haikuwebkit/LayoutTests/svg/foreignObject/text-tref-02-b.svg

80 lines
3.6 KiB
XML
Raw Permalink Normal View History

2010-06-23 Nikolas Zimmermann <nzimmermann@rim.com> Reviewed by Eric Seidel. Reproducible crash in com.apple.WebCore 0x01ed3784 WebCore::RenderLineBoxList::appendLineBox(WebCore::InlineFlowBox*) + 36 https://bugs.webkit.org/show_bug.cgi?id=40953 REGRESSION (r58209-58231): Memory corruption with invalid SVG https://bugs.webkit.org/show_bug.cgi?id=40173 Fix several crashes, all related to <foreignObject> and/or invalid SVG documents. - Only allow <svg> nodes, as direct children of a <foreignObject>, not any other "partial" SVG content. - Assure to create RenderSVGRoot objects for <svg> nodes in <foreignObject>, treat them as "outermost SVG elements". - Never allow any partial SVG content to appear in any document. Only <svg> elements are allowed. Tests: svg/custom/bug45331.svg svg/foreignObject/disallowed-svg-nodes-as-direct-children.svg svg/foreignObject/no-crash-with-svg-content-in-html-document.svg svg/foreignObject/svg-document-as-direct-child.svg svg/foreignObject/svg-document-in-html-document.svg svg/foreignObject/text-tref-02-b.svg * dom/Element.cpp: Added childShouldCreateRenderer, with ENABLE(SVG) guards. (WebCore::Element::childShouldCreateRenderer): Only create a renderer for a SVG child, if we're a SVG element, or if the child is a <svg> element. * dom/Element.h: Added childShouldCreateRenderer, with ENABLE(SVG) guards. * svg/SVGForeignObjectElement.cpp: (WebCore::SVGForeignObjectElement::childShouldCreateRenderer): Disallow arbitary SVG content, only <svg> elements are allowed as direct children of a <foreignObject> * svg/SVGSVGElement.cpp: (WebCore::SVGSVGElement::isOutermostSVG): Be sure to create RenderSVGRoot objects for <svg> elements inside <foreignObject> 2010-06-23 Nikolas Zimmermann <nzimmermann@rim.com> Reviewed by Eric Seidel. Reproducible crash in com.apple.WebCore 0x01ed3784 WebCore::RenderLineBoxList::appendLineBox(WebCore::InlineFlowBox*) + 36 https://bugs.webkit.org/show_bug.cgi?id=40953 REGRESSION (r58209-58231): Memory corruption with invalid SVG https://bugs.webkit.org/show_bug.cgi?id=40173 Added several new layout tests covering the crashes with <foreignObject> and/or invalid SVG documents. * platform/mac/svg/custom/bug45331-expected.checksum: Added. * platform/mac/svg/custom/bug45331-expected.png: Added. * platform/mac/svg/custom/bug45331-expected.txt: Added. * platform/mac/svg/foreignObject: Added. * platform/mac/svg/foreignObject/disallowed-svg-nodes-as-direct-children-expected.checksum: Added. * platform/mac/svg/foreignObject/disallowed-svg-nodes-as-direct-children-expected.png: Added. * platform/mac/svg/foreignObject/disallowed-svg-nodes-as-direct-children-expected.txt: Added. * platform/mac/svg/foreignObject/no-crash-with-svg-content-in-html-document-expected.checksum: Added. * platform/mac/svg/foreignObject/no-crash-with-svg-content-in-html-document-expected.png: Added. * platform/mac/svg/foreignObject/no-crash-with-svg-content-in-html-document-expected.txt: Added. * platform/mac/svg/foreignObject/svg-document-as-direct-child-expected.checksum: Added. * platform/mac/svg/foreignObject/svg-document-as-direct-child-expected.png: Added. * platform/mac/svg/foreignObject/svg-document-as-direct-child-expected.txt: Added. * platform/mac/svg/foreignObject/svg-document-in-html-document-expected.checksum: Added. * platform/mac/svg/foreignObject/svg-document-in-html-document-expected.png: Added. * platform/mac/svg/foreignObject/svg-document-in-html-document-expected.txt: Added. * platform/mac/svg/foreignObject/text-tref-02-b-expected.checksum: Added. * platform/mac/svg/foreignObject/text-tref-02-b-expected.png: Added. * platform/mac/svg/foreignObject/text-tref-02-b-expected.txt: Added. * svg/custom/bug45331.svg: Added. * svg/foreignObject: Added. * svg/foreignObject/disallowed-svg-nodes-as-direct-children.svg: Added. * svg/foreignObject/no-crash-with-svg-content-in-html-document.svg: Added. * svg/foreignObject/svg-document-as-direct-child.svg: Added. * svg/foreignObject/svg-document-in-html-document.svg: Added. * svg/foreignObject/text-tref-02-b.svg: Added. Canonical link: https://commits.webkit.org/52674@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@61667 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2010-06-23 07:11:19 +00:00
<!DOCTYPE svg [
<!ATTLIST bar id ID #REQUIRED>
]>
<svg version="1.1" baseProfile="basic" id="svg-root"
width="100%" height="100%" viewBox="0 0 480 360"
xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
<!--======================================================================-->
<!--= SVG 1.1 2nd Edition Test Case =-->
<!--======================================================================-->
<!--= Copyright 2009 World Wide Web Consortium, (Massachusetts =-->
<!--= Institute of Technology, European Research Consortium for =-->
<!--= Informatics and Mathematics (ERCIM), Keio University). =-->
<!--= All Rights Reserved. =-->
<!--= See http://www.w3.org/Consortium/Legal/. =-->
<!--======================================================================-->
<d:SVGTestCase xmlns:d="http://www.w3.org/2000/02/svg/testsuite/description/"
template-version="1.4" reviewer="ED" author="CL" status="accepted"
version="$Revision: 1.5 $" testname="$RCSfile: text-tref-02-b.svg,v $">
<d:testDescription xmlns="http://www.w3.org/1999/xhtml" href="http://www.w3.org/TR/SVG11/text.html#TRefElement">
<p>
Test viewer capability to handle 'tref' elements
which point to text strings outside the current SVG document fragment.
</p>
<p>
The test case consists of two sub-tests; one results in the word "Hello" and the second, the word "World".
</p>
</d:testDescription>
<d:operatorScript xmlns="http://www.w3.org/1999/xhtml">
<p>
Run the test. No interaction required.
</p>
</d:operatorScript>
<d:passCriteria xmlns="http://www.w3.org/1999/xhtml">
<p>
The test is passed if the phrase "Hello World" is displayed, in green.
</p>
</d:passCriteria>
</d:SVGTestCase>
<title id="test-title">$RCSfile: text-tref-02-b.svg,v $</title>
<defs>
<font-face font-family="SVGFreeSansASCII" unicode-range="U+0-7F">
<font-face-src>
2011-02-10 Nikolas Zimmermann <nzimmermann@rim.com> Reviewed by Maciej Stachowiak. LayoutTests/svg cleanup https://bugs.webkit.org/show_bug.cgi?id=54184 Fix wrong xlink:hrefs in dozens of SVG testcases. SVGFreeSans.svg is now used in more places. Remove unnecessary xml-stylesheet declarations, and unneeded text css attributes in some places. Updated pixel test results for the affected testcases. * platform/mac-snowleopard/svg/W3C-SVG-1.1-SE/types-dom-01-b-expected.txt: * platform/mac/svg/W3C-SVG-1.1-SE/coords-dom-01-f-expected.checksum: * platform/mac/svg/W3C-SVG-1.1-SE/coords-dom-01-f-expected.png: * platform/mac/svg/W3C-SVG-1.1-SE/coords-dom-01-f-expected.txt: * platform/mac/svg/W3C-SVG-1.1-SE/coords-dom-02-f-expected.checksum: * platform/mac/svg/W3C-SVG-1.1-SE/coords-dom-02-f-expected.png: * platform/mac/svg/W3C-SVG-1.1-SE/coords-dom-02-f-expected.txt: * platform/mac/svg/W3C-SVG-1.1-SE/coords-dom-03-f-expected.checksum: * platform/mac/svg/W3C-SVG-1.1-SE/coords-dom-03-f-expected.png: * platform/mac/svg/W3C-SVG-1.1-SE/coords-dom-03-f-expected.txt: * platform/mac/svg/W3C-SVG-1.1-SE/coords-dom-04-f-expected.checksum: * platform/mac/svg/W3C-SVG-1.1-SE/coords-dom-04-f-expected.png: * platform/mac/svg/W3C-SVG-1.1-SE/coords-dom-04-f-expected.txt: * platform/mac/svg/W3C-SVG-1.1-SE/paths-dom-02-f-expected.checksum: * platform/mac/svg/W3C-SVG-1.1-SE/paths-dom-02-f-expected.png: * platform/mac/svg/W3C-SVG-1.1-SE/paths-dom-02-f-expected.txt: * platform/mac/svg/W3C-SVG-1.1-SE/pservers-pattern-04-f-expected.checksum: * platform/mac/svg/W3C-SVG-1.1-SE/pservers-pattern-04-f-expected.png: * platform/mac/svg/W3C-SVG-1.1-SE/pservers-pattern-04-f-expected.txt: * platform/mac/svg/W3C-SVG-1.1-SE/types-dom-01-b-expected.checksum: * platform/mac/svg/W3C-SVG-1.1-SE/types-dom-01-b-expected.png: * platform/mac/svg/W3C-SVG-1.1-SE/types-dom-02-f-expected.checksum: * platform/mac/svg/W3C-SVG-1.1-SE/types-dom-02-f-expected.png: * platform/mac/svg/W3C-SVG-1.1-SE/types-dom-02-f-expected.txt: * platform/mac/svg/W3C-SVG-1.1-SE/types-dom-03-b-expected.checksum: * platform/mac/svg/W3C-SVG-1.1-SE/types-dom-03-b-expected.png: * platform/mac/svg/W3C-SVG-1.1-SE/types-dom-03-b-expected.txt: * platform/mac/svg/W3C-SVG-1.1-SE/types-dom-04-b-expected.checksum: * platform/mac/svg/W3C-SVG-1.1-SE/types-dom-04-b-expected.png: * platform/mac/svg/W3C-SVG-1.1-SE/types-dom-04-b-expected.txt: * platform/mac/svg/W3C-SVG-1.1-SE/types-dom-05-b-expected.checksum: * platform/mac/svg/W3C-SVG-1.1-SE/types-dom-05-b-expected.png: * platform/mac/svg/W3C-SVG-1.1-SE/types-dom-05-b-expected.txt: * platform/mac/svg/W3C-SVG-1.1-SE/types-dom-06-f-expected.checksum: * platform/mac/svg/W3C-SVG-1.1-SE/types-dom-06-f-expected.png: * platform/mac/svg/W3C-SVG-1.1-SE/types-dom-06-f-expected.txt: * platform/mac/svg/W3C-SVG-1.1-SE/types-dom-07-f-expected.checksum: * platform/mac/svg/W3C-SVG-1.1-SE/types-dom-07-f-expected.png: * platform/mac/svg/W3C-SVG-1.1-SE/types-dom-07-f-expected.txt: * platform/mac/svg/W3C-SVG-1.1/filters-light-04-f-expected.checksum: * platform/mac/svg/W3C-SVG-1.1/filters-light-04-f-expected.png: * platform/mac/svg/W3C-SVG-1.1/filters-light-04-f-expected.txt: * platform/mac/svg/W3C-SVG-1.1/filters-turb-02-f-expected.checksum: * platform/mac/svg/W3C-SVG-1.1/filters-turb-02-f-expected.png: * platform/mac/svg/W3C-SVG-1.1/filters-turb-02-f-expected.txt: * platform/mac/svg/batik/filters/feTile-expected.checksum: * platform/mac/svg/batik/filters/feTile-expected.png: * platform/mac/svg/batik/filters/feTile-expected.txt: * platform/mac/svg/css/circle-in-mask-with-shadow-expected.checksum: * platform/mac/svg/css/circle-in-mask-with-shadow-expected.png: * platform/mac/svg/css/mask-with-shadow-expected.checksum: * platform/mac/svg/css/mask-with-shadow-expected.png: * platform/mac/svg/foreignObject/text-tref-02-b-expected.checksum: * platform/mac/svg/foreignObject/text-tref-02-b-expected.png: * platform/mac/svg/foreignObject/text-tref-02-b-expected.txt: * platform/mac/svg/text/text-tref-01-b-expected.checksum: * platform/mac/svg/text/text-tref-01-b-expected.png: * platform/mac/svg/transforms/animated-path-inside-transformed-html-expected.checksum: * platform/mac/svg/transforms/animated-path-inside-transformed-html-expected.png: * platform/mac/svg/zoom/page/zoom-mask-with-percentages-expected.checksum: * platform/mac/svg/zoom/page/zoom-mask-with-percentages-expected.png: * platform/mac/svg/zoom/page/zoom-mask-with-percentages-expected.txt: * svg/W3C-SVG-1.1-SE/coords-dom-01-f.svg: * svg/W3C-SVG-1.1-SE/coords-dom-02-f.svg: * svg/W3C-SVG-1.1-SE/coords-dom-03-f.svg: * svg/W3C-SVG-1.1-SE/coords-dom-04-f.svg: * svg/W3C-SVG-1.1-SE/paths-dom-02-f.svg: * svg/W3C-SVG-1.1-SE/pservers-pattern-04-f.svg: * svg/W3C-SVG-1.1-SE/types-dom-01-b.svg: * svg/W3C-SVG-1.1-SE/types-dom-02-f.svg: * svg/W3C-SVG-1.1-SE/types-dom-03-b.svg: * svg/W3C-SVG-1.1-SE/types-dom-04-b.svg: * svg/W3C-SVG-1.1-SE/types-dom-05-b.svg: * svg/W3C-SVG-1.1-SE/types-dom-06-f.svg: * svg/W3C-SVG-1.1-SE/types-dom-07-f.svg: * svg/W3C-SVG-1.1/filters-light-04-f.svg: * svg/W3C-SVG-1.1/filters-turb-02-f.svg: * svg/W3C-SVG-1.1/resources/interact-order-02-b-targ.svg: * svg/W3C-SVG-1.1/resources/interact-order-03-b-targ.svg: * svg/W3C-SVG-1.1/resources/linkingToc-t.svg: * svg/batik/filters/feTile.svg: * svg/css/circle-in-mask-with-shadow.svg: * svg/css/mask-with-shadow.svg: * svg/custom/image-clipped-hit.svg: * svg/foreignObject/text-tref-02-b.svg: * svg/hixie/cascade/002.css: Removed. * svg/text/text-tref-01-b.svg: * svg/transforms/animated-path-inside-transformed-html.xhtml: * svg/zoom/page/zoom-mask-with-percentages.svg: * svg/zoom/page/zoom-zoom-coords.xhtml: Canonical link: https://commits.webkit.org/68200@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@78182 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2011-02-10 10:25:55 +00:00
<font-face-uri xlink:href="../custom/resources/SVGFreeSans.svg#ascii"/>
2010-06-23 Nikolas Zimmermann <nzimmermann@rim.com> Reviewed by Eric Seidel. Reproducible crash in com.apple.WebCore 0x01ed3784 WebCore::RenderLineBoxList::appendLineBox(WebCore::InlineFlowBox*) + 36 https://bugs.webkit.org/show_bug.cgi?id=40953 REGRESSION (r58209-58231): Memory corruption with invalid SVG https://bugs.webkit.org/show_bug.cgi?id=40173 Fix several crashes, all related to <foreignObject> and/or invalid SVG documents. - Only allow <svg> nodes, as direct children of a <foreignObject>, not any other "partial" SVG content. - Assure to create RenderSVGRoot objects for <svg> nodes in <foreignObject>, treat them as "outermost SVG elements". - Never allow any partial SVG content to appear in any document. Only <svg> elements are allowed. Tests: svg/custom/bug45331.svg svg/foreignObject/disallowed-svg-nodes-as-direct-children.svg svg/foreignObject/no-crash-with-svg-content-in-html-document.svg svg/foreignObject/svg-document-as-direct-child.svg svg/foreignObject/svg-document-in-html-document.svg svg/foreignObject/text-tref-02-b.svg * dom/Element.cpp: Added childShouldCreateRenderer, with ENABLE(SVG) guards. (WebCore::Element::childShouldCreateRenderer): Only create a renderer for a SVG child, if we're a SVG element, or if the child is a <svg> element. * dom/Element.h: Added childShouldCreateRenderer, with ENABLE(SVG) guards. * svg/SVGForeignObjectElement.cpp: (WebCore::SVGForeignObjectElement::childShouldCreateRenderer): Disallow arbitary SVG content, only <svg> elements are allowed as direct children of a <foreignObject> * svg/SVGSVGElement.cpp: (WebCore::SVGSVGElement::isOutermostSVG): Be sure to create RenderSVGRoot objects for <svg> elements inside <foreignObject> 2010-06-23 Nikolas Zimmermann <nzimmermann@rim.com> Reviewed by Eric Seidel. Reproducible crash in com.apple.WebCore 0x01ed3784 WebCore::RenderLineBoxList::appendLineBox(WebCore::InlineFlowBox*) + 36 https://bugs.webkit.org/show_bug.cgi?id=40953 REGRESSION (r58209-58231): Memory corruption with invalid SVG https://bugs.webkit.org/show_bug.cgi?id=40173 Added several new layout tests