| Commit message (Collapse) | Author | Age | Files | Lines |
|
|
|
|
| |
Change-Id: Ifc00865ceeb5b83b7990f91af7dbbd1a05df1c30
Reviewed-by: Konstantin Tokarev <annulen@yandex.ru>
|
|
|
|
|
| |
Change-Id: I3f9320f43d5d1fc5169a6c1b9dcea454974d6578
Reviewed-by: Konstantin Tokarev <annulen@yandex.ru>
|
|
|
|
|
| |
Change-Id: I8dda875c38075d43b76fe3a21acb0ffa102bb82d
Reviewed-by: Konstantin Tokarev <annulen@yandex.ru>
|
|
|
|
|
| |
Change-Id: I3b1d8a2808782c9f34d50240000e20cb38d3680f
Reviewed-by: Konstantin Tokarev <annulen@yandex.ru>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
garbage collection happens quickly.
Based on upstream fix by said@apple.com at http://trac.webkit.org/changeset/197125
Since the whole document was leaking once an SVGAnimatedProperty was created
so there was no way to produce this bug. After fixing the leak, one crash
and one assert got uncovered. Both of them happen because of the fact:
"if an SVGAnimatedProperty is not referenced it will be deleted."
* svg/SVGPathElement.cpp:
(WebCore::SVGPathElement::lookupOrCreateDWrapper):
The code in this function was assuming that the wrapper will be created
only once which happens when SVGAnimatedProperty::lookupOrCreateWrapper()
is called. Before making this single call, lookupOrCreateDWrapper() was
building an initial SVGPathSegList from byte stream. But now
SVGAnimatedProperty::lookupWrapper() can return false even after creating
the SVGAnimatedProperty because it was deleted later. Calling
buildSVGPathSegListFromByteStream() more than once was causing
SVGAnimatedListPropertyTearOff::animationStarted() to fire the assertion
ASSERT(m_values.size() == m_wrappers.size()) because the path segments were
appended twice to m_values which is in fact SVGPathElement::m_pathSegList.value.
The fix is to build the initial SVGPathSegList only once which should happen
when m_pathSegList.value.isEmpty().
(WebCore::SVGPathElement::animatedPropertyWillBeDeleted):
* svg/SVGPathElement.h:
* svg/properties/SVGAnimatedPathSegListPropertyTearOff.h:
(WebCore::SVGAnimatedPathSegListPropertyTearOff::~SVGAnimatedPathSegListPropertyTearOff):
SVGPathElement is assuming the following equivalence relation:
m_pathSegList.shouldSynchronize ~ SVGAnimatedProperty_is_created_and_not_null.
SVGPathElement::animatedPathSegList() and animatedNormalizedPathSegList()
set m_pathSegList.shouldSynchronize to true when SVGAnimatedProperty is
created but nothing sets m_pathSegList.shouldSynchronize back to false.
This was not a problem when the SVGAnimatedProperty was leaking but after
ensuring it is deleted when it is not referenced this equivalence relation
becomes untrue sometimes. This caused SVGPathElement::svgAttributeChanged()
to crash when we check m_pathSegList.shouldSynchronize and if it is true we
assume that SVGAnimatedProperty::lookupWrapper() will return a non-null pointer
and therefore we deference this pointer and call SVGAnimatedProperty::isAnimating().
To fix this crash we need to set m_pathSegList.shouldSynchronize back to false
when the associated SVGAnimatedProperty is deleted.
Change-Id: I05be755635b02d0d76105fc2eb21c2f013298c4e
Reviewed-by: Michael Brüning <michael.bruning@theqtcompany.com>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Based on upstream fix by said@apple.com at http://trac.webkit.org/changeset/196670
A destructor was added to SVGListPropertyTearOff that notifies its
wrapper (the SVGAnimatedListPropertyTearoff) about its deletion. This
allows the wrapper to nullify any references to the wrapped content.
We needed to do the same thing for SVGPathSegListPropertyTearOff. Both
SVGPathSegListPropertyTearOff and SVGListPropertyTearOff inherit from
SVGListProperty and both hold pointers to SVGAnimatedListPropertyTearOff
which needs to be notified.
