<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[183085] trunk</title>
</head>
<body>
<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; }
#msg dl a { font-weight: bold}
#msg dl a:link { color:#fc3; }
#msg dl a:active { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/183085">183085</a></dd>
<dt>Author</dt> <dd>commit-queue@webkit.org</dd>
<dt>Date</dt> <dd>2015-04-21 17:13:54 -0700 (Tue, 21 Apr 2015)</dd>
</dl>
<h3>Log Message</h3>
<pre>SVGAnimateElementBase::calculateAnimatedValue() asserts when reinserting an SVG animating element within the same animation limits
https://bugs.webkit.org/show_bug.cgi?id=143994
Patch by Said Abou-Hallawa <sabouhallawa@apple.com> on 2015-04-21
Reviewed by Simon Fraser.
Source/WebCore:
Make sure the SVG animation variables are reset cleanly such that if the
animation restarts it can rebuild its limit values reliably and correctly.
Tests: svg/animations/crash-reinsert-animate-length-same-limits.svg
svg/animations/crash-reinsert-animate-transform-same-limits.svg
* svg/SVGAnimateElementBase.h:
* svg/SVGAnimateElementBase.cpp:
(WebCore::SVGAnimateElementBase::resetAnimatedPropertyType):
Call the base class resetAnimatedPropertyType() from the derived class.
* svg/SVGAnimationElement.h:
* svg/SVGAnimationElement.cpp:
(WebCore::SVGAnimationElement::resetAnimatedPropertyType):
Make resetAnimatedPropertyType() virtual. The implementation of the base
class of this function resets the values of the animation limits. When
updateAnimation() is called, it will be forced to recalculate the animation
limits by calling calculateFromAndToValues() even if the limits have not
changed.
LayoutTests:
* svg/animations/crash-reinsert-animate-length-same-limits-expected.txt: Added.
* svg/animations/crash-reinsert-animate-length-same-limits.svg: Added.
* svg/animations/crash-reinsert-animate-transform-same-limits-expected.txt: Added.
* svg/animations/crash-reinsert-animate-transform-same-limits.svg: Added.
Make sure when removing an SVG animating element and reinserting it back
within the same animation length or transform limits, we do not crash.</pre>
<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkLayoutTestsChangeLog">trunk/LayoutTests/ChangeLog</a></li>
<li><a href="#trunkSourceWebCoreChangeLog">trunk/Source/WebCore/ChangeLog</a></li>
<li><a href="#trunkSourceWebCoresvgSVGAnimateElementBasecpp">trunk/Source/WebCore/svg/SVGAnimateElementBase.cpp</a></li>
<li><a href="#trunkSourceWebCoresvgSVGAnimateElementBaseh">trunk/Source/WebCore/svg/SVGAnimateElementBase.h</a></li>
<li><a href="#trunkSourceWebCoresvgSVGAnimationElementcpp">trunk/Source/WebCore/svg/SVGAnimationElement.cpp</a></li>
<li><a href="#trunkSourceWebCoresvgSVGAnimationElementh">trunk/Source/WebCore/svg/SVGAnimationElement.h</a></li>
</ul>
<h3>Added Paths</h3>
<ul>
<li><a href="#trunkLayoutTestssvganimationscrashreinsertanimatelengthsamelimitsexpectedtxt">trunk/LayoutTests/svg/animations/crash-reinsert-animate-length-same-limits-expected.txt</a></li>
<li><a href="#trunkLayoutTestssvganimationscrashreinsertanimatelengthsamelimitssvg">trunk/LayoutTests/svg/animations/crash-reinsert-animate-length-same-limits.svg</a></li>
<li><a href="#trunkLayoutTestssvganimationscrashreinsertanimatetransformsamelimitsexpectedtxt">trunk/LayoutTests/svg/animations/crash-reinsert-animate-transform-same-limits-expected.txt</a></li>
<li><a href="#trunkLayoutTestssvganimationscrashreinsertanimatetransformsamelimitssvg">trunk/LayoutTests/svg/animations/crash-reinsert-animate-transform-same-limits.svg</a></li>
</ul>
</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkLayoutTestsChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/ChangeLog (183084 => 183085)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/ChangeLog 2015-04-22 00:04:51 UTC (rev 183084)
+++ trunk/LayoutTests/ChangeLog 2015-04-22 00:13:54 UTC (rev 183085)
</span><span class="lines">@@ -1,3 +1,17 @@
</span><ins>+2015-04-21 Said Abou-Hallawa <sabouhallawa@apple.com>
+
+ SVGAnimateElementBase::calculateAnimatedValue() asserts when reinserting an SVG animating element within the same animation limits
+ https://bugs.webkit.org/show_bug.cgi?id=143994
+
+ Reviewed by Simon Fraser.
