<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[162643] trunk</title>
</head>
<body>
<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; }
#msg dl a { font-weight: bold}
#msg dl a:link { color:#fc3; }
#msg dl a:active { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/162643">162643</a></dd>
<dt>Author</dt> <dd>jhoneycutt@apple.com</dd>
<dt>Date</dt> <dd>2014-01-23 14:24:03 -0800 (Thu, 23 Jan 2014)</dd>
</dl>
<h3>Log Message</h3>
<pre>REGRESSION(<a href="http://trac.webkit.org/projects/webkit/changeset/161967">r161967</a>): Crash in WebCore::CachedSVGDocumentReference::load
<https://webkit.org/b/127151>
<rdar://problem/15840760>
Source/WebCore:
There were two issues introduced here; the first is a use-after-free of
CachedSVGDocumentReference objects.
The previous code kept a map from FilterOperation ->
RefPtr<WebKitCSSSVGDocumentValue>, which retained the
CachedSVGDocument. In <a href="http://trac.webkit.org/projects/webkit/changeset/161967">r161967</a>, this was changed to use a weak HashSet,
which allows stale CachedSVGDocumentReferences in the pending document
set if the owning FilterOperation is deleted. To fix this, we'll keep a
vector of RefPtr<FilterOperation> with pending SVG documents.
The second issue is a null deref in CachedSVGDocumentReference::load();
CachedResourceLoader::requestSVGDocument() can return 0 if (for
example) an invalid URL is passed. <a href="http://trac.webkit.org/projects/webkit/changeset/161967">r161967</a> removed a null check as part
of the refactoring.
Reviewed by Dirk Schulze.
Tests: css3/filters/crash-filter-animation-invalid-url.html
css3/filters/crash-invalid-url.html
* css/StyleResolver.cpp:
(WebCore::StyleResolver::State::clear):
Use new member var name.
(WebCore::StyleResolver::loadPendingSVGDocuments):
For each FilterOperation with a pending SVG document, get or create a
CachedSVGDocumentReference, and tell it to load. Changed to use new
function names.
(WebCore::StyleResolver::createFilterOperations):
Append the FilterOperation to the list of FilterOperations with
unloaded SVG documents.
* css/StyleResolver.h:
Changed from using PendingSVGDocumentSet, a weak set, to
a Vector<RefPtr<ReferenceFilterOperation>>.
(WebCore::StyleResolver::State::filtersWithPendingSVGDocuments):
Return the vector.
* loader/cache/CachedSVGDocumentReference.cpp:
(WebCore::CachedSVGDocumentReference::~CachedSVGDocumentReference):
Null check m_document rather than checking m_loadRequested.
m_loadRequested may be true when m_document is 0.
(WebCore::CachedSVGDocumentReference::load):
Null check the result of CachedResourceLoader::requestSVGDocument().
* platform/graphics/filters/FilterOperation.cpp:
(WebCore::ReferenceFilterOperation::getOrCreateCachedSVGDocumentReference):
Create, if necessary, and return the CachedSVGDocumentReference.
* platform/graphics/filters/FilterOperation.h:
Replaced createCachedSVGDocumentReference() with
getOrCreateCachedSVGDocumentReference(), which makes for slightly
cleaner code.
LayoutTests:
Reviewed by Dirk Schulze.
* css3/filters/crash-filter-animation-invalid-url-expected.txt: Added.
* css3/filters/crash-filter-animation-invalid-url.html: Added.
* css3/filters/crash-invalid-url-expected.txt: Added.
