haikuwebkit/LayoutTests/svg/custom/path-domsubtreemodified-cra...

36 lines
1023 B
HTML
Raw Permalink Normal View History

Do not dispatch modification events in SVG attribute synchronization https://bugs.webkit.org/show_bug.cgi?id=92604 Reviewed by Ryosuke Niwa. Source/WebCore: Previously, calling hasAttribute() during layout could hit a layout-during-layout bug because calling hasAttribute() could dispatch a subtree modification event which could synchronously force a layout. hasAttribute() exhibits this behavior because property synchronization is done lazily. This patch skips dispatching subtree modification events during attribute synchronization. Additionally, this patch contains a refactoring of lazy attribute setting. We now have a single place where lazy attributes are set (setSynchronizedLazyAttribute) and lazy attribute flags have been moved to just Element and ElementAttributeData. Test: svg/custom/path-domsubtreemodified-crash.html * dom/Element.cpp: (WebCore::Element::setAttribute): (WebCore::Element::setSynchronizedLazyAttribute): (WebCore): (WebCore::Element::setAttributeInternal): * dom/Element.h: (Element): * dom/ElementAttributeData.cpp: (WebCore::ElementAttributeData::addAttribute): (WebCore::ElementAttributeData::removeAttribute): * dom/ElementAttributeData.h: (ElementAttributeData): * dom/StyledElement.cpp: (WebCore::StyledElement::updateStyleAttribute): * svg/properties/SVGAnimatedPropertyMacros.h: (WebCore::SVGSynchronizableAnimatedProperty::synchronize): LayoutTests: * svg/custom/path-domsubtreemodified-crash-expected.txt: Added. * svg/custom/path-domsubtreemodified-crash.html: Added. Canonical link: https://commits.webkit.org/110856@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@124485 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2012-08-02 19:36:04 +00:00
<!DOCTYPE HTML>
<html>
<!-- Test for WK92604 - Passes if no crash occurs and "PASS" is printed. -->
<body id="body">
<svg xmlns="http://www.w3.org/2000/svg">
<line stroke="green" vector-effect="non-scaling-stroke" y2="1"/>
<defs id="defs"></defs>
</svg>
<script>
if (window.testRunner) {
testRunner.dumpAsText();
testRunner.waitUntilDone();
}
var body = document.getElementById("body");
var defs = document.getElementById("defs");
document.addEventListener("DOMContentLoaded", doCrash, false);
body.addEventListener("DOMSubtreeModified", function() {
// Prevent infinite loop of modification events.
this.removeEventListener("DOMSubtreeModified", arguments.callee);
document.write("This test passes if no crash occurs and PASS is printed. PASS");
if (window.testRunner)
testRunner.notifyDone();
}, false);
function doCrash() {
body.offsetWidth;
body.innerHTML = "FAIL";
}
</script>
</body>
</html>