Change-Id: I1873825c7bdc07bf06cd5c300156ebe084f2607e
Reviewed-by: Konstantin Tokarev <annulen@yandex.ru>
Reviewed-by: Michael Brüning <michael.bruning@theqtcompany.com>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Based on upstream fix by sabouhallawa@apple.com at http://trac.webkit.org/changeset/196268
The leak happens because of cyclic reference between SVGListPropertyTearOff
and SVGAnimatedListPropertyTearOff which is derived from SVGAnimatedProperty.
There is also cyclic reference between SVGAnimatedProperty and SVGElement and
this causes the whole document to be leaked. So if the JS requests, for
example, an instance of SVGPolylineElement.points, the whole document will be
leaked.
The fix depends on having the cyclic reference as is since the owning and the
owned classes have to live together if any of them is referenced. But the owning
class caches a raw 'ref-counted' pointer of the owned class. If it is requested
for an instance of the owned class it returned a RefPtr<> of it. Once the owned
class is not used, it can delete itself. The only thing needed here is to notify
the owner class of the deletion so it cleans its caches and be able to create a
new pointer if it is requested for an instance of the owned class later.
Revert the change of r181345 in SVGAnimatedProperty::lookupOrCreateWrapper()
to break the cyclic reference between SVGElement and SVGAnimatedProperty.
Also apply the same approach in SVGAnimatedListPropertyTearOff::baseVal() and
animVal() to break cyclic reference between SVGListPropertyTearOff and
SVGAnimatedListPropertyTearOff.
Change-Id: Ied6a077299e47855feb235a1c9310f1a58aad91b
Reviewed-by: Konstantin Tokarev <annulen@yandex.ru>
Reviewed-by: Michael Brüning <michael.bruning@theqtcompany.com>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
https://bugs.webkit.org/show_bug.cgi?id=119492
Reviewed by Darin Adler.
Source/WebCore:
* html/HTMLAnchorElement.cpp:
(WebCore::HTMLAnchorElement::parseAttribute): Call shouldProhibitLinks.
(WebCore::shouldProhibitLinks): Added.
* html/HTMLAnchorElement.h:
* html/HTMLImageElement.cpp:
(WebCore::HTMLImageElement::parseAttribute): Call shouldProhibitLinks.
* rendering/svg/RenderSVGRoot.cpp:
(WebCore::RenderSVGRoot::isEmbeddedThroughSVGImage): Use isInSVGImage.
* svg/SVGAElement.cpp:
(WebCore::SVGAElement::svgAttributeChanged): Call shouldProhibitLinks.
* svg/graphics/SVGImage.cpp:
(WebCore::SVGImage::hasSingleSecurityOrigin): Added.
(WebCore::isInSVGImage): Added.
* svg/graphics/SVGImage.h:
Change-Id: I294821dff7299e3c6a3e1df8f8ff3d855dc16dbd
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@153876 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Reviewed-by: Allan Sandfeld Jensen <allan.jensen@digia.com>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
https://bugs.webkit.org/show_bug.cgi?id=117540
Reviewed by Stephen Chenney.
Adds the glue to WidthIterator to take advantage of kerning in SVG web fonts.
To supply SVG font kerning with its required text input, the signature of
applyFontTransforms has been extended.
Since SVG font kerning was extremely slow, it has been sped up by replacing
the iteration over all possible kerning definitions with a hash-map based
lookup of the leading symbol to be kerned. The new algorithm provides a
roughly 100x speed-up in SVG font kerning.