+
+ * svg/animations/crash-reinsert-animate-length-same-limits-expected.txt: Added.
+ * svg/animations/crash-reinsert-animate-length-same-limits.svg: Added.
+ * svg/animations/crash-reinsert-animate-transform-same-limits-expected.txt: Added.
+ * svg/animations/crash-reinsert-animate-transform-same-limits.svg: Added.
+ Make sure when removing an SVG animating element and reinserting it back
+ within the same animation length or transform limits, we do not crash.
+
</ins><span class="cx"> 2015-04-21 Jinwoo Song <jinwoo7.song@samsung.com>
</span><span class="cx">
</span><span class="cx"> [EFL] Unreviewed gardening
</span></span></pre></div>
<a id="trunkLayoutTestssvganimationscrashreinsertanimatelengthsamelimitsexpectedtxt"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/svg/animations/crash-reinsert-animate-length-same-limits-expected.txt (0 => 183085)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/svg/animations/crash-reinsert-animate-length-same-limits-expected.txt (rev 0)
+++ trunk/LayoutTests/svg/animations/crash-reinsert-animate-length-same-limits-expected.txt 2015-04-22 00:13:54 UTC (rev 183085)
</span><span class="lines">@@ -0,0 +1 @@
</span><ins>+PASS
</ins></span></pre></div>
<a id="trunkLayoutTestssvganimationscrashreinsertanimatelengthsamelimitssvg"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/svg/animations/crash-reinsert-animate-length-same-limits.svg (0 => 183085)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/svg/animations/crash-reinsert-animate-length-same-limits.svg (rev 0)
+++ trunk/LayoutTests/svg/animations/crash-reinsert-animate-length-same-limits.svg 2015-04-22 00:13:54 UTC (rev 183085)
</span><span class="lines">@@ -0,0 +1,24 @@
</span><ins>+<svg xmlns="http://www.w3.org/2000/svg">
+ <circle id="lime-circle" fill="lime" cx="100" cy="100" r="90"/>
+ <circle id="yellow-circle" fill="yellow" cx="100" cy="100" r="90">
+ <animate attributeName="r" values="90; 30" dur="2s"/>
+ </circle>
+ <text x="100" y="100" text-anchor="middle" alignment-baseline="middle">PASS</text>
+ <script>
+ if (window.testRunner) {
+ testRunner.dumpAsText();
+ testRunner.waitUntilDone();
+ }
+ setTimeout(function() {
+ var limeCircle = document.getElementById("lime-circle");
+ var yellowCircle = document.getElementById("yellow-circle");
+ document.documentElement.insertBefore(yellowCircle, limeCircle);
+ // This timeout is needed to ensure that the animation timer is fired at
+ // least once before the test is done.
+ setTimeout(function() {
+ if (window.testRunner)
+ testRunner.notifyDone();
+ }, 0);
+ }, 0);
+ </script>
+</svg>
</ins></span></pre></div>
<a id="trunkLayoutTestssvganimationscrashreinsertanimatetransformsamelimitsexpectedtxt"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/svg/animations/crash-reinsert-animate-transform-same-limits-expected.txt (0 => 183085)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/svg/animations/crash-reinsert-animate-transform-same-limits-expected.txt (rev 0)
+++ trunk/LayoutTests/svg/animations/crash-reinsert-animate-transform-same-limits-expected.txt 2015-04-22 00:13:54 UTC (rev 183085)
</span><span class="lines">@@ -0,0 +1 @@
</span><ins>+PASS
</ins></span></pre></div>
<a id="trunkLayoutTestssvganimationscrashreinsertanimatetransformsamelimitssvg"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/svg/animations/crash-reinsert-animate-transform-same-limits.svg (0 => 183085)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/svg/animations/crash-reinsert-animate-transform-same-limits.svg (rev 0)
+++ trunk/LayoutTests/svg/animations/crash-reinsert-animate-transform-same-limits.svg 2015-04-22 00:13:54 UTC (rev 183085)
</span><span class="lines">@@ -0,0 +1,24 @@
</span><ins>+<svg xmlns="http://www.w3.org/2000/svg">
+ <circle id="lime-circle" fill="lime" cx="100" cy="100" r="45"/>
+ <circle id="yellow-circle" fill="yellow" cx="100" cy="100" r="90">
+ <animateTransform attributeName="transform" type="scale" values="1; 0.5; 1" dur="2s"/>
+ </circle>
+ <text x="100" y="100" text-anchor="middle" alignment-baseline="middle">PASS</text>
+ <script>
+ if (window.testRunner) {
+ testRunner.dumpAsText();
+ testRunner.waitUntilDone();
+ }
+ setTimeout(function() {
+ var limeCircle = document.getElementById("lime-circle");
+ var yellowCircle = document.getElementById("yellow-circle");
+ document.documentElement.insertBefore(yellowCircle, limeCircle);
+ // This timeout is needed to ensure that the animation timer is fired at
+ // least once before the test is done.
+ setTimeout(function() {
+ if (window.testRunner)
+ testRunner.notifyDone();
+ }, 0);
+ }, 0);
+ </script>
+</svg>
</ins></span></pre></div>
<a id="trunkSourceWebCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/ChangeLog (183084 => 183085)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/ChangeLog 2015-04-22 00:04:51 UTC (rev 183084)
+++ trunk/Source/WebCore/ChangeLog 2015-04-22 00:13:54 UTC (rev 183085)
</span><span class="lines">@@ -1,3 +1,30 @@
</span><ins>+2015-04-21 Said Abou-Hallawa <sabouhallawa@apple.com>
+
+ SVGAnimateElementBase::calculateAnimatedValue() asserts when reinserting an SVG animating element within the same animation limits
+ https://bugs.webkit.org/show_bug.cgi?id=143994
+
+ Reviewed by Simon Fraser.
+
+ Make sure the SVG animation variables are reset cleanly such that if the
+ animation restarts it can rebuild its limit values reliably and correctly.
+
+ Tests: svg/animations/crash-reinsert-animate-length-same-limits.svg
+ svg/animations/crash-reinsert-animate-transform-same-limits.svg
+
+ * svg/SVGAnimateElementBase.h:
+ * svg/SVGAnimateElementBase.cpp:
+ (WebCore::SVGAnimateElementBase::resetAnimatedPropertyType):
+ Call the base class resetAnimatedPropertyType() from the derived class.
+
+ * svg/SVGAnimationElement.h:
+ * svg/SVGAnimationElement.cpp:
+ (WebCore::SVGAnimationElement::resetAnimatedPropertyType):
+ Make resetAnimatedPropertyType() virtual. The implementation of the base
+ class of this function resets the values of the animation limits. When
+ updateAnimation() is called, it will be forced to recalculate the animation
+ limits by calling calculateFromAndToValues() even if the limits have not
+ changed.
+
</ins><span class="cx"> 2015-04-21 Tim Horton <timothy_horton@apple.com>
</span><span class="cx">
</span><span class="cx"> Long pause under _takeViewSnapshot when screen updates are disabled
</span></span></pre></div>
<a id="trunkSourceWebCoresvgSVGAnimateElementBasecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/svg/SVGAnimateElementBase.cpp (183084 => 183085)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/svg/SVGAnimateElementBase.cpp 2015-04-22 00:04:51 UTC (rev 183084)
+++ trunk/Source/WebCore/svg/SVGAnimateElementBase.cpp 2015-04-22 00:13:54 UTC (rev 183085)
</span><span class="lines">@@ -431,6 +431,7 @@
</span><span class="cx">
</span><span class="cx"> void SVGAnimateElementBase::resetAnimatedPropertyType()
</span><span class="cx"> {
</span><ins>+ SVGAnimationElement::resetAnimatedPropertyType();
</ins><span class="cx"> ASSERT(!m_animatedType);
</span><span class="cx"> m_fromType = nullptr;
</span><span class="cx"> m_toType = nullptr;
</span></span></pre></div>
<a id="trunkSourceWebCoresvgSVGAnimateElementBaseh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/svg/SVGAnimateElementBase.h (183084 => 183085)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/svg/SVGAnimateElementBase.h 2015-04-22 00:04:51 UTC (rev 183084)
+++ trunk/Source/WebCore/svg/SVGAnimateElementBase.h 2015-04-22 00:13:54 UTC (rev 183085)
</span><span class="lines">@@ -53,11 +53,11 @@
</span><span class="cx">
</span><span class="cx"> virtual void setTargetElement(SVGElement*) override;
</span><span class="cx"> virtual void setAttributeName(const QualifiedName&) override;
</span><ins>+ virtual void resetAnimatedPropertyType() override;
</ins><span class="cx">
</span><span class="cx"> AnimatedPropertyType m_animatedPropertyType;
</span><span class="cx">
</span><span class="cx"> private:
</span><del>- void resetAnimatedPropertyType();
</del><span class="cx"> SVGAnimatedTypeAnimator* ensureAnimator();
</span><span class="cx"> bool animatedPropertyTypeSupportsAddition() const;
</span><span class="cx">
</span></span></pre></div>
<a id="trunkSourceWebCoresvgSVGAnimationElementcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/svg/SVGAnimationElement.cpp (183084 => 183085)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/svg/SVGAnimationElement.cpp 2015-04-22 00:04:51 UTC (rev 183084)
+++ trunk/Source/WebCore/svg/SVGAnimationElement.cpp 2015-04-22 00:13:54 UTC (rev 183085)
</span><span class="lines">@@ -674,6 +674,11 @@
</span><span class="cx"> if (inheritsFromProperty(targetElement, attributeName, to))
</span><span class="cx"> m_toPropertyValueType = InheritValue;
</span><span class="cx"> }
</span><ins>+void SVGAnimationElement::resetAnimatedPropertyType()
+{
+ m_lastValuesAnimationFrom = String();
+ m_lastValuesAnimationTo = String();
+}
</ins><span class="cx">
</span><span class="cx"> void SVGAnimationElement::setTargetElement(SVGElement* target)
</span><span class="cx"> {
</span></span></pre></div>
<a id="trunkSourceWebCoresvgSVGAnimationElementh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/svg/SVGAnimationElement.h (183084 => 183085)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/svg/SVGAnimationElement.h 2015-04-22 00:04:51 UTC (rev 183084)
+++ trunk/Source/WebCore/svg/SVGAnimationElement.h 2015-04-22 00:13:54 UTC (rev 183085)
</span><span class="lines">@@ -168,6 +168,7 @@
</span><span class="cx">
</span><span class="cx"> void computeCSSPropertyValue(SVGElement*, CSSPropertyID, String& value);
</span><span class="cx"> virtual void determinePropertyValueTypes(const String& from, const String& to);
</span><ins>+ virtual void resetAnimatedPropertyType();
</ins><span class="cx">
</span><span class="cx"> static bool isSupportedAttribute(const QualifiedName&);
</span><span class="cx"> virtual void parseAttribute(const QualifiedName&, const AtomicString&) override;
</span></span></pre>
</div>
</div>
</body>
</html>