haikuwebkit/LayoutTests/svg/animations/insert-animate-use-path-whi...

42 lines
1.4 KiB
XML
Raw Permalink Normal View History

Crash when appending an SVG <use> element dynamically which has animated SVG <path> element https://bugs.webkit.org/show_bug.cgi?id=146690 <rdar://problem/20790376> Patch by Said Abou-Hallawa <sabouhallawa@apple.com> on 2015-07-08 Reviewed by Dean Jackson. Source/WebCore: Test: svg/animations/insert-animate-use-path-while-animation.svg The crashing call stack shows that SVGAnimatedListPropertyTearOff<SVGPathSegList>::m_animVal is null when trying to access it in synchronizeWrappersIfNeeded(). This happens because animationStarted() was not called for this animatedType. SVGAnimateElementBase::resetAnimatedType() calls SVGAnimatedPathAnimator::startAnimValAnimation() at the beginning of the animation. For the target element and all its instances, this function calls SVGAnimatedPathSegListPropertyTearOff::animationStarted() which calls SVGAnimatedListPropertyTearOff<SVGPathSegList>::animationStarted(). This last function allocates the member m_animVal when calling SVGAnimatedListPropertyTearOff<SVGPathSegList>::animVal(). When adding a new instance of the same animating target element, SVGAnimateElementBase::resetAnimatedType() just keeps calling SVGAnimatedPathAnimator::animValDidChange() for all the instances of the targetElement without ensuring that all of them have started their animations. The fix is to make SVGAnimatedPathAnimator::resetAnimValToBaseVal() ensure that animationStarted() is called for the targetElement and all its instances. * svg/SVGAnimatedPath.cpp: (WebCore::SVGAnimatedPathAnimator::startAnimValAnimation): Move resetting the animation value and starting the animatedTypes code to a new overriding function which is named resetAnimValToBaseVal(). (WebCore::SVGAnimatedPathAnimator::resetAnimValToBaseVal): Call the overriding function which calls buildSVGPathByteStreamFromSVGPathSegList() as before and ensure that all the animatedTypes have started their animations. * svg/SVGAnimatedPath.h: LayoutTests: When adding dynamically a new <use> element which references an animated SVG path after the animation starts, ensure that WebKit is not crashing. * svg/animations/insert-animate-use-path-while-animation-expected.txt: Added. * svg/animations/insert-animate-use-path-while-animation.svg: Added. Canonical link: https://commits.webkit.org/164832@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@186541 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2015-07-08 23:56:58 +00:00
<svg width="600" height="400" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
<path id="animatedRect" fill="green">
<animate
attributeType="XML"
attributeName="d"
from="M20 60 L20 110 L120 110 L120 60 Z"
to="M45 35 L45 135 L95 135 L95 35 Z"
dur="1s"
repeatCount="indefinite"/>
</path>
<script><![CDATA[
if (window.testRunner) {
testRunner.dumpAsText();
testRunner.waitUntilDone();
}
// Wait until the only instance of 'animatedRect' starts animation.
setTimeout(function () {
var svgns = 'http://www.w3.org/2000/svg';
var xlinkns = 'http://www.w3.org/1999/xlink';
for (var i = 1; i <= 4; i++) {
var shape = document.createElementNS(svgns, "use");
shape.setAttributeNS(xlinkns, 'href', '#animatedRect');
shape.setAttributeNS(null, 'transform', 'translate(' + 100 * i + ', 0)');
document.documentElement.appendChild(shape);
}
if (window.testRunner) {
// Wait until the next animation cycle starts to make sure
// all of the instances of 'animatedRect' are animating.
setTimeout(function () {
var text = document.createElementNS(svgns, "text");
text.appendChild(document.createTextNode("Passed"));
document.documentElement.appendChild(text);
testRunner.notifyDone();
}, 50);
}
}, 50);
]]></script>
</svg>