Test: fast/text/svg-font-face-with-kerning.html
* platform/graphics/TextRun.h:
(WebCore::TextRun::string):
* platform/graphics/WidthIterator.cpp:
(WebCore::applyFontTransforms):
(WebCore::WidthIterator::advanceInternal):
* rendering/svg/SVGTextRunRenderingContext.cpp:
(WebCore::SVGTextRunRenderingContext::applySVGKerning):
* rendering/svg/SVGTextRunRenderingContext.h:
* svg/SVGFontElement.cpp:
(WebCore::SVGFontElement::invalidateGlyphCache):
(WebCore::SVGFontElement::ensureGlyphCache):
(WebCore::SVGKerningMap::clear):
(WebCore::SVGKerningMap::insert):
(WebCore::stringMatchesUnicodeRange):
(WebCore::stringMatchesGlyphName):
(WebCore::stringMatchesUnicodeName):
(WebCore::matches):
(WebCore::kerningForPairOfStringsAndGlyphs):
(WebCore::SVGFontElement::horizontalKerningForPairOfStringsAndGlyphs):
(WebCore::SVGFontElement::verticalKerningForPairOfStringsAndGlyphs):
* svg/SVGFontElement.h:
(WebCore::SVGKerning::SVGKerning):
(WebCore::SVGKerningMap::isEmpty):
* svg/SVGHKernElement.cpp:
(WebCore::SVGHKernElement::buildHorizontalKerningPair):
* svg/SVGHKernElement.h:
* svg/SVGVKernElement.cpp:
(WebCore::SVGVKernElement::buildVerticalKerningPair):
* svg/SVGVKernElement.h:
Change-Id: I309d05b57df3a85fa9720e56f4ace53d5d1d8cf5
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@156393 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Reviewed-by: Allan Sandfeld Jensen <allan.jensen@digia.com>
|
|
|
|
|
|
|
| |
Importing a new snapshot of webkit.
Change-Id: I2d01ad12cdc8af8cb015387641120a9d7ea5f10c
Reviewed-by: Allan Sandfeld Jensen <allan.jensen@digia.com>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
https://bugs.webkit.org/show_bug.cgi?id=109293
Source/WebCore:
Replacing a list property item with itself should be a no-op. This patch updates the related
APIs and logic to detect the self-replace case and prevent removal of the item from the list.
To avoid scanning the list multiple times, removeItemFromList() is updated to operate on
indices and a findItem() method is added to resolve an item to an index.
Reviewed by Dirk Schulze.
No new tests: updated existing tests cover the change.
* svg/properties/SVGAnimatedListPropertyTearOff.h:
(WebCore::SVGAnimatedListPropertyTearOff::findItem):
(SVGAnimatedListPropertyTearOff):
(WebCore::SVGAnimatedListPropertyTearOff::removeItemFromList):
* svg/properties/SVGAnimatedPathSegListPropertyTearOff.h:
(WebCore::SVGAnimatedPathSegListPropertyTearOff::findItem):
(SVGAnimatedPathSegListPropertyTearOff):
(WebCore::SVGAnimatedPathSegListPropertyTearOff::removeItemFromList):
Add a findItem() delegating method, and update removeItemFromList() to use the new
index-based API.
* svg/properties/SVGListProperty.h:
(WebCore::SVGListProperty::insertItemBeforeValues):
(WebCore::SVGListProperty::insertItemBeforeValuesAndWrappers):
(WebCore::SVGListProperty::replaceItemValues):
(WebCore::SVGListProperty::replaceItemValuesAndWrappers):
(SVGListProperty):
Updated to handle the no-op case for insertItemBefore() & replaceItem().
* svg/properties/SVGListPropertyTearOff.h:
(WebCore::SVGListPropertyTearOff::findItem):
(WebCore::SVGListPropertyTearOff::removeItemFromList):
Index-based API updates.
(WebCore::SVGListPropertyTearOff::processIncomingListItemValue):
(WebCore::SVGListPropertyTearOff::processIncomingListItemWrapper):
* svg/properties/SVGPathSegListPropertyTearOff.cpp:
(WebCore::SVGPathSegListPropertyTearOff::processIncomingListItemValue):
Detect the self-replace case and return without removing the item from the list.
* svg/properties/SVGPathSegListPropertyTearOff.h:
(WebCore::SVGPathSegListPropertyTearOff::findItem):
(WebCore::SVGPathSegListPropertyTearOff::removeItemFromList):
(SVGPathSegListPropertyTearOff):
(WebCore::SVGPathSegListPropertyTearOff::processIncomingListItemWrapper):
* svg/properties/SVGStaticListPropertyTearOff.h:
(WebCore::SVGStaticListPropertyTearOff::processIncomingListItemValue):
(WebCore::SVGStaticListPropertyTearOff::processIncomingListItemWrapper):
Index-based API updates.
