commit 0f5d54e5f9d4ae663084af561af95139a14fbec0
author commit-queue@webkit.org <commit-queue@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc> Wed Jan 05 12:11:15 2011 +0000
committer commit-queue@webkit.org <commit-queue@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc> Wed Jan 05 12:11:15 2011 +0000
tree 10f1b5a7b871531cf0ba58f4312c077aed73499c
parent 054c530c33a7cecad25daaa9991aca1987ac0f8b

2011-01-05  Leo Yang  <leo.yang@torchmobile.com.cn>

        Reviewed by Dirk Schulze.

        Malformed SVG causes crash in updateContainerOffset
        https://bugs.webkit.org/show_bug.cgi?id=44610

        Test case for recursive svg <use>.
        This test case passes if no crash occurs.

        * svg/custom/recursive-use-expected.txt: Added.
        * svg/custom/recursive-use.svg: Added.
2011-01-05  Leo Yang  <leo.yang@torchmobile.com.cn>

        Reviewed by Dirk Schulze.

        Malformed SVG causes crash in updateContainerOffset
        https://bugs.webkit.org/show_bug.cgi?id=44610

        We should check recursive <use> at the begining of
        WebCore::SVGUseElement::buildInstanceTree instead
        of at the end of it because the target element's
        children may cause infinite recursive <use>.

        Test: svg/custom/recursive-use.svg

        * svg/SVGUseElement.cpp:
        (WebCore::SVGUseElement::buildInstanceTree):
        (WebCore::SVGUseElement::hasCycleUseReferencing):
        * svg/SVGUseElement.h:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@75059 268f45cc-cd09-0410-ab3c-d52691b4dbfc