<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[242856] branches/safari-607-branch</title>
</head>
<body>

<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt;  }
#msg dl a { font-weight: bold}
#msg dl a:link    { color:#fc3; }
#msg dl a:active  { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff  {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/242856">242856</a></dd>
<dt>Author</dt> <dd>bshafiei@apple.com</dd>
<dt>Date</dt> <dd>2019-03-13 01:24:34 -0700 (Wed, 13 Mar 2019)</dd>
</dl>

<h3>Log Message</h3>
<pre>Cherry-pick <a href="http://trac.webkit.org/projects/webkit/changeset/242515">r242515</a>. rdar://problem/48839275

    SVGPathSegList.insertItemBefore() should fail if the newItem belongs to an animating animPathSegList
    https://bugs.webkit.org/show_bug.cgi?id=195333
    <rdar://problem/48475802>

    Reviewed by Simon Fraser.

    Source/WebCore:

    Because the SVG1.1 specs states that the newItem should be removed from
    its original list before adding it to another list,
    SVGPathSegList.insertItemBefore() should fail if the new item belongs to
    an animating animPathSegList since it is read-only.

    Test: svg/dom/SVGPathSegList-insert-from-animating-animPathSegList.svg

    * svg/SVGPathSegList.cpp:
    (WebCore::SVGPathSegList::processIncomingListItemValue):

    LayoutTests:

    * svg/dom/SVGPathSegList-insert-from-animating-animPathSegList-expected.txt: Added.
    * svg/dom/SVGPathSegList-insert-from-animating-animPathSegList.svg: Added.

    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@242515 268f45cc-cd09-0410-ab3c-d52691b4dbfc</pre>

<h3>Modified Paths</h3>
<ul>
<li><a href="#branchessafari607branchLayoutTestsChangeLog">branches/safari-607-branch/LayoutTests/ChangeLog</a></li>
<li><a href="#branchessafari607branchSourceWebCoreChangeLog">branches/safari-607-branch/Source/WebCore/ChangeLog</a></li>
<li><a href="#branchessafari607branchSourceWebCoresvgSVGPathSegListcpp">branches/safari-607-branch/Source/WebCore/svg/SVGPathSegList.cpp</a></li>
</ul>

<h3>Added Paths</h3>
<ul>
<li><a href="#branchessafari607branchLayoutTestssvgdomSVGPathSegListinsertfromanimatinganimPathSegListexpectedtxt">branches/safari-607-branch/LayoutTests/svg/dom/SVGPathSegList-insert-from-animating-animPathSegList-expected.txt</a></li>
<li><a href="#branchessafari607branchLayoutTestssvgdomSVGPathSegListinsertfromanimatinganimPathSegListsvg">branches/safari-607-branch/LayoutTests/svg/dom/SVGPathSegList-insert-from-animating-animPathSegList.svg</a></li>
</ul>