Change-Id: I6afa8ff964eaccd1337156af41c5ded07e3b4b7d
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@142759 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Reviewed-by: Jocelyn Turcotte <jocelyn.turcotte@digia.com>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
https://bugs.webkit.org/show_bug.cgi?id=104007
Reviewed by Eric Seidel.
Upon redraw, SVGImage calls layout on the document it is drawing into
the image if the image, provided it believes the redraw does not need
to be delayed. Unfortunately, when an SVG <use> element is modified
(by animation, say) and regenerates its shadow tree, the destructors
invoke redraw, causing the SVGImage to call layout on something that
is in the process of being deleted. That's bad.
This change causes SVGImage to always delay the redraw. It is the most robust
way to protect against this problem, as there may be any number of
ways to cause this issue (a node being deleted in an svg-as-image
target) and this protects against them all.
The test case crashes in Asan Chromium.
Source/WebCore:
Test: svg/as-image/animated-use-as-image-crash.html
* svg/graphics/SVGImageCache.cpp:
(WebCore::SVGImageCache::imageContentChanged): Always redraw on the timer.
LayoutTests:
* platform/chromium-win/svg/custom/use-disappears-after-style-update-expected.png: Changed as a result of this change.
* svg/as-image/animated-use-as-image-crash-expected.txt: Added.
* svg/as-image/animated-use-as-image-crash.html: Added.
* svg/as-image/resources/animated-href-on-use.svg: Added.
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@136845 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Change-Id: I83b299c26582db115bc921435f2c96da42f761d3
Reviewed-by: Jocelyn Turcotte <jocelyn.turcotte@digia.com>
|
|
|
|
|
|
|
|
|
| |
(http://svn.webkit.org/repository/webkit/trunk@136119)
New snapshot that includes the fix for installing the QtWebProcess into libexec
Change-Id: I01344e079cbdac5678c4cba6ffcc05f4597cf0d7
Reviewed-by: Simon Hausmann <simon.hausmann@digia.com>
|
|
|
|
|
|
|
|
|
| |
(http://svn.webkit.org/repository/webkit/trunk@135602)
New snapshot that fixes various bugs
Change-Id: Icb6ce541a26a9f500d087821ce4b83a8d8a5474a
Reviewed-by: Simon Hausmann <simon.hausmann@digia.com>
|
|
|
|
|
|
|
| |
(http://svn.webkit.org/repository/webkit/trunk@135485)
Change-Id: I03774e5ac79721c13ffa30d152537a74d0b12e66
Reviewed-by: Simon Hausmann <simon.hausmann@digia.com>
|
|
|
|
|
|
| |
(http://svn.webkit.org/repository/webkit/trunk@133952)
Revert back to an older snapshot that should build on ARM
|
|
|
|
|
|
| |
(http://svn.webkit.org/repository/webkit/trunk@134025)
New snapshot with numerious build fixes, including MSVC 2012 and ARM Thumb-2.
|
|
|
|
|
|
| |
(http://svn.webkit.org/repository/webkit/trunk@133733)
New snapshot that contains all previous fixes as well as build fix for latest QtMultimedia API changes.
|
|
|
|
|
|
| |
(http://svn.webkit.org/repository/webkit/trunk@132191)
New snapshot that should fix build with latest qtbase and the QPlastiqueStyle removal
|
|
|
|
|
|
| |
(http://svn.webkit.org/repository/webkit/trunk@132067)
New snapshot that fixes build without QtWidgets
|
|
|
|
|
|
|
| |
(http://svn.webkit.org/repository/webkit/trunk@131718)
New snapshot that includes the return of -fkeep-memory at link time
to reduce memory pressure as well as modularized documentation
|
|
|
|
|
|
|
| |
(http://svn.webkit.org/repository/webkit/trunk@131592)
New snapshot that includes the build fixes for Mac OS X 10.6 and earlier as well
as the previously cherry-picked changes
|
|
|
|
|
|
|
|
| |
(http://svn.webkit.org/repository/webkit/trunk@131300)"
This reverts commit 5466563f4b5b6b86523e3f89bb7f77e5b5270c78.
