2010-12-29 Justin Schuh <jschuh@chromium.org>

        Reviewed by Darin Adler.

        Check SVG element type in FrameView::scrollToAnchor
        https://bugs.webkit.org/show_bug.cgi?id=51718

        Test: svg/custom/scroll-to-anchor-in-symbol.svg

        * page/FrameView.cpp:
        (WebCore::FrameView::scrollToAnchor):
2010-12-29  Justin Schuh  <jschuh@chromium.org>

        Reviewed by Darin Adler.

        Check SVG element type in FrameView::scrollToAnchor
        https://bugs.webkit.org/show_bug.cgi?id=51718

        * svg/custom/scroll-to-anchor-in-symbol-expected.txt: Added.
        * svg/custom/scroll-to-anchor-in-symbol.svg: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@74779 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index 54735d7..8bdcace 100644 (file)
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,13 @@
+2010-12-29  Justin Schuh  <jschuh@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Check SVG element type in FrameView::scrollToAnchor
+        https://bugs.webkit.org/show_bug.cgi?id=51718
+
+        * svg/custom/scroll-to-anchor-in-symbol-expected.txt: Added.
+        * svg/custom/scroll-to-anchor-in-symbol.svg: Added.
+
 2010-12-29  Zhenyao Mo  <zmo@google.com>
 
         Reviewed by Eric Seidel.

diff --git a/LayoutTests/svg/custom/scroll-to-anchor-in-symbol-expected.txt b/LayoutTests/svg/custom/scroll-to-anchor-in-symbol-expected.txt
new file mode 100644 (file)
index 0000000..6eb1bbf
--- /dev/null
+++ b/LayoutTests/svg/custom/scroll-to-anchor-in-symbol-expected.txt
@@ -0,0 +1 @@
+PASS: Navigating to symbol did not crash.

diff --git a/LayoutTests/svg/custom/scroll-to-anchor-in-symbol.svg b/LayoutTests/svg/custom/scroll-to-anchor-in-symbol.svg
new file mode 100644 (file)
index 0000000..8adf766
--- /dev/null
+++ b/LayoutTests/svg/custom/scroll-to-anchor-in-symbol.svg
@@ -0,0 +1,18 @@
+<svg xmlns="http://www.w3.org/2000/svg"> \r
+    <script>\r
+    if (window.layoutTestController) {\r
+        layoutTestController.dumpAsText();\r
+        layoutTestController.waitUntilDone();\r
+    }\r
+    window.onload = function () {\r
+        location.hash = 'v1';\r
+        setTimeout(function(){\r
+            document.getElementById("t1").appendChild(document.createTextNode("PASS: Navigating to symbol did not crash."));\r
+            if (window.layoutTestController)\r
+                layoutTestController.notifyDone();\r
+        }, 0);\r
+    }\r
+    </script>\r
+    <symbol><view id="v1"/></symbol>\r
+    <text x="20" y="20" fill="green" id="t1"></text>\r
+</svg>\r

diff --git a/WebCore/ChangeLog b/WebCore/ChangeLog
index ae6f753..4842aec 100644 (file)
--- a/WebCore/ChangeLog
+++ b/WebCore/ChangeLog
@@ -1,3 +1,15 @@
+2010-12-29  Justin Schuh  <jschuh@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Check SVG element type in FrameView::scrollToAnchor
+        https://bugs.webkit.org/show_bug.cgi?id=51718
+
+        Test: svg/custom/scroll-to-anchor-in-symbol.svg
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::scrollToAnchor):
+
 2010-12-29  Anton Muhin  <antonm@chromium.org>
 
         Reviewed by Eric Seidel.

diff --git a/WebCore/page/FrameView.cpp b/WebCore/page/FrameView.cpp
index f2e6e1f..850e1bb 100644 (file)
--- a/WebCore/page/FrameView.cpp
+++ b/WebCore/page/FrameView.cpp
@@ -1219,8 +1219,11 @@ bool FrameView::scrollToAnchor(const String& name)
             if (anchorNode && anchorNode->hasTagName(SVGNames::viewTag)) {
                 RefPtr<SVGViewElement> viewElement = anchorNode->hasTagName(SVGNames::viewTag) ? static_cast<SVGViewElement*>(anchorNode) : 0;
                 if (viewElement.get()) {
-                    RefPtr<SVGSVGElement> svg = static_cast<SVGSVGElement*>(SVGLocatable::nearestViewportElement(viewElement.get()));
-                    svg->inheritViewAttributes(viewElement.get());
+                    SVGElement* element = SVGLocatable::nearestViewportElement(viewElement.get());
+                    if (element->hasTagName(SVGNames::svgTag)) {
+                        RefPtr<SVGSVGElement> svg = static_cast<SVGSVGElement*>(element);
+                        svg->inheritViewAttributes(viewElement.get());
+                    }
                 }
             }
         }