Title: [118302] branches/chromium/1132
- Revision
- 118302
- Author
- [email protected]
- Date
- 2012-05-23 18:56:41 -0700 (Wed, 23 May 2012)
Log Message
Merge 117161
BUG=122029
Review URL: https://chromiumcodereview.appspot.com/10444003
Modified Paths
Added Paths
Diff
Copied: branches/chromium/1132/LayoutTests/svg/foreignObject/viewport-foreignobject-crash-expected.html (from rev 117161, trunk/LayoutTests/svg/foreignObject/viewport-foreignobject-crash-expected.html) (0 => 118302)
--- branches/chromium/1132/LayoutTests/svg/foreignObject/viewport-foreignobject-crash-expected.html (rev 0)
+++ branches/chromium/1132/LayoutTests/svg/foreignObject/viewport-foreignobject-crash-expected.html 2012-05-24 01:56:41 UTC (rev 118302)
@@ -0,0 +1 @@
+PASS
Copied: branches/chromium/1132/LayoutTests/svg/foreignObject/viewport-foreignobject-crash.html (from rev 117161, trunk/LayoutTests/svg/foreignObject/viewport-foreignobject-crash.html) (0 => 118302)
--- branches/chromium/1132/LayoutTests/svg/foreignObject/viewport-foreignobject-crash.html (rev 0)
+++ branches/chromium/1132/LayoutTests/svg/foreignObject/viewport-foreignobject-crash.html 2012-05-24 01:56:41 UTC (rev 118302)
@@ -0,0 +1,35 @@
+<html>
+<body>
+<script>
+var script = document.getElementsByTagName("script")[0];
+script.parentNode.removeChild(script);
+
+var count = 0;
+function crash() {
+ var element = event.srcElement;
+ document.adoptNode(element);
+ if (!document.body.innerHTML)
+ return;
+ document.execCommand('InsertHTML', false, document.body.innerHTML);
+ if (count == 1) {
+ document.removeEventListener("DOMNodeInserted", crash, false);
+ document.body.innerHTML = "PASS";
+ return;
+ }
+ document.body.appendChild(element);
+ element.insertAdjacentHTML('beforeend', '<svg><foreignObject>A</foreignObject></svg>');
+ element.focus();
+ count += 1;
+}
+
+document.addEventListener("DOMNodeInserted", crash, false);
+document.addEventListener("DOMContentLoaded", function () {
+ document.execCommand("SelectAll", false, false);
+ var range = window.getSelection().getRangeAt(0);
+ var docFragment = range.extractContents();
+ document.documentElement.firstChild.appendChild(docFragment);
+}, false);
+</script>
+<input/>
+</body>
+</html>
Modified: branches/chromium/1132/Source/WebCore/svg/SVGElement.cpp (118301 => 118302)
--- branches/chromium/1132/Source/WebCore/svg/SVGElement.cpp 2012-05-24 01:53:58 UTC (rev 118301)
+++ branches/chromium/1132/Source/WebCore/svg/SVGElement.cpp 2012-05-24 01:56:41 UTC (rev 118302)
@@ -129,7 +129,7 @@
// If we're living in a shadow tree, we're a <svg> element that got created as replacement
// for a <symbol> element or a cloned <svg> element in the referenced tree. In that case
// we're always an inner <svg> element.
- if (isInShadowTree())
+ if (isInShadowTree() && parentOrHostElement() && parentOrHostElement()->isSVGElement())
return false;
// Element may not be in the document, pretend we're outermost for viewport(), getCTM(), etc.
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
