| File: | Volumes/Data/worker/Apple-iOS-26-Safer-CPP-Checks-EWS/build/Source/WebCore/rendering/svg/legacy/LegacyRenderSVGResource.cpp |
| Warning: | line 56, column 9 Call argument for 'this' parameter is unchecked and unsafe |
Press '?' to see keyboard shortcuts
Keyboard shortcuts:
| 1 | /* |
| 2 | * Copyright (C) 2006 Nikolas Zimmermann <zimmermann@kde.org> |
| 3 | * Copyright (C) 2007 Rob Buis <buis@kde.org> |
| 4 | * Copyright (C) 2008 Dirk Schulze <krit@webkit.org> |
| 5 | * Copyright (C) Research In Motion Limited 2010. All rights reserved. |
| 6 | * Copyright (C) 2023-2026 Apple Inc. All rights reserved. |
| 7 | * Copyright (C) 2014 Google Inc. All rights reserved. |
| 8 | * |
| 9 | * This library is free software; you can redistribute it and/or |
| 10 | * modify it under the terms of the GNU Library General Public |
| 11 | * License as published by the Free Software Foundation; either |
| 12 | * version 2 of the License, or (at your option) any later version. |
| 13 | * |
| 14 | * This library is distributed in the hope that it will be useful, |
| 15 | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
| 16 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU |
| 17 | * Library General Public License for more details. |
| 18 | * |
| 19 | * You should have received a copy of the GNU Library General Public License |
| 20 | * along with this library; see the file COPYING.LIB. If not, write to |
| 21 | * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, |
| 22 | * Boston, MA 02110-1301, USA. |
| 23 | */ |
| 24 | |
| 25 | #include "config.h" |
| 26 | #include "LegacyRenderSVGResource.h" |
| 27 | |
| 28 | #include "ContainerNodeInlines.h" |
| 29 | #include "LegacyRenderSVGResourceClipper.h" |
| 30 | #include "LegacyRenderSVGResourceFilter.h" |
| 31 | #include "LegacyRenderSVGResourceMasker.h" |
| 32 | #include "LegacyRenderSVGResourceSolidColor.h" |
| 33 | #include "LegacyRenderSVGRoot.h" |
| 34 | #include "LegacyRenderSVGShape.h" |
| 35 | #include "LocalFrame.h" |
| 36 | #include "LocalFrameView.h" |
| 37 | #include "RenderElementInlines.h" |
| 38 | #include "RenderObjectInlines.h" |
| 39 | #include "RenderSVGRoot.h" |
| 40 | #include "RenderSVGShape.h" |
| 41 | #include "RenderView.h" |
| 42 | #include "SVGResourceElementClient.h" |
| 43 | #include "SVGResources.h" |
| 44 | #include "SVGResourcesCache.h" |
| 45 | #include "SVGURIReference.h" |
| 46 | #include "Settings.h" |
| 47 | #include "StyleComputedStyle+InitialInlines.h" |
| 48 | |
| 49 | namespace WebCore { |
| 50 | |
| 51 | static inline LegacyRenderSVGResource* requestPaintingResource(RenderSVGResourceMode mode, RenderElement& renderer, const RenderStyle& style, Color& fallbackColor) |
| 52 | { |
| 53 | bool applyToFill = mode == RenderSVGResourceMode::ApplyToFill; |
| 54 | |
| 55 | // When rendering the mask for a LegacyRenderSVGResourceClipper, always use the initial fill paint server. |
| 56 | if (renderer.view().frameView().paintBehavior().contains(PaintBehavior::RenderingSVGClipOrMask)) { |
Call argument for 'this' parameter is unchecked and unsafe | |
| 57 | // Ignore stroke. |
| 58 | if (!applyToFill) |
| 59 | return nullptr; |
| 60 | |
| 61 | // But always use the initial fill paint server. |
| 62 | LegacyRenderSVGResourceSolidColor* colorResource = LegacyRenderSVGResource::sharedSolidPaintingResource(); |
| 63 | colorResource->setColor(Style::ComputedStyle::initialFill().colorDisregardingType().resolvedColor()); |