</div>
<div id="patch">
<h3>Diff</h3>
<a id="branchessafari607branchLayoutTestsChangeLog"></a>
<div class="modfile"><h4>Modified: branches/safari-607-branch/LayoutTests/ChangeLog (242855 => 242856)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-607-branch/LayoutTests/ChangeLog 2019-03-13 08:24:31 UTC (rev 242855)
+++ branches/safari-607-branch/LayoutTests/ChangeLog    2019-03-13 08:24:34 UTC (rev 242856)
</span><span class="lines">@@ -1,5 +1,46 @@
</span><span class="cx"> 2019-03-13  Babak Shafiei  <bshafiei@apple.com>
</span><span class="cx"> 
</span><ins>+        Cherry-pick r242515. rdar://problem/48839275
+
+    SVGPathSegList.insertItemBefore() should fail if the newItem belongs to an animating animPathSegList
+    https://bugs.webkit.org/show_bug.cgi?id=195333
+    <rdar://problem/48475802>
+    
+    Reviewed by Simon Fraser.
+    
+    Source/WebCore:
+    
+    Because the SVG1.1 specs states that the newItem should be removed from
+    its original list before adding it to another list,
+    SVGPathSegList.insertItemBefore() should fail if the new item belongs to
+    an animating animPathSegList since it is read-only.
+    
+    Test: svg/dom/SVGPathSegList-insert-from-animating-animPathSegList.svg
+    
+    * svg/SVGPathSegList.cpp:
+    (WebCore::SVGPathSegList::processIncomingListItemValue):
+    
+    LayoutTests:
+    
+    * svg/dom/SVGPathSegList-insert-from-animating-animPathSegList-expected.txt: Added.
+    * svg/dom/SVGPathSegList-insert-from-animating-animPathSegList.svg: Added.
+    
+    
+    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@242515 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+    2019-03-05  Said Abou-Hallawa  <sabouhallawa@apple.com>
+
+            SVGPathSegList.insertItemBefore() should fail if the newItem belongs to an animating animPathSegList
+            https://bugs.webkit.org/show_bug.cgi?id=195333
+            <rdar://problem/48475802>
+
+            Reviewed by Simon Fraser.
+
+            * svg/dom/SVGPathSegList-insert-from-animating-animPathSegList-expected.txt: Added.
+            * svg/dom/SVGPathSegList-insert-from-animating-animPathSegList.svg: Added.
+
+2019-03-13  Babak Shafiei  <bshafiei@apple.com>
+
</ins><span class="cx">         Cherry-pick r241608. rdar://problem/48839277
</span><span class="cx"> 
</span><span class="cx">     [WebVTT] Inline WebVTT styles should start with '::cue'
</span></span></pre></div>
<a id="branchessafari607branchLayoutTestssvgdomSVGPathSegListinsertfromanimatinganimPathSegListexpectedtxt"></a>
<div class="addfile"><h4>Added: branches/safari-607-branch/LayoutTests/svg/dom/SVGPathSegList-insert-from-animating-animPathSegList-expected.txt (0 => 242856)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-607-branch/LayoutTests/svg/dom/SVGPathSegList-insert-from-animating-animPathSegList-expected.txt                         (rev 0)
+++ branches/safari-607-branch/LayoutTests/svg/dom/SVGPathSegList-insert-from-animating-animPathSegList-expected.txt    2019-03-13 08:24:34 UTC (rev 242856)
</span><span class="lines">@@ -0,0 +1 @@
</span><ins>+PASS: did not assert in debug.
</ins></span></pre></div>
<a id="branchessafari607branchLayoutTestssvgdomSVGPathSegListinsertfromanimatinganimPathSegListsvg"></a>
<div class="addfile"><h4>Added: branches/safari-607-branch/LayoutTests/svg/dom/SVGPathSegList-insert-from-animating-animPathSegList.svg (0 => 242856)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-607-branch/LayoutTests/svg/dom/SVGPathSegList-insert-from-animating-animPathSegList.svg                          (rev 0)
+++ branches/safari-607-branch/LayoutTests/svg/dom/SVGPathSegList-insert-from-animating-animPathSegList.svg     2019-03-13 08:24:34 UTC (rev 242856)
</span><span class="lines">@@ -0,0 +1,29 @@
</span><ins>+<svg id="svg" xmlns="http://www.w3.org/2000/svg">
+    <path id="path1"></path>
+    <path id="path2" d="M 1 1 S 2,2 3,3">
+        <animate id="animate" attributeName="d" values="M 1 1" min="1s" max="2s"/>
+    </path>
+    <text>PASS: did not assert in debug.</text>
+    <script>
+        if (window.testRunner) {
+            testRunner.dumpAsText();
+            testRunner.waitUntilDone();
+        }
+
+        var animate = document.getElementById("animate");
+        animate.addEventListener('beginEvent' , function () {
+            var path1 = document.getElementById("path1");
+            var path2 = document.getElementById("path2");
+
+            var path1_pathSegList = path1.pathSegList;
+            var path2_animPathSegList = path2.animatedPathSegList;  
+
+            document.documentElement.setCurrentTime(1);
