[Webkit-unassigned] [Bug 17736] New: JS (SVG) POD Type bindings bug

[bugzilla-daemon at webkit.org]

http://bugs.webkit.org/show_bug.cgi?id=17736

           Summary: JS (SVG) POD Type bindings bug
           Product: WebKit
           Version: 525+ (Nightly build)
          Platform: Macintosh
        OS/Version: Mac OS X 10.5
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: SVG
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: zimmermann at kde.org
                CC: eric at webkit.org, sam at webkit.org, oliver at apple.com


As the summary says I found a pretty harsh JS POD type bindings bug, while
writing tests for SVGLinearGradientElement & updating of the gradientTransform
attribute.

Try in trunk:
var transform = mySVGSVGElement.createSVGTransform();
alert(transform.matrix.a); returns '1.0' as expected
transform.matrix.a = 2;
alert(transform.matrix.a); returns '1.0' :(

Another way to trigger the bug without having to create a new SVGTransform
object:
myLinearGradientElement.gradientTransform.baseVal.getItem(0).matrix.a = 2;
alert(myLinearGradientElement.gradientTransform.baseVal.getItem(0).matrix.a);
returns '1.0'

The problem is that we forgot to handle the case where a JSSVGPODTypeWrapper is
able to create JSSVGPODTypeWrappers itself. In our case 'SVGTransform' contains
'readonly attribute SVGMatrix matrix;". As SVGTransform & SVGMatrix are both
POD types our updating logic fails. It only works for SVG elements containing
POD types (ie. a SVGRectElement contains a SVG(Animated)Length POD type => when
modifying the POD Type the SVGRectElement gets updated correctly.)

Not yet sure about possible solutions, still investigating.


-- 
Configure bugmail: http://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.