| 64 | return colorResource; |
| 65 | } |
| 66 | |
| 67 | const auto& paint = applyToFill ? style.fill() : style.stroke(); |
| 68 | |
| 69 | // If we have no fill/stroke, return nullptr. |
| 70 | if (paint.isNone()) |
| 71 | return nullptr; |
| 72 | |
| 73 | Style::ColorResolver colorResolver { style }; |
| 74 | |
| 75 | Color color; |
| 76 | if (auto paintColor = paint.tryAnyColor()) |
| 77 | color = colorResolver.colorResolvingCurrentColor(*paintColor); |
| 78 | |
| 79 | if (style.insideLink() == InsideLink::InsideVisited) { |
| 80 | // FIXME: This code doesn't support the uri component of the visited link paint, https://bugs.webkit.org/show_bug.cgi?id=70006 |
| 81 | auto& visitedPaint = applyToFill ? style.visitedLinkFill() : style.visitedLinkStroke(); |
| 82 | |
| 83 | if (auto visitedPaintColor = visitedPaint.tryColor()) { |
| 84 | if (visitedPaintColor->isCurrentColor()) |
| 85 | color = style.visitedLinkColor(); |
| 86 | else if (auto visitedColor = colorResolver.colorResolvingCurrentColor(*visitedPaintColor); visitedColor.isValid()) |
| 87 | color = visitedColor.colorWithAlpha(color.alphaAsFloat()); |
| 88 | } |
| 89 | } |
| 90 | |
| 91 | // If the primary resource is just a color, return immediately. |
| 92 | auto* colorResource = LegacyRenderSVGResource::sharedSolidPaintingResource(); |
| 93 | if (paint.isColor()) { |
| 94 | colorResource->setColor(color); |
| 95 | return colorResource; |
| 96 | } |
| 97 | |
| 98 | // FIXME: [LBSE] Add support for non-solid color resources in LBSE (gradient/pattern). |
| 99 | SVGResources* resources = nullptr; |
| 100 | if (!renderer.document().settings().layerBasedSVGEngineEnabled()) |
| 101 | resources = SVGResourcesCache::cachedResourcesForRenderer(renderer); |
| 102 | |
| 103 | LegacyRenderSVGResource* uriResource = nullptr; |
| 104 | if (resources) |
| 105 | uriResource = mode == RenderSVGResourceMode::ApplyToFill ? resources->fill() : resources->stroke(); |
| 106 | |
| 107 | // If the requested resource is not available, return the color resource or 'none'. |
| 108 | if (!uriResource) { |
| 109 | // The fallback is 'none'. (SVG2 say 'none' is implied when no fallback is specified.) |
| 110 | if (paint.isURLNone()) |
| 111 | return nullptr; |
| 112 | |
| 113 | colorResource->setColor(color); |
| 114 | return colorResource; |
| 115 | } |
| 116 | |
| 117 | // The paint server resource exists, though it may be invalid (pattern with width/height=0). Pass the fallback color to our caller |
| 118 | // so it can use the solid color painting resource, if applyResource() on the URI resource failed. |
| 119 | fallbackColor = color; |
| 120 | return uriResource; |
| 121 | } |
| 122 | |
| 123 | void LegacyRenderSVGResource::removeAllClientsFromCacheAndMarkForInvalidation(bool markForInvalidation) |
| 124 | { |
| 125 | SingleThreadWeakHashSet<RenderObject> visitedRenderers; |
| 126 | removeAllClientsFromCacheAndMarkForInvalidationIfNeeded(markForInvalidation, &visitedRenderers); |
| 127 | } |
| 128 | |
| 129 | LegacyRenderSVGResource* LegacyRenderSVGResource::fillPaintingResource(RenderElement& renderer, const RenderStyle& style, Color& fallbackColor) |
| 130 | { |
| 131 | return requestPaintingResource(RenderSVGResourceMode::ApplyToFill, renderer, style, fallbackColor); |
| 132 | } |
| 133 | |
| 134 | LegacyRenderSVGResource* LegacyRenderSVGResource::strokePaintingResource(RenderElement& renderer, const RenderStyle& style, Color& fallbackColor) |
| 135 | { |
