Merge 105978 - crash in WebCore::RenderSVGContainer::paint

Source/WebCore/rendering/svg/RenderSVGResourceClipper.cpp

 /*
  * Copyright (C) 2004, 2005, 2007, 2008 Nikolas Zimmermann <zimmermann@kde.org>
  * Copyright (C) 2004, 2005, 2006, 2007, 2008 Rob Buis <buis@kde.org>
  * Copyright (C) Research In Motion Limited 2009-2010. All rights reserved.
  * Copyright (C) 2011 Dirk Schulze <krit@webkit.org>
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
@@ skipping 36 matching lines @@
 #include "SVGUnitTypes.h"
 #include "SVGUseElement.h"
 #include <wtf/UnusedParam.h>
 
 namespace WebCore {
 
 RenderSVGResourceType RenderSVGResourceClipper::s_resourceType = ClipperResourceType;
 
 RenderSVGResourceClipper::RenderSVGResourceClipper(SVGClipPathElement* node)
     : RenderSVGResourceContainer(node)
-    , m_invalidationBlocked(false)
 {
 }
 
 RenderSVGResourceClipper::~RenderSVGResourceClipper()
 {
     if (m_clipper.isEmpty())
         return;
 
     deleteAllValues(m_clipper);
     m_clipper.clear();
 }
 
 void RenderSVGResourceClipper::removeAllClientsFromCache(bool markForInvalidation)
 {
-    if (m_invalidationBlocked)
-        return;
-
     m_clipBoundaries = FloatRect();
     if (!m_clipper.isEmpty()) {
         deleteAllValues(m_clipper);
         m_clipper.clear();
     }
 
     markAllClientsForInvalidation(markForInvalidation ? LayoutAndBoundariesInvalidation : ParentOnlyInvalidation);
 }
 
 void RenderSVGResourceClipper::removeClientFromCache(RenderObject* client, bool markForInvalidation)
 {
     ASSERT(client);
-    if (m_invalidationBlocked)
-        return;
-
     if (m_clipper.contains(client))
         delete m_clipper.take(client);
 
     markClientForInvalidation(client, markForInvalidation ? BoundariesInvalidation : ParentOnlyInvalidation);
 }
 
 bool RenderSVGResourceClipper::applyResource(RenderObject* object, RenderStyle*, GraphicsContext*& context, unsigned short resourceMode)
 {
     ASSERT(object);
     ASSERT(context);
@@ skipping 92 matching lines @@
         maskContext->concatCTM(absoluteTransform);
 
         // clipPath can also be clipped by another clipPath.
         if (SVGResources* resources = SVGResourcesCache::cachedResourcesForRenderObject(this)) {
             if (RenderSVGResourceClipper* clipper = resources->clipper()) {
                 if (!clipper->applyClippingToContext(this, objectBoundingBox, repaintRect, maskContext))
                     return false;
             }
         }
 
-        drawContentIntoMaskImage(clipperData, objectBoundingBox);
+        if (!drawContentIntoMaskImage(clipperData, objectBoundingBox)) {
+            stateSaver.restore();
+            clipperData->clipMaskImage.clear();
+        }
     }
 
     if (!clipperData->clipMaskImage)
         return false;
 
     SVGImageBufferTools::clipToImageBuffer(context, absoluteTransform, clampedAbsoluteTargetRect, clipperData->clipMaskImage);
     return true;
 }
 
 bool RenderSVGResourceClipper::drawContentIntoMaskImage(ClipperData* clipperData, const FloatRect& objectBoundingBox)
 {
+    ASSERT(frame());
     ASSERT(clipperData);
     ASSERT(clipperData->clipMaskImage);
 
     GraphicsContext* maskContext = clipperData->clipMaskImage->context();
     ASSERT(maskContext);
 
     AffineTransform maskContentTransformation;
     SVGClipPathElement* clipPath = static_cast<SVGClipPathElement*>(node());
     if (clipPath->clipPathUnits() == SVGUnitTypes::SVG_UNIT_TYPE_OBJECTBOUNDINGBOX) {
         maskContentTransformation.translate(objectBoundingBox.x(), objectBoundingBox.y());
         maskContentTransformation.scaleNonUniform(objectBoundingBox.width(), objectBoundingBox.height());
         maskContext->concatCTM(maskContentTransformation);
     }
 
