Diff
Modified: trunk/LayoutTests/ChangeLog (130776 => 130777)
--- trunk/LayoutTests/ChangeLog 2012-10-09 17:17:50 UTC (rev 130776)
+++ trunk/LayoutTests/ChangeLog 2012-10-09 17:49:59 UTC (rev 130777)
@@ -1,3 +1,29 @@
+2012-10-09 Philip Rogers <p...@google.com>
+
+ Prevent animation when CSS attributeType is invalid.
+ https://bugs.webkit.org/show_bug.cgi?id=94569
+
+ Reviewed by Dirk Schulze.
+
+ Adding a test to prove this patch works (invalid-css-attribute-crash.svg)
+ and an additional test to show that switching between XML and CSS
+ attributeTypes works as expected (animate-css-xml-attributeType.html).
+
+ * platform/chromium/TestExpectations:
+ * platform/efl/TestExpectations:
+ * platform/gtk/TestExpectations:
+ * platform/mac/TestExpectations:
+ * platform/qt/TestExpectations:
+ * platform/win/TestExpectations:
+ * svg/animations/animate-css-xml-attributeType-expected.txt: Added.
+ * svg/animations/animate-css-xml-attributeType.html: Added.
+ * svg/animations/invalid-css-attribute-crash-expected.svg: Added.
+ * svg/animations/invalid-css-attribute-crash.svg: Added.
+ * svg/animations/script-tests/animate-css-xml-attributeType.js: Added.
+ (sample1):
+ (sample6):
+ (executeTest):
+
2012-10-08 Simon Fraser <simon.fra...@apple.com>
Remove DRT/WTR implementations of layerTreeAsText
Modified: trunk/LayoutTests/platform/chromium/TestExpectations (130776 => 130777)
--- trunk/LayoutTests/platform/chromium/TestExpectations 2012-10-09 17:17:50 UTC (rev 130776)
+++ trunk/LayoutTests/platform/chromium/TestExpectations 2012-10-09 17:49:59 UTC (rev 130777)
@@ -1223,6 +1223,8 @@
# reasonable.
crbug.com/19897 [ Android Linux Win ] svg/custom/getscreenctm-in-mixed-content2.xhtml [ Failure ]
+webkit.org/b/98718 svg/animations/animate-css-xml-attributeType.html [ Failure Pass ]
+
# Failing since creation in http://trac.webkit.org/changeset/75308
# Failing worse maybe since https://bugs.webkit.org/show_bug.cgi?id=53471
crbug.com/122193 svg/text/caret-in-svg-text.xhtml [ Failure ]
Modified: trunk/LayoutTests/platform/efl/TestExpectations (130776 => 130777)
--- trunk/LayoutTests/platform/efl/TestExpectations 2012-10-09 17:17:50 UTC (rev 130776)
+++ trunk/LayoutTests/platform/efl/TestExpectations 2012-10-09 17:49:59 UTC (rev 130777)
@@ -820,6 +820,8 @@
webkit.org/b/98651 svg/text/non-bmp-positioning-lists.svg [ Skip ]
webkit.org/b/98653 svg/text/lengthAdjust-text-metrics.html [ Failure ]
+webkit.org/b/98718 svg/animations/animate-css-xml-attributeType.html [ Failure Pass ]
+
# EFL's TestRunner does not implement setMediaType
Bug(EFL) fast/media/print-restores-previous-mediatype.html [ Failure ]
Modified: trunk/LayoutTests/platform/gtk/TestExpectations (130776 => 130777)
--- trunk/LayoutTests/platform/gtk/TestExpectations 2012-10-09 17:17:50 UTC (rev 130776)
+++ trunk/LayoutTests/platform/gtk/TestExpectations 2012-10-09 17:49:59 UTC (rev 130777)
@@ -535,6 +535,8 @@
webkit.org/b/89650 [ Debug ] svg/W3C-SVG-1.1/animate-elem-85-t.svg [ Failure Pass ]
webkit.org/b/89650 svg/W3C-SVG-1.1/struct-dom-06-b.svg [ Failure Pass ]
+webkit.org/b/98718 svg/animations/animate-css-xml-attributeType.html [ Failure Pass ]
+
webkit.org/b/80158 plugins/netscape-plugin-page-cache-works.html [ Failure Pass ]
webkit.org/b/83704 media/event-attributes.html [ Failure Pass ]