| 136 | return requestPaintingResource(RenderSVGResourceMode::ApplyToStroke, renderer, style, fallbackColor); |
| 137 | } |
| 138 | |
| 139 | LegacyRenderSVGResourceSolidColor* LegacyRenderSVGResource::sharedSolidPaintingResource() |
| 140 | { |
| 141 | static LegacyRenderSVGResourceSolidColor* s_sharedSolidPaintingResource = 0; |
| 142 | if (!s_sharedSolidPaintingResource) |
| 143 | s_sharedSolidPaintingResource = new LegacyRenderSVGResourceSolidColor; |
| 144 | return s_sharedSolidPaintingResource; |
| 145 | } |
| 146 | |
| 147 | static void removeFromCacheAndInvalidateDependencies(RenderElement& renderer, bool needsLayout, SingleThreadWeakHashSet<RenderObject>* visitedRenderers) |
| 148 | { |
| 149 | if (auto* resources = SVGResourcesCache::cachedResourcesForRenderer(renderer)) { |
| 150 | if (LegacyRenderSVGResourceFilter* filter = resources->filter()) |
| 151 | filter->removeClientFromCacheAndMarkForInvalidation(renderer); |
| 152 | |
| 153 | if (LegacyRenderSVGResourceMasker* masker = resources->masker()) |
| 154 | masker->removeClientFromCacheAndMarkForInvalidation(renderer); |
| 155 | |
| 156 | if (LegacyRenderSVGResourceClipper* clipper = resources->clipper()) |
| 157 | clipper->removeClientFromCacheAndMarkForInvalidation(renderer); |
| 158 | } |
| 159 | |
| 160 | auto svgElement = dynamicDowncast<SVGElement>(protect(renderer.element())); |
| 161 | if (!svgElement) |
| 162 | return; |
| 163 | |
| 164 | for (auto& element : svgElement->referencingElements()) { |
| 165 | if (auto* renderer = element->renderer()) { |
| 166 | // We allow cycles in SVGDocumentExtensions reference sets in order to avoid expensive |
| 167 | // reference graph adjustments on changes, so we need to break possible cycles here. |
| 168 | static NeverDestroyed<WeakHashSet<SVGElement, WeakPtrImplWithEventTargetData>> invalidatingDependencies; |
| 169 | if (!invalidatingDependencies.get().add(element.get()).isNewEntry) [[unlikely]] { |
| 170 | // Reference cycle: we are in process of invalidating this dependant. |
| 171 | continue; |
| 172 | } |
| 173 | LegacyRenderSVGResource::markForLayoutAndParentResourceInvalidationIfNeeded(*renderer, needsLayout, visitedRenderers); |
| 174 | invalidatingDependencies.get().remove(element.get()); |
| 175 | } |
| 176 | } |
| 177 | |
| 178 | for (auto& cssClient : svgElement->referencingCSSClients()) { |
| 179 | if (!cssClient) |
| 180 | continue; |
| 181 | cssClient->resourceChanged(*svgElement); |
| 182 | } |
| 183 | } |
| 184 | |
| 185 | void LegacyRenderSVGResource::markForLayoutAndParentResourceInvalidation(RenderObject& object, bool needsLayout) |
| 186 | { |
| 187 | SingleThreadWeakHashSet<RenderObject> visitedRenderers; |
| 188 | markForLayoutAndParentResourceInvalidationIfNeeded(object, needsLayout, &visitedRenderers); |
| 189 | } |
| 190 | |
| 191 | void LegacyRenderSVGResource::markForLayoutAndParentResourceInvalidationIfNeeded(RenderObject& object, bool needsLayout, SingleThreadWeakHashSet<RenderObject>* visitedRenderers) |
| 192 | { |
| 193 | ASSERT(object.node())((void)0); |
| 194 | if (object.document().settings().layerBasedSVGEngineEnabled()) { |
| 195 | RELEASE_ASSERT_NOT_REACHED()do { WTF::isIntegralOrPointerType(); compilerFenceForCrash(); WTFCrashWithInfo(195, "/Volumes/Data/worker/Apple-iOS-26-Safer-CPP-Checks-EWS/build/Source/WebCore/rendering/svg/legacy/LegacyRenderSVGResource.cpp" , __PRETTY_FUNCTION__ ); } while (false); |
| 196 | return; |
| 197 | } |
| 198 | |
| 199 | if (visitedRenderers) { |
| 200 | auto addResult = visitedRenderers->add(object); |
| 201 | if (!addResult.isNewEntry) |
| 202 | return; |
| 203 | } |
| 204 | |
| 205 | if (needsLayout && !object.renderTreeBeingDestroyed()) { |
| 206 | // If we are inside the layout of an LegacyRenderSVGRoot, do not cross the SVG boundary to |
| 207 | // invalidate the ancestor renderer because it may have finished its layout already. |
| 208 | if (CheckedPtr svgRoot = dynamicDowncast<LegacyRenderSVGRoot>(object); svgRoot && svgRoot->isInLayout()) |
| 209 | svgRoot->setNeedsLayout(MarkOnlyThis); |
| 210 | else { |
| 211 | if (CheckedPtr element = dynamicDowncast<RenderElement>(object)) { |
| 212 | auto svgRoot = SVGRenderSupport::findTreeRootObject(*element); |
| 213 | if (!svgRoot || !svgRoot->isInLayout()) |
| 214 | element->setNeedsLayout(MarkContainingBlockChain); |
| 215 | else { |
| 216 | // We just want to re-layout the ancestors up to the RenderSVGRoot. |
| 217 | element->setNeedsLayout(MarkOnlyThis); |
| 218 | for (auto current = element->parent(); current != svgRoot; current = current->parent()) |
| 219 | current->setNeedsLayout(MarkOnlyThis); |
| 220 | svgRoot->setNeedsLayout(MarkOnlyThis); |
| 221 | } |
| 222 | } else |
| 223 | object.setNeedsLayout(MarkOnlyThis); |
| 224 | } |
| 225 | } |
| 226 | |
| 227 | if (CheckedPtr element = dynamicDowncast<RenderElement>(object)) |
| 228 | removeFromCacheAndInvalidateDependencies(*element, needsLayout, visitedRenderers); |
| 229 | |
| 230 | // Invalidate resources in ancestor chain, if needed. |
| 231 | auto current = object.parent(); |
| 232 | while (current) { |
| 233 | removeFromCacheAndInvalidateDependencies(*current, needsLayout, visitedRenderers); |
| 234 | |
| 235 | if (CheckedPtr container = dynamicDowncast<LegacyRenderSVGResourceContainer>(*current)) { |
| 236 | // This will process the rest of the ancestors. |
| 237 | bool markForInvalidation = true; |
| 238 | container->removeAllClientsFromCacheAndMarkForInvalidationIfNeeded(markForInvalidation, visitedRenderers); |
| 239 | break; |
| 240 | } |
| 241 | |
| 242 | current = current->parent(); |
| 243 | } |
| 244 | } |
| 245 | |
| 246 | void LegacyRenderSVGResource::fillAndStrokePathOrShape(GraphicsContext& context, OptionSet<RenderSVGResourceMode> resourceMode, const Path* path, const RenderElement* shape) |
| 247 | { |
| 248 | if (shape) { |
| 249 | ASSERT(shape->isRenderOrLegacyRenderSVGShape())((void)0); |
| 250 | |
| 251 | if (resourceMode.contains(RenderSVGResourceMode::ApplyToFill)) { |
| 252 | if (CheckedPtr svgShape = dynamicDowncast<LegacyRenderSVGShape>(shape)) |
| 253 | svgShape->fillShape(context); |
| 254 | else if (CheckedPtr svgShape = dynamicDowncast<RenderSVGShape>(shape)) |
| 255 | svgShape->fillShape(context); |
| 256 | } |
| 257 | |
| 258 | if (resourceMode.contains(RenderSVGResourceMode::ApplyToStroke)) { |
| 259 | if (CheckedPtr svgShape = dynamicDowncast<LegacyRenderSVGShape>(shape)) |
| 260 | svgShape->strokeShape(context); |
| 261 | else if (CheckedPtr svgShape = dynamicDowncast<RenderSVGShape>(shape)) |
| 262 | svgShape->strokeShape(context); |
| 263 | } |
| 264 | |
| 265 | return; |
| 266 | } |
| 267 | |
| 268 | if (!path) |
| 269 | return; |
| 270 | |
| 271 | if (resourceMode.contains(RenderSVGResourceMode::ApplyToFill)) |
| 272 | context.fillPath(*path); |
| 273 | if (resourceMode.contains(RenderSVGResourceMode::ApplyToStroke)) |
| 274 | context.strokePath(*path); |
| 275 | } |
| 276 | |
| 277 | } |