(useTag));
return static_cast<SVGUseElement*>(shadowTreeParentElement)->instanceForShadowTreeElement(referenceNode);
}
#endif
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