* css3/filters/crash-invalid-url.html: Added.</pre>
<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkLayoutTestsChangeLog">trunk/LayoutTests/ChangeLog</a></li>
<li><a href="#trunkSourceWebCoreChangeLog">trunk/Source/WebCore/ChangeLog</a></li>
<li><a href="#trunkSourceWebCorecssStyleResolvercpp">trunk/Source/WebCore/css/StyleResolver.cpp</a></li>
<li><a href="#trunkSourceWebCorecssStyleResolverh">trunk/Source/WebCore/css/StyleResolver.h</a></li>
<li><a href="#trunkSourceWebCoreloadercacheCachedSVGDocumentReferencecpp">trunk/Source/WebCore/loader/cache/CachedSVGDocumentReference.cpp</a></li>
<li><a href="#trunkSourceWebCoreplatformgraphicsfiltersFilterOperationcpp">trunk/Source/WebCore/platform/graphics/filters/FilterOperation.cpp</a></li>
<li><a href="#trunkSourceWebCoreplatformgraphicsfiltersFilterOperationh">trunk/Source/WebCore/platform/graphics/filters/FilterOperation.h</a></li>
</ul>
<h3>Added Paths</h3>
<ul>
<li><a href="#trunkLayoutTestscss3filterscrashfilteranimationinvalidurlexpectedtxt">trunk/LayoutTests/css3/filters/crash-filter-animation-invalid-url-expected.txt</a></li>
<li><a href="#trunkLayoutTestscss3filterscrashfilteranimationinvalidurlhtml">trunk/LayoutTests/css3/filters/crash-filter-animation-invalid-url.html</a></li>
<li><a href="#trunkLayoutTestscss3filterscrashinvalidurlexpectedtxt">trunk/LayoutTests/css3/filters/crash-invalid-url-expected.txt</a></li>
<li><a href="#trunkLayoutTestscss3filterscrashinvalidurlhtml">trunk/LayoutTests/css3/filters/crash-invalid-url.html</a></li>
</ul>
</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkLayoutTestsChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/ChangeLog (162642 => 162643)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/ChangeLog 2014-01-23 22:12:08 UTC (rev 162642)
+++ trunk/LayoutTests/ChangeLog 2014-01-23 22:24:03 UTC (rev 162643)
</span><span class="lines">@@ -1,3 +1,16 @@
</span><ins>+2014-01-22 Jon Honeycutt <jhoneycutt@apple.com>
+
+ REGRESSION(r161967): Crash in WebCore::CachedSVGDocumentReference::load
+ <https://webkit.org/b/127151>
+ <rdar://problem/15840760>
+
+ Reviewed by Dirk Schulze.
+
+ * css3/filters/crash-filter-animation-invalid-url-expected.txt: Added.
+ * css3/filters/crash-filter-animation-invalid-url.html: Added.
+ * css3/filters/crash-invalid-url-expected.txt: Added.
+ * css3/filters/crash-invalid-url.html: Added.
+
</ins><span class="cx"> 2014-01-23 Alexey Proskuryakov <ap@apple.com>
</span><span class="cx">
</span><span class="cx"> svg/animations/smil-syncbase-self-dependency.svg is very flaky
</span></span></pre></div>
<a id="trunkLayoutTestscss3filterscrashfilteranimationinvalidurlexpectedtxt"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/css3/filters/crash-filter-animation-invalid-url-expected.txt (0 => 162643)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/css3/filters/crash-filter-animation-invalid-url-expected.txt (rev 0)
+++ trunk/LayoutTests/css3/filters/crash-filter-animation-invalid-url-expected.txt 2014-01-23 22:24:03 UTC (rev 162643)
</span><span class="lines">@@ -0,0 +1,3 @@
</span><ins>+WebKit bug #127151. This test passes if it doesn't crash.
+
+XXX
</ins></span></pre></div>
<a id="trunkLayoutTestscss3filterscrashfilteranimationinvalidurlhtml"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/css3/filters/crash-filter-animation-invalid-url.html (0 => 162643)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/css3/filters/crash-filter-animation-invalid-url.html (rev 0)
+++ trunk/LayoutTests/css3/filters/crash-filter-animation-invalid-url.html 2014-01-23 22:24:03 UTC (rev 162643)
</span><span class="lines">@@ -0,0 +1,29 @@
</span><ins>+<!DOCTYPE html>
+<!-- Test passes if doesn't crash. -->
+<style>
+ a {
+ -webkit-animation-name: n;
+ -webkit-animation-duration: .01s;
+ }
+ @-webkit-keyframes n {
+ from {
+ -webkit-filter: url(z);
+ }
+ }
+</style>
+
+
+WebKit bug #127151. This test passes if it doesn't crash.
+
+<br><br>
+<a href="" id="a">XXX</div>
+
+<script>
+ if (window.testRunner) {
+ window.testRunner.dumpAsText(true);
+ window.testRunner.waitUntilDone();
+ }
+ document.getElementById("a").addEventListener('webkitAnimationStart', function() {
+ window.testRunner.notifyDone();
+ }, false);
+</script>
</ins></span></pre></div>
<a id="trunkLayoutTestscss3filterscrashinvalidurlexpectedtxt"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/css3/filters/crash-invalid-url-expected.txt (0 => 162643)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/css3/filters/crash-invalid-url-expected.txt (rev 0)
+++ trunk/LayoutTests/css3/filters/crash-invalid-url-expected.txt 2014-01-23 22:24:03 UTC (rev 162643)
</span><span class="lines">@@ -0,0 +1 @@
</span><ins>+WebKit bug #127151. This test passes if it doesn't crash.