+    // Switch to a paint behavior where all children of this <clipPath> will be rendered using special constraints:
+    // - fill-opacity/stroke-opacity/opacity set to 1
+    // - masker/filter not applied when rendering the children
+    // - fill is set to the initial fill paint server (solid, black)
+    // - stroke is set to the initial stroke paint server (none)
+    PaintBehavior oldBehavior = frame()->view()->paintBehavior();
+    frame()->view()->setPaintBehavior(oldBehavior | PaintBehaviorRenderingSVGMask);
+
     // Draw all clipPath children into a global mask.
     for (Node* childNode = node()->firstChild(); childNode; childNode = childNode->nextSibling()) {
         RenderObject* renderer = childNode->renderer();
         if (!childNode->isSVGElement() || !static_cast<SVGElement*>(childNode)->isStyled() || !renderer)
             continue;
+        if (renderer->needsLayout()) {
+            frame()->view()->setPaintBehavior(oldBehavior);
+            return false;
+        }
         RenderStyle* style = renderer->style();
         if (!style || style->display() == NONE || style->visibility() != VISIBLE)
             continue;
 
         WindRule newClipRule = style->svgStyle()->clipRule();
         bool isUseElement = renderer->isSVGShadowTreeRootContainer();
         if (isUseElement) {
             SVGUseElement* useElement = static_cast<SVGUseElement*>(childNode);
             renderer = useElement->rendererClipChild();
             if (!renderer)
                 continue;
             if (!useElement->hasAttribute(SVGNames::clip_ruleAttr))
                 newClipRule = renderer->style()->svgStyle()->clipRule();
         }
 
         // Only shapes, paths and texts are allowed for clipping.
         if (!renderer->isSVGShape() && !renderer->isSVGText())
             continue;
 
-        // Save the old RenderStyle of the current object for restoring after drawing
-        // it to the MaskImage. The new intermediate RenderStyle needs to inherit from
-        // the old one.
-        RefPtr<RenderStyle> oldRenderStyle = renderer->style();
-        RefPtr<RenderStyle> newRenderStyle = RenderStyle::clone(oldRenderStyle.get());
-        SVGRenderStyle* svgStyle = newRenderStyle.get()->accessSVGStyle();
-        svgStyle->setFillPaint(SVGRenderStyle::initialFillPaintType(), SVGRenderStyle::initialFillPaintColor(), SVGRenderStyle::initialFillPaintUri());
-        svgStyle->setStrokePaint(SVGRenderStyle::initialStrokePaintType(), SVGRenderStyle::initialStrokePaintColor(), SVGRenderStyle::initialStrokePaintUri());
-        svgStyle->setFillRule(newClipRule);
-        newRenderStyle.get()->setOpacity(1);
-        svgStyle->setFillOpacity(1);
-        svgStyle->setStrokeOpacity(1);
-        svgStyle->setFilterResource(String());
-        svgStyle->setMaskerResource(String());
-
-        // The setStyle() call results in a styleDidChange() call, which in turn invalidations the resources.
-        // As we're mutating the resource on purpose, block updates until we've resetted the style again.
-        m_invalidationBlocked = true;
-        renderer->setStyle(newRenderStyle.release());
+        maskContext->setFillRule(newClipRule);
 
         // In the case of a <use> element, we obtained its renderere above, to retrieve its clipRule.
         // We have to pass the <use> renderer itself to renderSubtreeToImageBuffer() to apply it's x/y/transform/etc. values when rendering.
         // So if isUseElement is true, refetch the childNode->renderer(), as renderer got overriden above.
         SVGImageBufferTools::renderSubtreeToImageBuffer(clipperData->clipMaskImage.get(), isUseElement ? childNode->renderer() : renderer, maskContentTransformation);
-
-        renderer->setStyle(oldRenderStyle.release());
-        m_invalidationBlocked = false;
     }
 
+    frame()->view()->setPaintBehavior(oldBehavior);
     return true;
 }
 
 void RenderSVGResourceClipper::calculateClipContentRepaintRect()
 {
     // This is a rough heuristic to appraise the clip size and doesn't consider clip on clip.
     for (Node* childNode = node()->firstChild(); childNode; childNode = childNode->nextSibling()) {
         RenderObject* renderer = childNode->renderer();
         if (!childNode->isSVGElement() || !static_cast<SVGElement*>(childNode)->isStyled() || !renderer)
             continue;
@@ skipping 54 matching lines @@
         transform.scaleNonUniform(objectBoundingBox.width(), objectBoundingBox.height());
         return transform.mapRect(m_clipBoundaries);
     }
 
     return m_clipBoundaries;
 }
 
 }
 
 #endif // ENABLE(SVG)