Skip to content

GitLab

T
tangled
Commit 70ed485e authored by Fredrik Söderquist's avatar Fredrik Söderquist Committed by Commit Bot
Browse files
Options

[SPv175] Don't crash on <feImage> which reference an element with a mask 

This works around a crash where a layout box references a filter that
contains a feImage filter primitive, which in turn reference content
that has a mask applied.

Bug: 814815, 825538
Cq-Include-Trybots: master.tryserver.blink:linux_trusty_blink_rel;master.tryserver.chromium.linux:linux_layout_tests_slimming_paint_v2
Change-Id: Ib2433b3ba48b3ea56462a1eb64209d36aa37cfa4
Reviewed-on: https://chromium-review.googlesource.com/982114Reviewed-by: default avatarXianzhu Wang <wangxianzhu@chromium.org>
Commit-Queue: Fredrik Söderquist <fs@opera.com>
Cr-Commit-Position: refs/heads/master@{#547802}
parent dd598460
Hide whitespace changes
Inline Side-by-side
Showing with 24 additions and 4 deletions
third_party/WebKit/LayoutTests/svg/masking/mask-within-feimage-filter-on-root-crash.html 0 → 100644
View file @ 70ed485e
<!DOCTYPE html>
<title>'mask' within &lt;feImage> should not crash</title>
<script src="../../resources/testharness.js"></script>
<script src="../../resources/testharnessreport.js"></script>
<svg filter="url(#filter)">
<mask id="mask">
<rect width="100" height="100" fill="white"/>
</mask>
<filter id="filter">
<feImage xlink:href="#e"/>
</filter>
<rect id="e" width="200" height="100" fill="green" mask="url(#mask)"/>
</svg>
<script>
test(_ => {});
</script>
third_party/WebKit/Source/core/paint/SVGMaskPainter.cpp
View file @ 70ed485e
......@@ -50,10 +50,14 @@ void SVGMaskPainter::FinishEffect(const LayoutObject& object,
Optional<ScopedPaintChunkProperties> scoped_paint_chunk_properties;
if (RuntimeEnabledFeatures::SlimmingPaintV175Enabled()) {
const auto* properties = object.FirstFragment().PaintProperties();
DCHECK(properties && properties->Mask());
scoped_paint_chunk_properties.emplace(context.GetPaintController(),
properties->Mask(), object,
DisplayItem::kSVGMask);
// TODO(crbug.com/814815): This condition should be a DCHECK, but for now
// we may paint the object for filters during PrePaint before the
// properties are ready.
if (properties && properties->Mask()) {
scoped_paint_chunk_properties.emplace(context.GetPaintController(),
properties->Mask(), object,
DisplayItem::kSVGMask);
}
}
DrawMaskForLayoutObject(context, object, object.ObjectBoundingBox());
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment