208279 2020-02-26 17:22:11 -0800 Hit test with clipPath referencing parent element causes infinite recursion 2020-06-17 12:00:40 -0700 1 1 1 Unclassified WebKit SVG WebKit Local Build Mac macOS 10.15 RESOLVED FIXED https://bugs.webkit.org/show_bug.cgi?id=209773 InRadar P2 Normal --- 1 dougk webkit-unassigned commit-queue dino esprehn+autocc ews-watchlist fmalita glenn gyuyoung.kim kondapallykalyan pdr rniwa sabouhallawa schenney sergio webkit-bug-importer zimmermann oldest_to_newest 1623298 0 dougk 2020-02-26 17:22:11 -0800 When using a hit test that checks an element nested inside a clipPath (but the child element refers to the clipPath), this can result in an infinite recursion. An extra check is needed to break the cycle when performing the hit test. <rdar://problem/58381090> 1623304 1 391817 dougk 2020-02-26 17:28:30 -0800 Created attachment 391817 Patch 1623865 2 391817 rniwa 2020-02-27 19:53:55 -0800 Comment on attachment 391817 Patch Seems ok. 1623866 3 391817 commit-queue 2020-02-27 20:15:43 -0800 Comment on attachment 391817 Patch Clearing flags on attachment: 391817 Committed r257616: <https://trac.webkit.org/changeset/257616> 1623867 4 commit-queue 2020-02-27 20:15:45 -0800 All reviewed patches have been landed. Closing bug. 1624673 5 391817 sabouhallawa 2020-03-02 12:37:41 -0800 Comment on attachment 391817 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=391817&action=review > Source/WebCore/rendering/svg/RenderSVGResourceClipper.cpp:290 > + const RenderStyle& style = renderer->style(); > + if (is<ReferenceClipPathOperation>(style.clipPath())) { > + auto& clipPath = downcast<ReferenceClipPathOperation>(*style.clipPath()); > + AtomString id(clipPath.fragment()); > + RenderSVGResourceClipper* clipper = getRenderSVGResourceById<RenderSVGResourceClipper>(document(), id); > + if (clipper == this) > + continue; > + } I do not think this is the right solution. Detecting SVG resources cyclic referencing is more complicated than going one level up in the resources tree. For example if you delete the last two lines of your test case below: <clipPath id="clippath" clipPathUnits="objectBoundingBox"> <text clip-path="url(#clippath)" to="currentColor">Text</text> And you add these lines instead: <g id="group"> <text clip-path="url(#clippath)" to="currentColor">Text</text> </g> <clipPath id="clippath" clipPathUnits="objectBoundingBox"> <use href="#group"/> </clipPath> The new test case will hit the following infinite recursive call stack: #1 0x000000011c854e44 in WebCore::RenderBlock::nodeAtPoint(WebCore::HitTestRequest const&, WebCore::HitTestResult&, WebCore::HitTestLocation const&, WebCore::LayoutPoint const&, WebCore::HitTestAction) at /Volumes/Data/WebKit/OpenSource/Source/WebCore/rendering/RenderBlock.cpp:1994 #2 0x000000011cc241e1 in WebCore::RenderSVGText::nodeAtFloatPoint(WebCore::HitTestRequest const&, WebCore::HitTestResult&, WebCore::FloatPoint const&, WebCore::HitTestAction) at /Volumes/Data/WebKit/OpenSource/Source/WebCore/rendering/svg/RenderSVGText.cpp:444 #3 0x000000011cbcc501 in WebCore::RenderSVGContainer::nodeAtFloatPoint(WebCore::HitTestRequest const&, WebCore::HitTestResult&, WebCore::FloatPoint const&, WebCore::HitTestAction) at /Volumes/Data/WebKit/OpenSource/Source/WebCore/rendering/svg/RenderSVGContainer.cpp:170 #4 0x000000011cbcc501 in WebCore::RenderSVGContainer::nodeAtFloatPoint(WebCore::HitTestRequest const&, WebCore::HitTestResult&, WebCore::FloatPoint const&, WebCore::HitTestAction) at /Volumes/Data/WebKit/OpenSource/Source/WebCore/rendering/svg/RenderSVGContainer.cpp:170 #5 0x000000011cbe0606 in WebCore::RenderSVGResourceClipper::hitTestClipContent(WebCore::FloatRect const&, WebCore::FloatPoint const&) at /Volumes/Data/WebKit/OpenSource/Source/WebCore/rendering/svg/RenderSVGResourceClipper.cpp:293 #6 0x000000011c8553c8 in WebCore::RenderBlock::nodeAtPoint(WebCore::HitTestRequest const&, WebCore::HitTestResult&, WebCore::HitTestLocation const&, WebCore::LayoutPoint const&, WebCore::HitTestAction) at /Volumes/Data/WebKit/OpenSource/Source/WebCore/rendering/RenderBlock.cpp:2048 #7 0x000000011cc241e1 in WebCore::RenderSVGText::nodeAtFloatPoint(WebCore::HitTestRequest const&, WebCore::HitTestResult&, WebCore::FloatPoint const&, WebCore::HitTestAction) at /Volumes/Data/WebKit/OpenSource/Source/WebCore/rendering/svg/RenderSVGText.cpp:444 Please see SVGResourcesCycleSolver::resolveCycles(). 