Attachment 300787 Details for Bug 164181 – Patch

[patch] Patch

bug-164181-20170206214431.patch (text/plain), 4.24 KB, created by Philip Rogers on 2017-02-06 21:46:53 PST

(hide)

Description:

Filename:

MIME Type:

Creator: Philip Rogers

Created: 2017-02-06 21:46:53 PST

Size: 4.24 KB

patch

obsolete

>Index: Source/WebCore/ChangeLog
>===================================================================
>--- Source/WebCore/ChangeLog	(revision 211772)
>+++ Source/WebCore/ChangeLog	(working copy)
>@@ -1,3 +1,22 @@
>+2017-02-06  Philip Rogers  <pdr@google.com>
>+
>+        SVG clip-path references can clip out later content
>+        https://bugs.webkit.org/show_bug.cgi?id=164181
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        RenderSVGResourceClipper can modify the GraphicsContext state (through the path-only
>+        clipping codepath) so we need to ensure RenderLayer::setupClipPath saves and restores
>+        so later content is not clipped as well.
>+
>+        This patch is based on a chromium patch by fs@opera.com:
>+        https://chromium.googlesource.com/chromium/src/+/b3f7e7d2c4afb3c7e5c7eb438ff5933cbe2109b3
>+
>+        Test: css3/masking/clip-path-reference-restore.html
>+
>+        * rendering/RenderLayer.cpp:
>+        (WebCore::RenderLayer::setupClipPath): Add a GC save and switch to downcast instead of static_cast.
>+
> 2017-02-06  Chris Dumez  <cdumez@apple.com>
> 
>         Symbols exposed on cross-origin Window / Location objects should be configurable
>Index: Source/WebCore/rendering/RenderLayer.cpp
>===================================================================
>--- Source/WebCore/rendering/RenderLayer.cpp	(revision 211763)
>+++ Source/WebCore/rendering/RenderLayer.cpp	(working copy)
>@@ -4170,9 +4170,9 @@ bool RenderLayer::setupClipPath(Graphics
>         ReferenceClipPathOperation* referenceClipPathOperation = static_cast<ReferenceClipPathOperation*>(style.clipPath());
>         Element* element = renderer().document().getElementById(referenceClipPathOperation->fragment());
>         if (element && element->hasTagName(SVGNames::clipPathTag) && element->renderer()) {
>-            // FIXME: This should use a safer cast such as toRenderSVGResourceContainer().
>-            // FIXME: Should this do a context.save() and return true so we restore the context?
>-            static_cast<RenderSVGResourceClipper*>(element->renderer())->applyClippingToContext(renderer(), rootRelativeBounds, paintingInfo.paintDirtyRect, context);
>+            context.save();
>+            downcast<RenderSVGResourceClipper>(*element->renderer()).applyClippingToContext(renderer(), rootRelativeBounds, paintingInfo.paintDirtyRect, context);
>+            return true;
>         }
>     }
> 
>Index: LayoutTests/ChangeLog
>===================================================================
>--- LayoutTests/ChangeLog	(revision 211763)
>+++ LayoutTests/ChangeLog	(working copy)
>@@ -1,3 +1,15 @@
>+2017-02-06  Philip Rogers  <pdr@google.com>
>+
>+        SVG clip-path references can clip out later content
>+        https://bugs.webkit.org/show_bug.cgi?id=164181
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        Make sure applying multiple clip-path references does not clip out later content.
>+
>+        * css3/masking/clip-path-reference-restore-expected.html: Added.
>+        * css3/masking/clip-path-reference-restore.html: Added.
>+
> 2017-02-06  Youenn Fablet  <youennf@gmail.com>
> 
>         Allow some schemes to opt-out of CORS
>Index: LayoutTests/css3/masking/clip-path-reference-restore-expected.html
>===================================================================
>--- LayoutTests/css3/masking/clip-path-reference-restore-expected.html	(nonexistent)
>+++ LayoutTests/css3/masking/clip-path-reference-restore-expected.html	(working copy)
>@@ -0,0 +1,2 @@
>+<!DOCTYPE html>
>+<div style="width: 100px; height: 100px; background-color: green;"></div>
>Index: LayoutTests/css3/masking/clip-path-reference-restore.html
>===================================================================
>--- LayoutTests/css3/masking/clip-path-reference-restore.html	(nonexistent)
>+++ LayoutTests/css3/masking/clip-path-reference-restore.html	(working copy)
>@@ -0,0 +1,25 @@
>+<!DOCTYPE html>
>+<style>
>+  .error {
>+    width: 100px;
>+    height: 100px;
>+    background-color: red;
>+    position: absolute;
>+  }
>+  .test {
>+    width: 200px;
>+    height: 50px;
>+    background-color: green;
>+    -webkit-clip-path: url(#c);
>+  }
>+</style>
>+<div class="error"></div>
>+<div class="test"></div>
>+<div class="test"></div>
>+<svg>
>+  <defs>
>+    <clipPath id="c" clipPathUnits="objectBoundingBox">
>+      <rect width="0.5" height="1"/>
>+    </clipPath>
>+  </defs>
>+</svg>

Actions: View | Formatted Diff | Diff

Attachments on bug 164181: 300787 | 301111 | 301114