+
+            var pathseg = path2_animPathSegList.getItem(0); 
+            path1_pathSegList.insertItemBefore(pathseg, 0);
+            if (window.testRunner)
+                testRunner.notifyDone();
+        }, { once: true});
+    </script>
+</svg>
</ins></span></pre></div>
<a id="branchessafari607branchSourceWebCoreChangeLog"></a>
<div class="modfile"><h4>Modified: branches/safari-607-branch/Source/WebCore/ChangeLog (242855 => 242856)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-607-branch/Source/WebCore/ChangeLog      2019-03-13 08:24:31 UTC (rev 242855)
+++ branches/safari-607-branch/Source/WebCore/ChangeLog 2019-03-13 08:24:34 UTC (rev 242856)
</span><span class="lines">@@ -1,5 +1,53 @@
</span><span class="cx"> 2019-03-13  Babak Shafiei  <bshafiei@apple.com>
</span><span class="cx"> 
</span><ins>+        Cherry-pick r242515. rdar://problem/48839275
+
+    SVGPathSegList.insertItemBefore() should fail if the newItem belongs to an animating animPathSegList
+    https://bugs.webkit.org/show_bug.cgi?id=195333
+    <rdar://problem/48475802>
+    
+    Reviewed by Simon Fraser.
+    
+    Source/WebCore:
+    
+    Because the SVG1.1 specs states that the newItem should be removed from
+    its original list before adding it to another list,
+    SVGPathSegList.insertItemBefore() should fail if the new item belongs to
+    an animating animPathSegList since it is read-only.
+    
+    Test: svg/dom/SVGPathSegList-insert-from-animating-animPathSegList.svg
+    
+    * svg/SVGPathSegList.cpp:
+    (WebCore::SVGPathSegList::processIncomingListItemValue):
+    
+    LayoutTests:
+    
+    * svg/dom/SVGPathSegList-insert-from-animating-animPathSegList-expected.txt: Added.
+    * svg/dom/SVGPathSegList-insert-from-animating-animPathSegList.svg: Added.
+    
+    
+    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@242515 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+    2019-03-05  Said Abou-Hallawa  <sabouhallawa@apple.com>
+
+            SVGPathSegList.insertItemBefore() should fail if the newItem belongs to an animating animPathSegList
+            https://bugs.webkit.org/show_bug.cgi?id=195333
+            <rdar://problem/48475802>
+
+            Reviewed by Simon Fraser.
+
+            Because the SVG1.1 specs states that the newItem should be removed from
+            its original list before adding it to another list,
+            SVGPathSegList.insertItemBefore() should fail if the new item belongs to
+            an animating animPathSegList since it is read-only.
+
+            Test: svg/dom/SVGPathSegList-insert-from-animating-animPathSegList.svg
+
+            * svg/SVGPathSegList.cpp:
+            (WebCore::SVGPathSegList::processIncomingListItemValue):
+
+2019-03-13  Babak Shafiei  <bshafiei@apple.com>
+
</ins><span class="cx">         Cherry-pick r241632. rdar://problem/48839379
</span><span class="cx"> 
</span><span class="cx">     Sample domainsVisited diagnostic logging
</span></span></pre></div>
<a id="branchessafari607branchSourceWebCoresvgSVGPathSegListcpp"></a>
<div class="modfile"><h4>Modified: branches/safari-607-branch/Source/WebCore/svg/SVGPathSegList.cpp (242855 => 242856)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-607-branch/Source/WebCore/svg/SVGPathSegList.cpp 2019-03-13 08:24:31 UTC (rev 242855)
+++ branches/safari-607-branch/Source/WebCore/svg/SVGPathSegList.cpp    2019-03-13 08:24:34 UTC (rev 242856)
</span><span class="lines">@@ -85,8 +85,15 @@
</span><span class="cx">     bool livesInOtherList = animatedPropertyOfItem != m_animatedProperty;
</span><span class="cx">     RefPtr<SVGAnimatedPathSegListPropertyTearOff> propertyTearOff = static_pointer_cast<SVGAnimatedPathSegListPropertyTearOff>(animatedPropertyOfItem);
</span><span class="cx">     int indexToRemove = propertyTearOff->findItem(newItem.get());
</span><del>-    ASSERT(indexToRemove != -1);
</del><span class="cx"> 
</span><ins>+    // If newItem does not exist in the propertyTearOff baseVal() list, it has to be
+    // in its animVal() list and it has to be animating.
+    if (indexToRemove == -1) {
+        ASSERT(propertyTearOff->isAnimating());
+        ASSERT(propertyTearOff->animVal()->findItem(newItem.get()) != -1);
+        return false;
+    }
+
</ins><span class="cx">     // Do not remove newItem if already in this list at the target index.
</span><span class="cx">     if (!livesInOtherList && indexToModify && static_cast<unsigned>(indexToRemove) == *indexToModify)
</span><span class="cx">         return false;
</span></span></pre>
</div>
</div>

</body>
</html>