[Webkit-unassigned] [Bug 51061] REGRESSION (64275): Shape pattern-image fill turns black

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=51061





--- Comment #15 from Tim Horton <timothy_horton at apple.com>  2011-09-13 11:16:17 PST ---
(In reply to comment #14)
> (From update of attachment 107192 [details])
> View in context: https://bugs.webkit.org/attachment.cgi?id=107192&action=review
> 
> > Source/WebCore/rendering/svg/SVGResourcesCache.cpp:170
> > +        SVGStyledElement* clientElement = static_cast<SVGStyledElement*>(it->first->node());
> 
> How do you know that the first node is a SVGStyledElement? Is that always true?

The only way something can get into the cache which we're iterating through here is through the clientUpdateFromElement ---> addResourcesForRenderObject path. There are a few calls to clientUpdateFromElement:

* in RenderSVGBlock, which adds itself (so that's safe)
* in RenderSVGInline, which adds itself (so that's safe)
* in RenderSVGModelObject, which adds itself (so that's safe)
* in RenderSVGResourceContainer, which is adding from a HashSet of SVGStyledElements (so that's safe)
* in RenderSVGRoot, which adds itself (so that's safe)
* in SVGResourcesCache, via clientStyleChanged, which is called:
     * from RenderSVGBlock, which adds itself
     * from RenderSVGInline, which adds itself
     * from RenderSVGModelObject, which adds itself
     * from RenderSVGRoot, which adds itself
     * from SVGInlineTextBox, which adds its parent

So, I'm *pretty* sure it has to be an SVGStyledElement. Should I use a different cast/check the type/add an ASSERT()?

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.