</ins></span></pre></div>
<a id="trunkLayoutTestscss3filterscrashinvalidurlhtml"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/css3/filters/crash-invalid-url.html (0 => 162643)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/css3/filters/crash-invalid-url.html (rev 0)
+++ trunk/LayoutTests/css3/filters/crash-invalid-url.html 2014-01-23 22:24:03 UTC (rev 162643)
</span><span class="lines">@@ -0,0 +1,9 @@
</span><ins>+<!DOCTYPE html>
+<!-- Test passes if doesn't crash. -->
+
+<a href="" style="-webkit-filter: url(x);">WebKit bug #127151. This test passes if it doesn't crash.</a>
+
+<script>
+ if (window.testRunner)
+ window.testRunner.dumpAsText(true);
+</script>
</ins><span class="cx">\ No newline at end of file
</span></span></pre></div>
<a id="trunkSourceWebCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/ChangeLog (162642 => 162643)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/ChangeLog 2014-01-23 22:12:08 UTC (rev 162642)
+++ trunk/Source/WebCore/ChangeLog 2014-01-23 22:24:03 UTC (rev 162643)
</span><span class="lines">@@ -1,3 +1,62 @@
</span><ins>+2014-01-22 Jon Honeycutt <jhoneycutt@apple.com>
+
+ REGRESSION(r161967): Crash in WebCore::CachedSVGDocumentReference::load
+ <https://webkit.org/b/127151>
+ <rdar://problem/15840760>
+
+ There were two issues introduced here; the first is a use-after-free of
+ CachedSVGDocumentReference objects.
+
+ The previous code kept a map from FilterOperation ->
+ RefPtr<WebKitCSSSVGDocumentValue>, which retained the
+ CachedSVGDocument. In r161967, this was changed to use a weak HashSet,
+ which allows stale CachedSVGDocumentReferences in the pending document
+ set if the owning FilterOperation is deleted. To fix this, we'll keep a
+ vector of RefPtr<FilterOperation> with pending SVG documents.
+
+ The second issue is a null deref in CachedSVGDocumentReference::load();
+ CachedResourceLoader::requestSVGDocument() can return 0 if (for
+ example) an invalid URL is passed. r161967 removed a null check as part
+ of the refactoring.
+
+ Reviewed by Dirk Schulze.
+
+ Tests: css3/filters/crash-filter-animation-invalid-url.html
+ css3/filters/crash-invalid-url.html
+
+ * css/StyleResolver.cpp:
+ (WebCore::StyleResolver::State::clear):
+ Use new member var name.
+ (WebCore::StyleResolver::loadPendingSVGDocuments):
+ For each FilterOperation with a pending SVG document, get or create a
+ CachedSVGDocumentReference, and tell it to load. Changed to use new
+ function names.
+ (WebCore::StyleResolver::createFilterOperations):
+ Append the FilterOperation to the list of FilterOperations with
+ unloaded SVG documents.
+
+ * css/StyleResolver.h:
+ Changed from using PendingSVGDocumentSet, a weak set, to
+ a Vector<RefPtr<ReferenceFilterOperation>>.
+ (WebCore::StyleResolver::State::filtersWithPendingSVGDocuments):
+ Return the vector.
+
+ * loader/cache/CachedSVGDocumentReference.cpp:
+ (WebCore::CachedSVGDocumentReference::~CachedSVGDocumentReference):
+ Null check m_document rather than checking m_loadRequested.
+ m_loadRequested may be true when m_document is 0.
+ (WebCore::CachedSVGDocumentReference::load):
+ Null check the result of CachedResourceLoader::requestSVGDocument().
+
+ * platform/graphics/filters/FilterOperation.cpp:
+ (WebCore::ReferenceFilterOperation::getOrCreateCachedSVGDocumentReference):
+ Create, if necessary, and return the CachedSVGDocumentReference.
+
+ * platform/graphics/filters/FilterOperation.h:
+ Replaced createCachedSVGDocumentReference() with
+ getOrCreateCachedSVGDocumentReference(), which makes for slightly
+ cleaner code.