1624676 6 392173 sabouhallawa 2020-03-02 12:41:19 -0800 Created attachment 392173 test case (will crash) 1624951 7 rniwa 2020-03-02 22:49:01 -0800 Let's track that in a separate bug. 391817 2020-02-26 17:28:30 -0800 2020-02-27 20:15:43 -0800 Patch bug-208279-20200226172830.patch text/plain 4512 dougk U3VidmVyc2lvbiBSZXZpc2lvbjogMjU2OTg3CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggZjZiMmIwYzVhY2M1Yzk5 MTBlZTc0YWY5YTBmMmE5NDUwNjUyMWJmMy4uOTQxYzViN2JhNjQ5MTQyZjdkMGY3YTMyZDk5YTU1 Mjk5NjEzYmY3ZiAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDE5IEBACisyMDIwLTAyLTI2ICBEb3Vn IEtlbGx5ICA8ZG91Z2tAYXBwbGUuY29tPgorCisgICAgICAgIEhpdCB0ZXN0IHdpdGggY2xpcFBh dGggcmVmZXJlbmNpbmcgcGFyZW50IGVsZW1lbnQgY2F1c2VzIGluZmluaXRlIHJlY3Vyc2lvbgor ICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MjA4Mjc5CisK KyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgQWRkIGFuIGVh cmx5IHJldHVybiBmb3IgU1ZHIGhpdCB0ZXN0cyB3aGljaCBoYXZlIGEgY2hpbGQgZWxlbWVudCBy ZWZlcmVuY2luZyBhICBwYXJlbnQgY2xpcFBhdGguCisgICAgICAgIFRoaXMgY2hhbmdlIGJyZWFr cyB0aGUgY3ljbGUsIGFsdGhvdWdoIGl0IHVuZm9ydHVuYXRlbHkgcnVucyBvbiBldmVyeSBoaXQg dGVzdCwgZm9yIGVhY2ggbm9kZSB3aGljaAorICAgICAgICBpcyBhIGNoaWxkIG9mIHRoZSBjbGlw UGF0aCBlbGVtZW50LiAKKworICAgICAgICBUZXN0OiBzdmcvaGl0dGVzdC9zdmctY2xpcC1wYXRo LWNoaWxkLWVsZW1lbnQuaHRtbAorCisgICAgICAgICogcmVuZGVyaW5nL3N2Zy9SZW5kZXJTVkdS ZXNvdXJjZUNsaXBwZXIuY3BwOgorICAgICAgICAoV2ViQ29yZTo6UmVuZGVyU1ZHUmVzb3VyY2VD bGlwcGVyOjpoaXRUZXN0Q2xpcENvbnRlbnQpOgorCiAyMDIwLTAyLTE5ICBZb3Vlbm4gRmFibGV0 ICA8eW91ZW5uQGFwcGxlLmNvbT4KIAogICAgICAgICBbbWFjIGRlYnVnXSBSZWdyZXNzaW9uOiBo dHRwL3Rlc3RzL3dlYnNvY2tldC90ZXN0cy9oeWJpL3dvcmtlcnMvd29ya2VyLXJlbG9hZC5odG1s IGlzIGEgZmxha3kgY3Jhc2gKZGlmZiAtLWdpdCBhL1NvdXJjZS9XZWJDb3JlL3JlbmRlcmluZy9z dmcvUmVuZGVyU1ZHUmVzb3VyY2VDbGlwcGVyLmNwcCBiL1NvdXJjZS9XZWJDb3JlL3JlbmRlcmlu Zy9zdmcvUmVuZGVyU1ZHUmVzb3VyY2VDbGlwcGVyLmNwcAppbmRleCAxZDc3YjYzYzZmZTI4MzEy YWUxMWVkODI1YjUyM2FhY2U3MTdlYzVhLi4xM2RmNjIyNDc0YjJmNjFjYzAzNzM2MDEyZThiNTNm MjA4MGZkYWExIDEwMDY0NAotLS0gYS9Tb3VyY2UvV2ViQ29yZS9yZW5kZXJpbmcvc3ZnL1JlbmRl clNWR1Jlc291cmNlQ2xpcHBlci5jcHAKKysrIGIvU291cmNlL1dlYkNvcmUvcmVuZGVyaW5nL3N2 Zy9SZW5kZXJTVkdSZXNvdXJjZUNsaXBwZXIuY3BwCkBAIC0yNzksNiArMjc5LDE2IEBAIGJvb2wg UmVuZGVyU1ZHUmVzb3VyY2VDbGlwcGVyOjpoaXRUZXN0Q2xpcENvbnRlbnQoY29uc3QgRmxvYXRS ZWN0JiBvYmplY3RCb3VuZGluCiAgICAgICAgICAgICBjb250aW51ZTsKICAgICAgICAgaWYgKCFy ZW5kZXJlci0+aXNTVkdTaGFwZSgpICYmICFyZW5kZXJlci0+aXNTVkdUZXh0KCkgJiYgIWNoaWxk Tm9kZS0+aGFzVGFnTmFtZShTVkdOYW1lczo6dXNlVGFnKSkKICAgICAgICAgICAgIGNvbnRpbnVl OworCisgICAgICAgIGNvbnN0IFJlbmRlclN0eWxlJiBzdHlsZSA9IHJlbmRlcmVyLT5zdHlsZSgp OworICAgICAgICBpZiAoaXM8UmVmZXJlbmNlQ2xpcFBhdGhPcGVyYXRpb24+KHN0eWxlLmNsaXBQ YXRoKCkpKSB7CisgICAgICAgICAgICBhdXRvJiBjbGlwUGF0aCA9IGRvd25jYXN0PFJlZmVyZW5j ZUNsaXBQYXRoT3BlcmF0aW9uPigqc3R5bGUuY2xpcFBhdGgoKSk7CisgICAgICAgICAgICBBdG9t U3RyaW5nIGlkKGNsaXBQYXRoLmZyYWdtZW50KCkpOworICAgICAgICAgICAgUmVuZGVyU1ZHUmVz b3VyY2VDbGlwcGVyKiBjbGlwcGVyID0gZ2V0UmVuZGVyU1ZHUmVzb3VyY2VCeUlkPFJlbmRlclNW R1Jlc291cmNlQ2xpcHBlcj4oZG9jdW1lbnQoKSwgaWQpOworICAgICAgICAgICAgaWYgKGNsaXBw ZXIgPT0gdGhpcykKKyAgICAgICAgICAgICAgICBjb250aW51ZTsKKyAgICAgICAgfQorCiAgICAg ICAgIEludFBvaW50IGhpdFBvaW50OwogICAgICAgICBIaXRUZXN0UmVzdWx0IHJlc3VsdChoaXRQ b2ludCk7CiAgICAgICAgIGlmIChyZW5kZXJlci0+bm9kZUF0RmxvYXRQb2ludChIaXRUZXN0UmVx dWVzdChIaXRUZXN0UmVxdWVzdDo6U1ZHQ2xpcENvbnRlbnQgfCBIaXRUZXN0UmVxdWVzdDo6RGlz YWxsb3dVc2VyQWdlbnRTaGFkb3dDb250ZW50KSwgcmVzdWx0LCBwb2ludCwgSGl0VGVzdEZvcmVn cm91bmQpKQpkaWZmIC0tZ2l0IGEvTGF5b3V0VGVzdHMvQ2hhbmdlTG9nIGIvTGF5b3V0VGVzdHMv Q2hhbmdlTG9nCmluZGV4IDNjYjE5MWRlOTViNzE0YmNkNTU5YWI1MmQyZGFhYjM4NTJjNDQ5ZTEu LmZiMjJjNTY3NWM3YjY2YmZjMTM4NGRkYmUxNmMwMzYxY2FhNjA3MjkgMTAwNjQ0Ci0tLSBhL0xh eW91dFRlc3RzL0NoYW5nZUxvZworKysgYi9MYXlvdXRUZXN0cy9DaGFuZ2VMb2cKQEAgLTEsMyAr MSwxMyBAQAorMjAyMC0wMi0yNiAgRG91ZyBLZWxseSAgPGRvdWdrQGFwcGxlLmNvbT4KKworICAg ICAgICBIaXQgdGVzdCB3aXRoIGNsaXBQYXRoIHJlZmVyZW5jaW5nIHBhcmVudCBlbGVtZW50IGNh dXNlcyBpbmZpbml0ZSByZWN1cnNpb24KKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcv c2hvd19idWcuY2dpP2lkPTIwODI3OQorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09Q UyEpLgorCisgICAgICAgICogc3ZnL2hpdHRlc3Qvc3ZnLWNsaXAtcGF0aC1jaGlsZC1lbGVtZW50 LWV4cGVjdGVkLnR4dDogQWRkZWQuCisgICAgICAgICogc3ZnL2hpdHRlc3Qvc3ZnLWNsaXAtcGF0 aC1jaGlsZC1lbGVtZW50Lmh0bWw6IEFkZGVkLgorCiAyMDIwLTAyLTE5ICBKYXNvbiBMYXdyZW5j ZSAgPGxhd3JlbmNlLmpAYXBwbGUuY29tPgogCiAgICAgICAgIFsgTWFjIF0gY3NzMy9zZWxlY3Rv cnMzL3htbC9jc3MzLW1vZHNlbC1kMS54bWwgaXMgZmxha3kgZmFpbGluZy4KZGlmZiAtLWdpdCBh L0xheW91dFRlc3RzL3N2Zy9oaXR0ZXN0L3N2Zy1jbGlwLXBhdGgtY2hpbGQtZWxlbWVudC1leHBl Y3RlZC50eHQgYi9MYXlvdXRUZXN0cy9zdmcvaGl0dGVzdC9zdmctY2xpcC1wYXRoLWNoaWxkLWVs ZW1lbnQtZXhwZWN0ZWQudHh0Cm5ldyBmaWxlIG1vZGUgMTAwNjQ0CmluZGV4IDAwMDAwMDAwMDAw MDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAuLmUyNmEyYmJiMWRjNDg2ODk0NWExNTI1ZDQ1 ZjUxOTJkN2ZiM2U5Y2EKLS0tIC9kZXYvbnVsbAorKysgYi9MYXlvdXRUZXN0cy9zdmcvaGl0dGVz dC9zdmctY2xpcC1wYXRoLWNoaWxkLWVsZW1lbnQtZXhwZWN0ZWQudHh0CkBAIC0wLDAgKzEgQEAK K1Rlc3RzIFNWRyBoaXQgdGVzdCB3aXRoIGEgcmVjdXJzaXZlIGNsaXBQYXRoLiBUZXN0IHBhc3Nl