Modified: trunk/LayoutTests/platform/mac/TestExpectations (130776 => 130777)
--- trunk/LayoutTests/platform/mac/TestExpectations 2012-10-09 17:17:50 UTC (rev 130776)
+++ trunk/LayoutTests/platform/mac/TestExpectations 2012-10-09 17:49:59 UTC (rev 130777)
@@ -1185,6 +1185,8 @@
webkit.org/b/89116 svg/dynamic-updates/SVGFESpecularLightingElement-svgdom-suraceScale-prop.html [ ImageOnlyFailure Pass ]
webkit.org/b/89116 svg/filters/feLighting-crash.svg [ ImageOnlyFailure Pass ]
+webkit.org/b/98718 svg/animations/animate-css-xml-attributeType.html [ Failure Pass ]
+
# Needs rebaseline after https://bugs.webkit.org/show_bug.cgi?id=79682
webkit.org/b/79682 svg/repaint/text-mask-update.svg [ Failure ImageOnlyFailure Missing Pass ]
Modified: trunk/LayoutTests/platform/qt/TestExpectations (130776 => 130777)
--- trunk/LayoutTests/platform/qt/TestExpectations 2012-10-09 17:17:50 UTC (rev 130776)
+++ trunk/LayoutTests/platform/qt/TestExpectations 2012-10-09 17:49:59 UTC (rev 130777)
@@ -1426,6 +1426,8 @@
svg/text/text-intro-05-t.svg
svg/text/text-tselect-02-f.svg
+webkit.org/b/98718 svg/animations/animate-css-xml-attributeType.html [ Failure Pass ]
+
# [Qt] svg/animations/animate-path-nested-transforms.html fails
# https://bugs.webkit.org/show_bug.cgi?id=48987
svg/animations/animate-path-nested-transforms.html
Modified: trunk/LayoutTests/platform/win/TestExpectations (130776 => 130777)
--- trunk/LayoutTests/platform/win/TestExpectations 2012-10-09 17:17:50 UTC (rev 130776)
+++ trunk/LayoutTests/platform/win/TestExpectations 2012-10-09 17:49:59 UTC (rev 130777)
@@ -142,6 +142,8 @@
fast/text/cg-vs-atsui.html
fast/text/atsui-spacing-features.html
+webkit.org/b/98718 svg/animations/animate-css-xml-attributeType.html [ Failure Pass ]
+
# <rdar://problem/5718773> Support a minimum antialiased font size
svg/hixie/text/003.html
svg/hixie/text/003a.xml
Added: trunk/LayoutTests/svg/animations/animate-css-xml-attributeType-expected.txt (0 => 130777)
--- trunk/LayoutTests/svg/animations/animate-css-xml-attributeType-expected.txt (rev 0)
+++ trunk/LayoutTests/svg/animations/animate-css-xml-attributeType-expected.txt 2012-10-09 17:49:59 UTC (rev 130777)
@@ -0,0 +1,20 @@
+SVG 1.1 dynamic animation tests
+
+Tests that XML and CSS attributeTypes can be switched between.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS rect.x.animVal.value is 100
+PASS rect.x.baseVal.value is 100
+PASS rect.x.animVal.value is 300
+PASS rect.x.animVal.value is 100
+PASS getComputedStyle(rect).getPropertyCSSValue('opacity').getFloatValue(CSSPrimitiveValue.CSS_NUMBER) is 0.8
+PASS rect.x.animVal.value is 100
+PASS getComputedStyle(rect).getPropertyCSSValue('opacity').getFloatValue(CSSPrimitiveValue.CSS_NUMBER) is 1.0
+PASS rect.x.animVal.value is 200
+PASS rect.x.baseVal.value is 100
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
Added: trunk/LayoutTests/svg/animations/animate-css-xml-attributeType.html (0 => 130777)
--- trunk/LayoutTests/svg/animations/animate-css-xml-attributeType.html (rev 0)
+++ trunk/LayoutTests/svg/animations/animate-css-xml-attributeType.html 2012-10-09 17:49:59 UTC (rev 130777)
@@ -0,0 +1,14 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src=""
+<script src=""
+<script src=""
+</head>
+<body _onload_="runSMILTest()">
+<h1>SVG 1.1 dynamic animation tests</h1>
+<p id="description"></p>
