REGRESSION(r285481): Infinite recursion with cyclic filter reference

• Component: SVG
• Status: RESOLVED FIXED

[Said Abou-Hallawa]

Created attachment 443878 [details]
test case

Open the attached test case.

Result: WebKit crashes because of infinite recursion.

This happens because of r285481. Before this change, we were creating the ImageBuffer of the referenced SVGElement for the FEImage through RenderSVGResourceFilter::postApplyResource(). Now we we create this ImageBuffer through RenderSVGResourceFilter::applyResource(). The difference is at the end of RenderSVGResourceFilter::applyResource() we add entry to m_rendererFilterDataMap

m_rendererFilterDataMap.set(&renderer, WTFMove(filterData));

This will detect the cycle if we try to build the same filter while we are running RenderSVGResourceFilter::postApplyResource().

if (m_rendererFilterDataMap.contains(&renderer)) {
    FilterData* filterData = m_rendererFilterDataMap.get(&renderer);
    if (filterData->state == FilterData::PaintingSource || filterData->state == FilterData::Applying)
        filterData->state = FilterData::CycleDetected;
    return false; // Already built, or we're in a cycle, or we're marked for removal. Regardless, just do nothing more now.
}

But this will not help detect it before we add the entry to the m_rendererFilterDataMap.

[Said Abou-Hallawa]

rdar://85264240

[Said Abou-Hallawa]

Created attachment 443895 [details]
Patch

[EWS]

Tools/Scripts/svn-apply failed to apply attachment 443895 [details] to trunk.
Please resolve the conflicts and upload a new patch.

[Said Abou-Hallawa]

Created attachment 444129 [details]
Patch

[EWS]

Committed r285769 (244213@main): <https://commits.webkit.org/244213@main>

All reviewed patches have been landed. Closing bug and clearing flags on attachment 444129 [details].