Title: [164861] trunk
- Revision
- 164861
- Author
- [email protected]
- Date
- 2014-02-28 08:35:27 -0800 (Fri, 28 Feb 2014)
Log Message
ASSERTION FAILED: roundedIntPoint(rendererMappedResult) == roundedIntPoint(result) in WebCore::RenderGeometryMap::mapToContainer
https://bugs.webkit.org/show_bug.cgi?id=119626
Source/WebCore:
SVGRenderSupport::mapLocalToContainer() was trying to apply transforms
in the incorrect order. Specifically, it would attempt to apply its
localToParentTransform before its localToBorderBoxTransform. This
was causing an ASSERT to fail when the computed transforms didn't
match up to those computed by RenderGeometryMap.
Backported from Blink: https://codereview.chromium.org/143363004
Patch by Martin Hodovan <[email protected]> on 2014-02-28
Reviewed by Simon Fraser.
Test: svg/transforms/svg-geometry-crash.html
* rendering/svg/SVGRenderSupport.cpp:
(WebCore::SVGRenderSupport::mapLocalToContainer):
LayoutTests:
Backported from Blink: https://codereview.chromium.org/143363004
Patch by Martin Hodovan <[email protected]> on 2014-02-28
Reviewed by Simon Fraser.
* svg/transforms/svg-geometry-crash-expected.txt: Added.
* svg/transforms/svg-geometry-crash.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (164860 => 164861)
--- trunk/LayoutTests/ChangeLog 2014-02-28 15:52:17 UTC (rev 164860)
+++ trunk/LayoutTests/ChangeLog 2014-02-28 16:35:27 UTC (rev 164861)
@@ -1,3 +1,15 @@
+2014-02-28 Martin Hodovan <[email protected]>
+
+ ASSERTION FAILED: roundedIntPoint(rendererMappedResult) == roundedIntPoint(result) in WebCore::RenderGeometryMap::mapToContainer
+ https://bugs.webkit.org/show_bug.cgi?id=119626
+
+ Backported from Blink: https://codereview.chromium.org/143363004
+
+ Reviewed by Simon Fraser.
+
+ * svg/transforms/svg-geometry-crash-expected.txt: Added.
+ * svg/transforms/svg-geometry-crash.html: Added.
+
2014-02-28 Commit Queue <[email protected]>
Unreviewed, rolling out r164859.
Added: trunk/LayoutTests/svg/transforms/svg-geometry-crash-expected.txt (0 => 164861)
--- trunk/LayoutTests/svg/transforms/svg-geometry-crash-expected.txt (rev 0)
+++ trunk/LayoutTests/svg/transforms/svg-geometry-crash-expected.txt 2014-02-28 16:35:27 UTC (rev 164861)
@@ -0,0 +1,2 @@
+
+This test passes if it does not crash.
Added: trunk/LayoutTests/svg/transforms/svg-geometry-crash.html (0 => 164861)
--- trunk/LayoutTests/svg/transforms/svg-geometry-crash.html (rev 0)
+++ trunk/LayoutTests/svg/transforms/svg-geometry-crash.html 2014-02-28 16:35:27 UTC (rev 164861)
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html>
+ <head>
+ <script>
+ if (window.testRunner)
+ testRunner.dumpAsText();
+ </script>
+ </head>
+ <body>
+ <svg viewbox="0 0 1000 500">
+ <g transform="scale(3.0)">
+ <foreignobject width="300" height="50">
+ <textarea>scaled text</textarea>
+ </foreignobject>
+ </g>
+ </svg>
+ This test passes if it does not crash.
+ </body>
+</html>
Modified: trunk/Source/WebCore/ChangeLog (164860 => 164861)
--- trunk/Source/WebCore/ChangeLog 2014-02-28 15:52:17 UTC (rev 164860)
+++ trunk/Source/WebCore/ChangeLog 2014-02-28 16:35:27 UTC (rev 164861)
@@ -1,3 +1,23 @@
+2014-02-28 Martin Hodovan <[email protected]>
+
+ ASSERTION FAILED: roundedIntPoint(rendererMappedResult) == roundedIntPoint(result) in WebCore::RenderGeometryMap::mapToContainer
+ https://bugs.webkit.org/show_bug.cgi?id=119626
+
+ SVGRenderSupport::mapLocalToContainer() was trying to apply transforms
+ in the incorrect order. Specifically, it would attempt to apply its
+ localToParentTransform before its localToBorderBoxTransform. This
+ was causing an ASSERT to fail when the computed transforms didn't
+ match up to those computed by RenderGeometryMap.
+
+ Backported from Blink: https://codereview.chromium.org/143363004
+
+ Reviewed by Simon Fraser.
+
+ Test: svg/transforms/svg-geometry-crash.html
+
+ * rendering/svg/SVGRenderSupport.cpp:
+ (WebCore::SVGRenderSupport::mapLocalToContainer):
+
2014-02-28 Mihnea Ovidenie <[email protected]>
[CSSRegions] ASSERTION FAILED: !m_regionsInvalidated in RenderFlowThread::regionAtBlockOffset
Modified: trunk/Source/WebCore/rendering/svg/SVGRenderSupport.cpp (164860 => 164861)
--- trunk/Source/WebCore/rendering/svg/SVGRenderSupport.cpp 2014-02-28 15:52:17 UTC (rev 164860)
+++ trunk/Source/WebCore/rendering/svg/SVGRenderSupport.cpp 2014-02-28 16:35:27 UTC (rev 164861)
@@ -83,8 +83,6 @@
void SVGRenderSupport::mapLocalToContainer(const RenderElement& renderer, const RenderLayerModelObject* repaintContainer, TransformState& transformState, bool* wasFixed)
{
- transformState.applyTransform(renderer.localToParentTransform());
-
ASSERT(renderer.parent());
auto& parent = *renderer.parent();
@@ -94,6 +92,8 @@
if (parent.isSVGRoot())
transformState.applyTransform(toRenderSVGRoot(parent).localToBorderBoxTransform());
+ transformState.applyTransform(renderer.localToParentTransform());
+
MapCoordinatesFlags mode = UseTransforms;
parent.mapLocalToContainer(repaintContainer, transformState, mode, wasFixed);
}
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