+
</ins><span class="cx"> 2014-01-23 Antti Koivisto <antti@apple.com>
</span><span class="cx">
</span><span class="cx"> Don't enable speculative tiles immediately after main load stops progressing
</span></span></pre></div>
<a id="trunkSourceWebCorecssStyleResolvercpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/css/StyleResolver.cpp (162642 => 162643)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/css/StyleResolver.cpp 2014-01-23 22:12:08 UTC (rev 162642)
+++ trunk/Source/WebCore/css/StyleResolver.cpp 2014-01-23 22:24:03 UTC (rev 162643)
</span><span class="lines">@@ -260,7 +260,7 @@
</span><span class="cx"> m_hasPendingShaders = false;
</span><span class="cx"> #endif
</span><span class="cx"> #if ENABLE(CSS_FILTERS) && ENABLE(SVG)
</span><del>- m_pendingSVGDocuments.clear();
</del><ins>+ m_filtersWithPendingSVGDocuments.clear();
</ins><span class="cx"> #endif
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -3415,13 +3415,14 @@
</span><span class="cx"> // style is NULL. We don't know exactly why this happens. Our guess is
</span><span class="cx"> // reentering styleForElement().
</span><span class="cx"> ASSERT(state.style());
</span><del>- if (!state.style() || !state.style()->hasFilter() || state.pendingSVGDocuments().isEmpty())
</del><ins>+ if (!state.style() || !state.style()->hasFilter() || state.filtersWithPendingSVGDocuments().isEmpty())
</ins><span class="cx"> return;
</span><span class="cx">
</span><span class="cx"> CachedResourceLoader* cachedResourceLoader = state.document().cachedResourceLoader();
</span><del>- for (auto pendingDocument : state.pendingSVGDocuments())
- pendingDocument->load(cachedResourceLoader);
- state.pendingSVGDocuments().clear();
</del><ins>+ for (auto filterOperation : state.filtersWithPendingSVGDocuments())
+ filterOperation->getOrCreateCachedSVGDocumentReference()->load(cachedResourceLoader);
+
+ state.filtersWithPendingSVGDocuments().clear();
</ins><span class="cx"> }
</span><span class="cx"> #endif
</span><span class="cx">
</span><span class="lines">@@ -3818,7 +3819,8 @@
</span><span class="cx">
</span><span class="cx"> RefPtr<ReferenceFilterOperation> operation = ReferenceFilterOperation::create(cssUrl, url.fragmentIdentifier(), operationType);
</span><span class="cx"> if (SVGURIReference::isExternalURIReference(cssUrl, m_state.document()))
</span><del>- m_state.pendingSVGDocuments().add(operation->createCachedSVGDocumentReference());
</del><ins>+ state.filtersWithPendingSVGDocuments().append(operation);
+
</ins><span class="cx"> operations.operations().append(operation);
</span><span class="cx"> #endif
</span><span class="cx"> continue;
</span></span></pre></div>
<a id="trunkSourceWebCorecssStyleResolverh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/css/StyleResolver.h (162642 => 162643)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/css/StyleResolver.h 2014-01-23 22:12:08 UTC (rev 162642)
+++ trunk/Source/WebCore/css/StyleResolver.h 2014-01-23 22:24:03 UTC (rev 162643)
</span><span class="lines">@@ -374,9 +374,6 @@
</span><span class="cx">
</span><span class="cx"> public:
</span><span class="cx"> typedef HashMap<CSSPropertyID, RefPtr<CSSValue>> PendingImagePropertyMap;
</span><del>-#if ENABLE(CSS_FILTERS) && ENABLE(SVG)
- typedef HashSet<CachedSVGDocumentReference*> PendingSVGDocumentSet;
-#endif
</del><span class="cx">
</span><span class="cx"> class State {
</span><span class="cx"> WTF_MAKE_NONCOPYABLE(State);
</span><span class="lines">@@ -428,7 +425,7 @@
</span><span class="cx"> bool applyPropertyToVisitedLinkStyle() const { return m_applyPropertyToVisitedLinkStyle; }
</span><span class="cx"> PendingImagePropertyMap& pendingImageProperties() { return m_pendingImageProperties; }
</span><span class="cx"> #if ENABLE(CSS_FILTERS) && ENABLE(SVG)
</span><del>- PendingSVGDocumentSet& pendingSVGDocuments() { return m_pendingSVGDocuments; }
</del><ins>+ Vector<RefPtr<ReferenceFilterOperation>>& filtersWithPendingSVGDocuments() { return m_filtersWithPendingSVGDocuments; }
</ins><span class="cx"> #endif
</span><span class="cx"> #if ENABLE(CSS_SHADERS)
</span><span class="cx"> void setHasPendingShaders(bool hasPendingShaders) { m_hasPendingShaders = hasPendingShaders; }
</span><span class="lines">@@ -482,7 +479,7 @@
</span><span class="cx"> bool m_hasPendingShaders;
</span><span class="cx"> #endif
</span><span class="cx"> #if ENABLE(CSS_FILTERS) && ENABLE(SVG)
</span><del>- PendingSVGDocumentSet m_pendingSVGDocuments;
</del><ins>+ Vector<RefPtr<ReferenceFilterOperation>> m_filtersWithPendingSVGDocuments;
</ins><span class="cx"> #endif
</span><span class="cx"> CSSValue* m_lineHeightValue;
</span><span class="cx"> bool m_fontDirty;
</span></span></pre></div>
<a id="trunkSourceWebCoreloadercacheCachedSVGDocumentReferencecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/loader/cache/CachedSVGDocumentReference.cpp (162642 => 162643)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/loader/cache/CachedSVGDocumentReference.cpp 2014-01-23 22:12:08 UTC (rev 162642)
+++ trunk/Source/WebCore/loader/cache/CachedSVGDocumentReference.cpp 2014-01-23 22:24:03 UTC (rev 162643)
</span><span class="lines">@@ -44,7 +44,7 @@
</span><span class="cx">
</span><span class="cx"> CachedSVGDocumentReference::~CachedSVGDocumentReference()
</span><span class="cx"> {
</span><del>- if (m_loadRequested)
</del><ins>+ if (m_document)
</ins><span class="cx"> m_document->removeClient(this);
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -57,7 +57,9 @@
</span><span class="cx"> CachedResourceRequest request(ResourceRequest(loader->document()->completeURL(m_url)));
</span><span class="cx"> request.setInitiator(cachedResourceRequestInitiators().css);
</span><span class="cx"> m_document = loader->requestSVGDocument(request);
</span><del>- m_document->addClient(this);
</del><ins>+ if (m_document)
+ m_document->addClient(this);
+
</ins><span class="cx"> m_loadRequested = true;
</span><span class="cx"> }
</span><span class="cx">
</span></span></pre></div>
<a id="trunkSourceWebCoreplatformgraphicsfiltersFilterOperationcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/platform/graphics/filters/FilterOperation.cpp (162642 => 162643)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/platform/graphics/filters/FilterOperation.cpp 2014-01-23 22:12:08 UTC (rev 162642)
+++ trunk/Source/WebCore/platform/graphics/filters/FilterOperation.cpp 2014-01-23 22:24:03 UTC (rev 162643)
</span><span class="lines">@@ -48,9 +48,10 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> #if ENABLE(SVG)
</span><del>-CachedSVGDocumentReference* ReferenceFilterOperation::createCachedSVGDocumentReference()
</del><ins>+CachedSVGDocumentReference* ReferenceFilterOperation::getOrCreateCachedSVGDocumentReference()
</ins><span class="cx"> {
</span><del>- m_cachedSVGDocumentReference = std::make_unique<CachedSVGDocumentReference>(m_url);
</del><ins>+ if (!m_cachedSVGDocumentReference)
+ m_cachedSVGDocumentReference = std::make_unique<CachedSVGDocumentReference>(m_url);
</ins><span class="cx"> return m_cachedSVGDocumentReference.get();
</span><span class="cx"> }
</span><span class="cx"> #endif
</span></span></pre></div>
<a id="trunkSourceWebCoreplatformgraphicsfiltersFilterOperationh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/platform/graphics/filters/FilterOperation.h (162642 => 162643)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/platform/graphics/filters/FilterOperation.h 2014-01-23 22:12:08 UTC (rev 162642)
+++ trunk/Source/WebCore/platform/graphics/filters/FilterOperation.h 2014-01-23 22:24:03 UTC (rev 162643)
</span><span class="lines">@@ -166,7 +166,7 @@
</span><span class="cx">
</span><span class="cx"> #if ENABLE(SVG)
</span><span class="cx"> CachedSVGDocumentReference* cachedSVGDocumentReference() const { return m_cachedSVGDocumentReference.get(); }
</span><del>- CachedSVGDocumentReference* createCachedSVGDocumentReference();
</del><ins>+ CachedSVGDocumentReference* getOrCreateCachedSVGDocumentReference();
</ins><span class="cx"> #endif
</span><span class="cx">
</span><span class="cx"> FilterEffect* filterEffect() const { return m_filterEffect.get(); }
</span></span></pre>
</div>
</div>
</body>
</html>