Bug 90820 – REGRESSION: Infinite loop in document.elementFromPoint

• Status: RESOLVED
• Resolution: FIXED
• Component: SVG

[Philip Rogers]

Created attachment 151315 [details]
Testcase

In writing a perf test (https://bugs.webkit.org/show_bug.cgi?id=90811) I found a bug where we infinite loop when calling document.elementFromPoint on a <use>'d element in SVG. In the attached testcase you should see:
About to call document.elementFromPoint(100,100)... 3... 2... 1... Done!

But you actually see:
About to call document.elementFromPoint(100,100)... 3... 2... 1...
and the browser hangs.

A quick look through trac hints at a regression from r118319 but that's just a guess.

[Nikolas Zimmermann]

Never heard about document.elementFromPoint before, its untested for SVG and likely to be broken.

[Philip Rogers]

(In reply to comment #1)
> Never heard about document.elementFromPoint before, its untested for SVG and likely to be broken.

Sure we do! elementFromPoint just calls through the nodeAtFloatPoint codepaths; lots of tests there. What we don't have is tests of this on <use> or <symbol> though, which is how this regressed.

[Shinya Kawanaka]

Hi, I found this issue accidentally. Let me check it...

[Shinya Kawanaka]

Created attachment 152163 [details]
Patch

[Shinya Kawanaka]

I hope this patch will pass the tests...

[WebKit Review Bot]

Comment on attachment 152163 [details]
Patch

Attachment 152163 [details] did not pass chromium-ews (chromium-xvfb):
Output: http://queues.webkit.org/results/13207953

New failing tests:
http/tests/w3c/webperf/approved/navigation-timing/html/test_performance_attributes_exist_in_object.html

[WebKit Review Bot]

Created attachment 152169 [details]
Archive of layout-test-results from gce-cr-linux-04

The attached test failures were seen while running run-webkit-tests on the chromium-ews.
Bot: gce-cr-linux-04  Port: <class 'webkitpy.common.config.ports.ChromiumXVFBPort'>  Platform: Linux-2.6.39-gcg-201203291735-x86_64-with-Ubuntu-10.04-lucid

[Shinya Kawanaka]

Comment on attachment 152163 [details]
Patch

I don't think this failure is related to my patch.

[Shinya Kawanaka]

Created attachment 152671 [details]
Rebased ToT

[Shinya Kawanaka]

zimmerman, could you review this?

[Nikolas Zimmermann]

Comment on attachment 152671 [details]
Rebased ToT

Great catch. r=me!

[Shinya Kawanaka]

(In reply to comment #11)
> (From update of attachment 152671 [details])
> Great catch. r=me!

Thanks for reviewing!

[WebKit Review Bot]

Comment on attachment 152671 [details]
Rebased ToT

Clearing flags on attachment: 152671

Committed r122825: <http://trac.webkit.org/changeset/122825>

[WebKit Review Bot]

All reviewed patches have been landed.  Closing bug.

[Philip Rogers]

(In reply to comment #14)
> All reviewed patches have been landed.  Closing bug.

Thanks for the quick fix Shinya! You rock :)