cyBpZiBXZWJLaXQgZG9lcyBub3QgY3Jhc2guIFBBU1MKZGlmZiAtLWdpdCBhL0xheW91dFRlc3Rz L3N2Zy9oaXR0ZXN0L3N2Zy1jbGlwLXBhdGgtY2hpbGQtZWxlbWVudC5odG1sIGIvTGF5b3V0VGVz dHMvc3ZnL2hpdHRlc3Qvc3ZnLWNsaXAtcGF0aC1jaGlsZC1lbGVtZW50Lmh0bWwKbmV3IGZpbGUg bW9kZSAxMDA2NDQKaW5kZXggMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAw MC4uOWJkODdlZjdkMTc4MGQ0OTcyNGYyNzdmMjA3MTY5ODk2NzgxZTA3MgotLS0gL2Rldi9udWxs CisrKyBiL0xheW91dFRlc3RzL3N2Zy9oaXR0ZXN0L3N2Zy1jbGlwLXBhdGgtY2hpbGQtZWxlbWVu dC5odG1sCkBAIC0wLDAgKzEsMTcgQEAKKzxzdHlsZT4KKy5wYXRoIHsgLXdlYmtpdC1jbGlwLXBh dGg6IHVybCgjY2xpcHBhdGgpOyB9Cis8L3N0eWxlPgorPHNjcmlwdD4KK2Z1bmN0aW9uIGxvYWRl dmVudCgpIHsKKyAgICBkb2N1bWVudC5jYXJldFJhbmdlRnJvbVBvaW50KDM3LCA3MCk7CisgICAg aWYgKHdpbmRvdy50ZXN0UnVubmVyKSB7CisgICAgCWRvY3VtZW50LmJvZHkuaW5uZXJUZXh0ID0g IlRlc3RzIFNWRyBoaXQgdGVzdCB3aXRoIGEgcmVjdXJzaXZlIGNsaXBQYXRoLiAgVGVzdCBwYXNz ZXMgaWYgV2ViS2l0IGRvZXMgbm90IGNyYXNoLiAgUEFTUyI7CisgICAgCXRlc3RSdW5uZXIuZHVt cEFzVGV4dCgpOworICAgIH0KK30KKzwvc2NyaXB0PgorPGJvZHkgb25sb2FkPWxvYWRldmVudCgp PgorPHN2ZyBjb250ZW50U2NyaXB0VHlwZT0idGV4dC9lY21hc2NyaXB0Ij4KKzxwYXRoIGQ9Ik0x NiA4IEwzMiA1NiIgY2xhc3M9InBhdGgiIC8+Cis8Y2xpcFBhdGggaWQ9ImNsaXBwYXRoIiBjbGlw UGF0aFVuaXRzPSJvYmplY3RCb3VuZGluZ0JveCI+Cis8dGV4dCBjbGlwLXBhdGg9InVybCgjY2xp cHBhdGgpIiB0bz0iY3VycmVudENvbG9yIj5UZXh0PC90ZXh0PgpcIE5vIG5ld2xpbmUgYXQgZW5k IG9mIGZpbGUK 392173 2020-03-02 12:41:19 -0800 2020-03-02 12:41:19 -0800 test case (will crash) svg-clip-path-child-element-2.html text/html 633 sabouhallawa PHN0eWxlPgoucGF0aCB7IC13ZWJraXQtY2xpcC1wYXRoOiB1cmwoI2NsaXBwYXRoKTsgfQo8L3N0 eWxlPgo8c2NyaXB0PgpmdW5jdGlvbiBsb2FkZXZlbnQoKSB7CiAgICBkb2N1bWVudC5jYXJldFJh bmdlRnJvbVBvaW50KDM3LCA3MCk7CiAgICBpZiAod2luZG93LnRlc3RSdW5uZXIpIHsKICAgICAg ICBkb2N1bWVudC5ib2R5LmlubmVyVGV4dCA9ICJUZXN0cyBTVkcgaGl0IHRlc3Qgd2l0aCBhIHJl Y3Vyc2l2ZSBjbGlwUGF0aC4gIFRlc3QgcGFzc2VzIGlmIFdlYktpdCBkb2VzIG5vdCBjcmFzaC4g IFBBU1MiOwogICAgICAgIHRlc3RSdW5uZXIuZHVtcEFzVGV4dCgpOwogICAgfQp9Cjwvc2NyaXB0 Pgo8Ym9keSBvbmxvYWQ9bG9hZGV2ZW50KCk+CjxzdmcgY29udGVudFNjcmlwdFR5cGU9InRleHQv ZWNtYXNjcmlwdCI+CjxwYXRoIGQ9Ik0xNiA4IEwzMiA1NiIgY2xhc3M9InBhdGgiIC8+CjxnIGlk PSJncm91cCI+CiAgICA8dGV4dCBjbGlwLXBhdGg9InVybCgjY2xpcHBhdGgpIiB0bz0iY3VycmVu dENvbG9yIj5UZXh0PC90ZXh0Pgo8L2c+CjxjbGlwUGF0aCBpZD0iY2xpcHBhdGgiIGNsaXBQYXRo VW5pdHM9Im9iamVjdEJvdW5kaW5nQm94Ij4KICAgIDx1c2UgaHJlZj0iI2dyb3VwIi8+CjwvY2xp cFBhdGg+