+<div id="console"></div>
+<script src=""
+</body>
+</html>
Added: trunk/LayoutTests/svg/animations/invalid-css-attribute-crash-expected.svg (0 => 130777)
--- trunk/LayoutTests/svg/animations/invalid-css-attribute-crash-expected.svg (rev 0)
+++ trunk/LayoutTests/svg/animations/invalid-css-attribute-crash-expected.svg 2012-10-09 17:49:59 UTC (rev 130777)
@@ -0,0 +1,3 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+<text x="5" y="20">This test passes if it does not CRASH.</text>
+</svg>
Added: trunk/LayoutTests/svg/animations/invalid-css-attribute-crash.svg (0 => 130777)
--- trunk/LayoutTests/svg/animations/invalid-css-attribute-crash.svg (rev 0)
+++ trunk/LayoutTests/svg/animations/invalid-css-attribute-crash.svg 2012-10-09 17:49:59 UTC (rev 130777)
@@ -0,0 +1,7 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+<!-- Test for WK94569: Passes if there is no crash in animating non-CSS animations with attributeType=CSS. -->
+<text x="5" y="20">This test passes if it does not CRASH.</text>
+<feConvolveMatrix>
+<set attributeName="result" attributeType="CSS" to="inherit"></set>
+</feConvolveMatrix>
+</svg>
Added: trunk/LayoutTests/svg/animations/script-tests/animate-css-xml-attributeType.js (0 => 130777)
--- trunk/LayoutTests/svg/animations/script-tests/animate-css-xml-attributeType.js (rev 0)
+++ trunk/LayoutTests/svg/animations/script-tests/animate-css-xml-attributeType.js 2012-10-09 17:49:59 UTC (rev 130777)
@@ -0,0 +1,77 @@
+description("Tests that XML and CSS attributeTypes can be switched between.");
+createSVGTestCase();
+
+// Setup test document
+var rect = createSVGElement("rect");
+rect.setAttribute("id", "rect");
+rect.setAttribute("x", "100");
+rect.setAttribute("width", "100");
+rect.setAttribute("height", "100");
+rect.setAttribute("fill", "green");
+rect.setAttribute("onclick", "executeTest()");
+
+var set = createSVGElement("set");
+set.setAttribute("id", "set");
+set.setAttribute("attributeName", "x");
+set.setAttribute("attributeType", "XML");
+set.setAttribute("to", "300");
+set.setAttribute("begin", "click");
+rect.appendChild(set);
+rootSVGElement.appendChild(rect);
+
+// Setup animation test
+function sample1() {
+ shouldBeCloseEnough("rect.x.animVal.value", "100");
+ shouldBe("rect.x.baseVal.value", "100");
+}
+
+function sample2() {
+ shouldBeCloseEnough("rect.x.animVal.value", "300");
+ // change the animationType to CSS which is invalid.
+ set.setAttribute("attributeType", "CSS");
+}
+
+function sample3() {
+ // verify that the animation resets.
+ shouldBeCloseEnough("rect.x.animVal.value", "100");
+ // change the animation to a CSS animatable value.
+ set.setAttribute("attributeName", "opacity");
+ set.setAttribute("to", "0.8");
+}
+
+function sample4() {
+ shouldBeCloseEnough("getComputedStyle(rect).getPropertyCSSValue('opacity').getFloatValue(CSSPrimitiveValue.CSS_NUMBER)", "0.8");
+ // change the animation to a non-CSS animatable value.
+ set.setAttribute("attributeName", "x");
+ set.setAttribute("to", "200");
+}
+
+function sample5() {
+ // verify that the animation does not run.
+ shouldBeCloseEnough("rect.x.animVal.value", "100");
+ shouldBeCloseEnough("getComputedStyle(rect).getPropertyCSSValue('opacity').getFloatValue(CSSPrimitiveValue.CSS_NUMBER)", "1.0");
+ // change the animationType to XML which is valid.