covering the crashes with <foreignObject> and/or invalid SVG documents. * platform/mac/svg/custom/bug45331-expected.checksum: Added. * platform/mac/svg/custom/bug45331-expected.png: Added. * platform/mac/svg/custom/bug45331-expected.txt: Added. * platform/mac/svg/foreignObject: Added. * platform/mac/svg/foreignObject/disallowed-svg-nodes-as-direct-children-expected.checksum: Added. * platform/mac/svg/foreignObject/disallowed-svg-nodes-as-direct-children-expected.png: Added. * platform/mac/svg/foreignObject/disallowed-svg-nodes-as-direct-children-expected.txt: Added. * platform/mac/svg/foreignObject/no-crash-with-svg-content-in-html-document-expected.checksum: Added. * platform/mac/svg/foreignObject/no-crash-with-svg-content-in-html-document-expected.png: Added. * platform/mac/svg/foreignObject/no-crash-with-svg-content-in-html-document-expected.txt: Added. * platform/mac/svg/foreignObject/svg-document-as-direct-child-expected.checksum: Added. * platform/mac/svg/foreignObject/svg-document-as-direct-child-expected.png: Added. * platform/mac/svg/foreignObject/svg-document-as-direct-child-expected.txt: Added. * platform/mac/svg/foreignObject/svg-document-in-html-document-expected.checksum: Added. * platform/mac/svg/foreignObject/svg-document-in-html-document-expected.png: Added. * platform/mac/svg/foreignObject/svg-document-in-html-document-expected.txt: Added. * platform/mac/svg/foreignObject/text-tref-02-b-expected.checksum: Added. * platform/mac/svg/foreignObject/text-tref-02-b-expected.png: Added. * platform/mac/svg/foreignObject/text-tref-02-b-expected.txt: Added. * svg/custom/bug45331.svg: Added. * svg/foreignObject: Added. * svg/foreignObject/disallowed-svg-nodes-as-direct-children.svg: Added. * svg/foreignObject/no-crash-with-svg-content-in-html-document.svg: Added. * svg/foreignObject/svg-document-as-direct-child.svg: Added. * svg/foreignObject/svg-document-in-html-document.svg: Added. * svg/foreignObject/text-tref-02-b.svg: Added. Canonical link: https://commits.webkit.org/52674@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@61667 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2010-06-23 07:11:19 +00:00
</font-face-src>
</font-face>
</defs>
<g id="test-body-content" font-family="SVGFreeSansASCII,sans-serif" font-size="18">
<!-- Test case label -->
<text x="75" y="25" font-family="SVGFreeSansASCII,sans-serif" font-size="12" fill="blue">Test 'tref' element pointing outside the SVG document fragment.</text>
<text x="75" y="200" font-size="36" font-family="SVGFreeSansASCII,sans-serif" fill="green">
<tref xlink:href="#hello"/>
<tref xlink:href="#world"/>
</text>
<!-- now make a new SVG document fragment, and hide it from being rendered -->
<defs>
<foreignObject>
<svg>
<text id="hello">Hello</text>
</svg>
</foreignObject>
</defs>
<!-- and another way to make a separate document fragment -->
<foo xmlns="http://example.org/foo">
<bar id="world">World</bar>
</foo>
</g>
<g font-family="SVGFreeSansASCII,sans-serif" font-size="32">
<text id="revision" x="10" y="340" stroke="none" fill="black">$Revision: 1.5 $</text>
</g>
<rect id="test-frame" x="1" y="1" width="478" height="358" fill="none" stroke="#000000"/>
<!-- comment out this watermark once the test is approved -->
<!--<g id="draft-watermark">
<rect x="1" y="1" width="478" height="20" fill="red" stroke="black" stroke-width="1"/>
<text font-family="SVGFreeSansASCII,sans-serif" font-weight="bold" font-size="20" x="240"
text-anchor="middle" y="18" stroke-width="0.5" stroke="black" fill="white">DRAFT</text>
</g>-->
</svg>