ASSERT (and crash) with dynamically moved <font-face>

https://bugs.webkit.org/show_bug.cgi?id=64839

Reviewed by Antti Koivisto.

Source/WebCore:

Reset the style declaration when rmeoving the font-face element from the document.

Test: svg/custom/font-face-move.svg

* svg/SVGFontFaceElement.cpp:
(WebCore::SVGFontFaceElement::removedFromDocument):

LayoutTests:

* svg/custom/font-face-move-expected.txt: Added.
* svg/custom/font-face-move.svg: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@108097 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index f1bceab..250e9ca 100644 (file)
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,13 @@
+2012-02-17  Rob Buis  <rbuis@rim.com>
+
+        ASSERT (and crash) with dynamically moved <font-face>
+        https://bugs.webkit.org/show_bug.cgi?id=64839
+
+        Reviewed by Antti Koivisto.
+
+        * svg/custom/font-face-move-expected.txt: Added.
+        * svg/custom/font-face-move.svg: Added.
+
 2012-02-17  Julien Chaffraix  <jchaffraix@webkit.org>
 
         Unreviewed Chromium rebaseline after r107971.

diff --git a/LayoutTests/svg/custom/font-face-move-expected.txt b/LayoutTests/svg/custom/font-face-move-expected.txt
new file mode 100644 (file)
index 0000000..7ef22e9
--- /dev/null
+++ b/LayoutTests/svg/custom/font-face-move-expected.txt
@@ -0,0 +1 @@
+PASS

diff --git a/LayoutTests/svg/custom/font-face-move.svg b/LayoutTests/svg/custom/font-face-move.svg
new file mode 100644 (file)
index 0000000..961472c
--- /dev/null
+++ b/LayoutTests/svg/custom/font-face-move.svg
@@ -0,0 +1,15 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+    <defs id="defs">
+        <font id="a">
+            <font-face id="bfont" font-family="b" />
+        </font>
+    </defs>
+    <text font-family="b">PASS</text>
+    <script>
+    if (window.layoutTestController)
+        layoutTestController.dumpAsText();
+    var defs = document.getElementById("defs");
+    var bfont = document.getElementById("bfont");
+    defs.appendChild(bfont);
+    </script>
+</svg>

diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
index 91c1164..46722cb 100644 (file)
--- a/Source/WebCore/ChangeLog
+++ b/Source/WebCore/ChangeLog
@@ -1,3 +1,17 @@
+2012-02-17  Rob Buis  <rbuis@rim.com>
+
+        ASSERT (and crash) with dynamically moved <font-face>
+        https://bugs.webkit.org/show_bug.cgi?id=64839
+
+        Reviewed by Antti Koivisto.
+
+        Reset the style declaration when rmeoving the font-face element from the document.
+
+        Test: svg/custom/font-face-move.svg
+
+        * svg/SVGFontFaceElement.cpp:
+        (WebCore::SVGFontFaceElement::removedFromDocument):
+
 2012-02-17  Martin Robinson  <mrobinson@igalia.com>
 
         Fix some warnings encountered during the GTK+ build

diff --git a/Source/WebCore/svg/SVGFontFaceElement.cpp b/Source/WebCore/svg/SVGFontFaceElement.cpp
index af78956..51cb732 100644 (file)
--- a/Source/WebCore/svg/SVGFontFaceElement.cpp
+++ b/Source/WebCore/svg/SVGFontFaceElement.cpp
@@ -329,6 +329,7 @@ void SVGFontFaceElement::removedFromDocument()
 {
     removeFromMappedElementSheet();
     SVGElement::removedFromDocument();
+    m_fontFaceRule->declaration()->parseDeclaration(emptyString());
 }
 
 void SVGFontFaceElement::childrenChanged(bool changedByParser, Node* beforeChange, Node* afterChange, int childCountDelta)