+ set.setAttribute("attributeType", "XML");
+}
+
+function sample6() {
+ shouldBeCloseEnough("rect.x.animVal.value", "200");
+ shouldBe("rect.x.baseVal.value", "100");
+}
+
+function executeTest() {
+ const expectedValues = [
+ // [animationId, time, sampleCallback]
+ ["set", 0.0, sample1],
+ ["set", 0.5, sample2],
+ ["set", 1.0, sample3],
+ ["set", 1.5, sample4],
+ ["set", 2.0, sample5],
+ ["set", 2.5, sample6]
+ ];
+
+ runAnimationTest(expectedValues);
+}
+
+window.clickX = 150;
+var successfullyParsed = true;
Modified: trunk/Source/WebCore/ChangeLog (130776 => 130777)
--- trunk/Source/WebCore/ChangeLog 2012-10-09 17:17:50 UTC (rev 130776)
+++ trunk/Source/WebCore/ChangeLog 2012-10-09 17:49:59 UTC (rev 130777)
@@ -1,3 +1,52 @@
+2012-10-09 Philip Rogers <p...@google.com>
+
+ Prevent animation when CSS attributeType is invalid.
+ https://bugs.webkit.org/show_bug.cgi?id=94569
+
+ Reviewed by Dirk Schulze.
+
+ This patch changes hasValidAttributeType() to return false when
+ we have attributeType=CSS with a non-CSS attribute name.
+
+ Previously we would animate non-CSS attributes when attributeType was
+ CSS which resulted in crashes. To track this case, this patch catches
+ changes to targetElement, attributeName, and attributeType and checks
+ if an invalid combination is present. If invalid, hasInvalidCSSAttributeType()
+ will return true causing hasValidAttributeType() to return false and prevent
+ the animation from running.
+
+ Tests: svg/animations/animate-css-xml-attributeType.html
+ svg/animations/invalid-css-attribute-crash-expected.svg
+ svg/animations/invalid-css-attribute-crash.svg
+
+ * svg/SVGAnimateElement.cpp:
+ (WebCore::SVGAnimateElement::hasValidAttributeType):
+ (WebCore::SVGAnimateElement::targetElementWillChange):
+ * svg/SVGAnimationElement.cpp:
+ (WebCore::SVGAnimationElement::SVGAnimationElement):
+ (WebCore::SVGAnimationElement::isSupportedAttribute):
+
+ This now supports the attributeType attribute which is stored in m_attributeType.
+
+ (WebCore::SVGAnimationElement::parseAttribute):
+ (WebCore::SVGAnimationElement::setAttributeType):
+
+ Changes to attributeType, attributeName, and targetElement need to be tracked
+ to determine when an invalid combination happens.
+
+ (WebCore::SVGAnimationElement::targetElementWillChange):
+ (WebCore):
+ (WebCore::SVGAnimationElement::setAttributeName):
+ (WebCore::SVGAnimationElement::checkInvalidCSSAttributeType):
+ * svg/SVGAnimationElement.h:
+ (WebCore::SVGAnimationElement::attributeType):
+ (SVGAnimationElement):
+ (WebCore::SVGAnimationElement::hasInvalidCSSAttributeType):
+ * svg/animation/SVGSMILElement.cpp:
+ (WebCore::SVGSMILElement::targetElement):
+ * svg/animation/SVGSMILElement.h:
+ (SVGSMILElement):
+
2012-10-09 Pravin D <pravind....@gmail.com>
max-width property is does not overriding the width properties for css tables(display:table)
Modified: trunk/Source/WebCore/svg/SVGAnimateElement.cpp (130776 => 130777)
--- trunk/Source/WebCore/svg/SVGAnimateElement.cpp 2012-10-09 17:17:50 UTC (rev 130776)
+++ trunk/Source/WebCore/svg/SVGAnimateElement.cpp 2012-10-09 17:49:59 UTC (rev 130777)
@@ -56,8 +56,8 @@
SVGElement* targetElement = this->targetElement();
if (!targetElement)
return false;
-
- return m_animatedPropertyType != AnimatedUnknown;
+
+ return m_animatedPropertyType != AnimatedUnknown && !hasInvalidCSSAttributeType();
}
AnimatedPropertyType SVGAnimateElement::determineAnimatedPropertyType(SVGElement* targetElement) const
@@ -398,7 +398,7 @@
void SVGAnimateElement::targetElementWillChange(SVGElement* currentTarget, SVGElement* newTarget)
{
- SVGSMILElement::targetElementWillChange(currentTarget, newTarget);
+ SVGAnimationElement::targetElementWillChange(currentTarget, newTarget);
ASSERT(!m_animatedType);
m_fromType.clear();
Modified: trunk/Source/WebCore/svg/SVGAnimationElement.cpp (130776 => 130777)
--- trunk/Source/WebCore/svg/SVGAnimationElement.cpp 2012-10-09 17:17:50 UTC (rev 130776)
+++ trunk/Source/WebCore/svg/SVGAnimationElement.cpp 2012-10-09 17:49:59 UTC (rev 130777)
@@ -55,6 +55,8 @@
, m_fromPropertyValueType(RegularPropertyValue)
, m_toPropertyValueType(RegularPropertyValue)
, m_animationValid(false)
+ , m_attributeType(AttributeTypeAuto)
+ , m_hasInvalidCSSAttributeType(false)
{
registerAnimatedPropertiesForSVGAnimationElement();
}
@@ -145,6 +147,7 @@
supportedAttributes.add(SVGNames::keyTimesAttr);
supportedAttributes.add(SVGNames::keyPointsAttr);
supportedAttributes.add(SVGNames::keySplinesAttr);
+ supportedAttributes.add(SVGNames::attributeTypeAttr);
}
return supportedAttributes.contains<QualifiedName, SVGAttributeHashTranslator>(attrName);
}
@@ -185,6 +188,11 @@
return;
}
+ if (attribute.name() == SVGNames::attributeTypeAttr) {
+ setAttributeType(attribute.value());
+ return;
+ }
+
if (SVGTests::parseAttribute(attribute))
return;
if (SVGExternalResourcesRequired::parseAttribute(attribute))
@@ -281,16 +289,17 @@
return hasTagName(SVGNames::animateMotionTag) ? CalcModePaced : CalcModeLinear;
}
-SVGAnimationElement::AttributeType SVGAnimationElement::attributeType() const
-{
+void SVGAnimationElement::setAttributeType(const AtomicString& attributeType)
+{
DEFINE_STATIC_LOCAL(const AtomicString, css, ("CSS"));
DEFINE_STATIC_LOCAL(const AtomicString, xml, ("XML"));
- const AtomicString& value = fastGetAttribute(SVGNames::attributeTypeAttr);
- if (value == css)
- return AttributeTypeCSS;
- if (value == xml)
- return AttributeTypeXML;
- return AttributeTypeAuto;
+ if (attributeType == css)
+ m_attributeType = AttributeTypeCSS;
+ else if (attributeType == xml)
+ m_attributeType = AttributeTypeXML;
+ else
+ m_attributeType = AttributeTypeAuto;
+ checkInvalidCSSAttributeType(targetElement(DoNotResolveNewTarget));
}
String SVGAnimationElement::toValue() const
@@ -648,6 +657,25 @@
m_toPropertyValueType = InheritValue;
}
+void SVGAnimationElement::targetElementWillChange(SVGElement* currentTarget, SVGElement* newTarget)
+{
+ SVGSMILElement::targetElementWillChange(currentTarget, newTarget);
+
+ checkInvalidCSSAttributeType(newTarget);
}
+void SVGAnimationElement::setAttributeName(const QualifiedName& attributeName)
+{
+ SVGSMILElement::setAttributeName(attributeName);
+
+ checkInvalidCSSAttributeType(targetElement(DoNotResolveNewTarget));
+}
+
+void SVGAnimationElement::checkInvalidCSSAttributeType(SVGElement* target)
+{
+ m_hasInvalidCSSAttributeType = target && hasValidAttributeName() && attributeType() == AttributeTypeCSS && !isTargetAttributeCSSProperty(target, attributeName());
+}
+
+}
+
#endif // ENABLE(SVG)
Modified: trunk/Source/WebCore/svg/SVGAnimationElement.h (130776 => 130777)