Caused OOM issues on some CI machines :(
|
|
|
|
|
|
|
|
|
| |
(http://svn.webkit.org/repository/webkit/trunk@131300)
WebKit update which introduces the QtWebKitWidgets module that contains the WK1
widgets based API. (In fact it renames QtWebKit to QtWebKitWidgets while we're
working on completing the entire split as part of
https://bugs.webkit.org/show_bug.cgi?id=99314
|
|
|
|
|
|
| |
(http://svn.webkit.org/repository/webkit/trunk@129119)
New snapshot with prospective build fix for incorrect QtWebKit master module header file creation
|
|
|
|
|
|
| |
(http://svn.webkit.org/repository/webkit/trunk@128886)
New snapshot with various build fixes
|
|
|
|
|
|
| |
(http://svn.webkit.org/repository/webkit/trunk@128608)
New snapshot that enables WebKit2 build on Windows (still some bugs) and allows for WebKit to be built with qmake && make
|
|
|
|
|
|
|
| |
(http://svn.webkit.org/repository/webkit/trunk@128206)
This includes the rewrite of the configure part of the build system which should fix the QtQuick2 detection
and allow for further simplifications in the future
|
|
|
|
|
|
| |
(http://svn.webkit.org/repository/webkit/trunk@128073)
New snapshot
|
|
|
|
|
|
| |
(http://svn.webkit.org/repository/webkit/trunk@126420)
New snapshot with OS X 10.6 build fix
|
|
|
|
|
|
| |
(http://svn.webkit.org/repository/webkit/trunk@126284)
New snapshot that includes MSVC 64-bit build fix
|
|
|
|
|
|
| |
(http://svn.webkit.org/repository/webkit/trunk@126147)
New snapshot including various build fixes for newer Qt 5
|
|
|
|
|
|
| |
(http://svn.webkit.org/repository/webkit/trunk@125365)
New snapshot with build fixes for latest API changes in Qt and all WK1 Win MSVC fixes upstream
|
|
|
|
|
|
| |
(http://svn.webkit.org/repository/webkit/trunk@124002)
New snapshot with prospective Mountain Lion build fix
|
|
|
|
|
|
| |
(http://svn.webkit.org/repository/webkit/trunk@123308)
New snapshot with better configure tests
|
|
|
|
|
|
| |
(http://svn.webkit.org/repository/webkit/trunk@122948)
New snapshot that should fix the rendering issues recently introduced
|
|
|
|
| |
(http://svn.webkit.org/repository/webkit/trunk@122676)
|
|
|
|
|
|
| |
(http://svn.webkit.org/repository/webkit/trunk@122325)
New snapshot that should work with the latest Qt build system changes
|
|
|
|
|
|
| |
(http://svn.webkit.org/repository/webkit/trunk@121325)
New snapshot with more Windows build fixes
|
|
|
|
|
|
| |
(http://svn.webkit.org/repository/webkit/trunk@121147)
New snapshot that includes Win32 debug build fix (use SVGAllInOne)
|
|
|
|
|
|
| |
(http://svn.webkit.org/repository/webkit/trunk@120813)
New snapshot with Windows build fixes
|
|
|
|
|
|
|
| |
(http://svn.webkit.org/repository/webkit/trunk@119200)
Weekly update :). Particularly relevant changes for Qt are the use of the WebCore image decoders and direct usage
of libpng/libjpeg if available in the system.
|
|
|
|
| |
(http://svn.webkit.org/repository/webkit/trunk@118629)
|
|
|
|
| |
(http://svn.webkit.org/repository/webkit/trunk@118516)
|
|
|
|
|
|
| |
(http://svn.webkit.org/repository/webkit/trunk@117578)
Weekly snapshot
|
|
|
|
|
|
| |
(http://svn.webkit.org/repository/webkit/trunk@116736)
New snapshot to include QDeclarative* -> QQml* build fixes
|
|
|
|
| |
(http://svn.webkit.org/repository/webkit/trunk@116286)
|
|
|
|
|
|
| |
(http://svn.webkit.org/repository/webkit/trunk@110422)
This includes build fixes for the latest qtbase/qtdeclarative as well as the final QML2 API.
|
|
|
|
| |
(http://svn.webkit.org/repository/webkit/trunk@108790)
|
|
|
|
| |
(http://svn.webkit.org/repository/webkit/trunk@107223)
|