--- trunk/Source/WebCore/svg/SVGAnimationElement.h 2012-10-09 17:17:50 UTC (rev 130776)
+++ trunk/Source/WebCore/svg/SVGAnimationElement.h 2012-10-09 17:49:59 UTC (rev 130777)
@@ -183,7 +183,7 @@
AttributeTypeXML,
AttributeTypeAuto
};
- AttributeType attributeType() const;
+ AttributeType attributeType() const { return m_attributeType; }
String toValue() const;
String byValue() const;
@@ -198,9 +198,16 @@
AnimatedPropertyValueType m_fromPropertyValueType;
AnimatedPropertyValueType m_toPropertyValueType;
+ virtual void targetElementWillChange(SVGElement* currentTarget, SVGElement* oldTarget) OVERRIDE;
+ bool hasInvalidCSSAttributeType() const { return m_hasInvalidCSSAttributeType; }
+
private:
virtual void animationAttributeChanged() OVERRIDE;
+ virtual void setAttributeName(const QualifiedName&) OVERRIDE;
+ void setAttributeType(const AtomicString&);
+ void checkInvalidCSSAttributeType(SVGElement*);
+
virtual bool calculateToAtEndOfDurationValue(const String& toAtEndOfDurationString) = 0;
virtual bool calculateFromAndToValues(const String& fromString, const String& toString) = 0;
virtual bool calculateFromAndByValues(const String& fromString, const String& byString) = 0;
@@ -230,12 +237,14 @@
bool m_animationValid;
+ AttributeType m_attributeType;
Vector<String> m_values;
Vector<float> m_keyTimes;
Vector<float> m_keyPoints;
Vector<UnitBezier> m_keySplines;
String m_lastValuesAnimationFrom;
String m_lastValuesAnimationTo;
+ bool m_hasInvalidCSSAttributeType;
};
} // namespace WebCore
Modified: trunk/Source/WebCore/svg/animation/SVGSMILElement.cpp (130776 => 130777)
--- trunk/Source/WebCore/svg/animation/SVGSMILElement.cpp 2012-10-09 17:17:50 UTC (rev 130776)
+++ trunk/Source/WebCore/svg/animation/SVGSMILElement.cpp 2012-10-09 17:49:59 UTC (rev 130777)
@@ -567,12 +567,12 @@
m_attributeName = attributeName;
}
-SVGElement* SVGSMILElement::targetElement()
+SVGElement* SVGSMILElement::targetElement(ResolveTarget resolveTarget)
{
if (m_targetElement)
return m_targetElement;
- if (!inDocument())
+ if (!inDocument() || resolveTarget == DoNotResolveNewTarget)
return 0;
String href = ""
Modified: trunk/Source/WebCore/svg/animation/SVGSMILElement.h (130776 => 130777)
--- trunk/Source/WebCore/svg/animation/SVGSMILElement.h 2012-10-09 17:17:50 UTC (rev 130776)
+++ trunk/Source/WebCore/svg/animation/SVGSMILElement.h 2012-10-09 17:49:59 UTC (rev 130777)
@@ -58,7 +58,7 @@
SMILTimeContainer* timeContainer() const { return m_timeContainer.get(); }
- SVGElement* targetElement();
+ SVGElement* targetElement(ResolveTarget = ResolveNewTarget);
void resetTargetElement(ResolveTarget = ResolveNewTarget);
const QualifiedName& attributeName() const { return m_attributeName; }
@@ -121,6 +121,7 @@
// Sub-classes may need to take action when the target is changed.
virtual void targetElementWillChange(SVGElement* currentTarget, SVGElement* newTarget);
+ virtual void setAttributeName(const QualifiedName&);
private:
virtual void startedActiveInterval() = 0;
@@ -142,8 +143,6 @@
void beginListChanged(SMILTime eventTime);
void endListChanged(SMILTime eventTime);
- void setAttributeName(const QualifiedName&);
-
// This represents conditions on elements begin or end list that need to be resolved on runtime
// for example <animate begin="otherElement.begin + 8s; button.click" ... />
struct Condition {
