Don't transfer viewport to an invalid/dirty <use> instance

Source/core/svg/SVGUseElement.cpp

 /*
  * Copyright (C) 2004, 2005, 2006, 2007, 2008 Nikolas Zimmermann <zimmermann@kde.org>
  * Copyright (C) 2004, 2005, 2006, 2007 Rob Buis <buis@kde.org>
  * Copyright (C) Research In Motion Limited 2009-2010. All rights reserved.
  * Copyright (C) 2011 Torch Mobile (Beijing) Co. Ltd. All rights reserved.
  * Copyright (C) 2012 University of Szeged
  * Copyright (C) 2012 Renata Hodovan <reni@webkit.org>
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ skipping 62 matching lines @@
     // Always build a user agent #shadow-root for SVGUseElement.
     RefPtrWillBeRawPtr<SVGUseElement> use = adoptRefWillBeNoop(new SVGUseElement(document));
     use->ensureUserAgentShadowRoot();
     return use.release();
 }
 
 SVGUseElement::~SVGUseElement()
 {
     setDocumentResource(0);
 #if !ENABLE(OILPAN)
-    clearResourceReferences();
+    clearShadowTree();
+    cancelShadowTreeRecreation();
 #endif
     svgUseLoadEventSender().cancelEvent(this);
 }
 
 DEFINE_TRACE(SVGUseElement)
 {
     visitor->trace(m_x);
     visitor->trace(m_y);
     visitor->trace(m_width);
     visitor->trace(m_height);
@@ skipping 19 matching lines @@
         return InsertionDone;
     ASSERT(!m_targetElementInstance || !isWellFormedDocument(&document()));
     ASSERT(!hasPendingResources() || !isWellFormedDocument(&document()));
     invalidateShadowTree();
     return InsertionDone;
 }
 
 void SVGUseElement::removedFrom(ContainerNode* rootParent)
 {
     SVGGraphicsElement::removedFrom(rootParent);
-    if (rootParent->inDocument())
-        clearResourceReferences();
+    if (rootParent->inDocument()) {
+        clearShadowTree();
+        cancelShadowTreeRecreation();
+    }
 }
 
 TreeScope* SVGUseElement::referencedScope() const
 {
     if (isStructurallyExternal())
         return externalDocument();
     return &treeScope();
 }
 
 Document* SVGUseElement::externalDocument() const
@@ skipping 160 matching lines @@
 }
 
 void SVGUseElement::scheduleShadowTreeRecreation()
 {
     if (inUseShadowTree())
         return;
     m_needsShadowTreeRecreation = true;
     document().scheduleUseShadowTreeUpdate(*this);
 }
 
-void SVGUseElement::clearResourceReferences()
+void SVGUseElement::cancelShadowTreeRecreation()
+{
+    m_needsShadowTreeRecreation = false;
+    document().unscheduleUseShadowTreeUpdate(*this);
+}
+
+void SVGUseElement::clearInstanceRoot()
 {
     if (m_targetElementInstance)
         m_targetElementInstance = nullptr;
+}
+
+void SVGUseElement::clearShadowTree()
+{
+    clearInstanceRoot();
 
     // FIXME: We should try to optimize this, to at least allow partial reclones.
     if (ShadowRoot* shadowTreeRootElement = userAgentShadowRoot())
         shadowTreeRootElement->removeChildren(OmitSubtreeModifiedEvent);
 
-    m_needsShadowTreeRecreation = false;
-    document().unscheduleUseShadowTreeUpdate(*this);
-
     removeAllOutgoingReferences();
 }
 
 void SVGUseElement::buildPendingResource()
 {
     if (inUseShadowTree())
         return;
-    clearResourceReferences();
+    clearShadowTree();
+    cancelShadowTreeRecreation();
     if (!referencedScope() || !inDocument())
         return;
 
     AtomicString id;
     Element* target = SVGURIReference::targetElementFromIRIString(hrefString(), treeScope(), &id, externalDocument());
     if (!target || !target->inDocument()) {
         // If we can't find the target of an external element, just give up.
         // We can't observe if the target somewhen enters the external document, nor should we do it.
         if (externalDocument())
             return;
@@ skipping 26 matching lines @@
         data->eventListenerMap.copyEventListenersNotCreatedFromMarkupToTarget(clone.get());
     TrackExceptionState exceptionState;
     for (Node* node = toClone.firstChild(); node && !exceptionState.hadException(); node = node->nextSibling())
         clone->appendChild(cloneNodeAndAssociate(*node), exceptionState);
     return clone.release();
 }
 
 void SVGUseElement::buildShadowAndInstanceTree(SVGElement* target)
 {
     ASSERT(!m_targetElementInstance);
+    ASSERT(!m_needsShadowTreeRecreation);
 
     // <use> creates a "user agent" shadow root. Do not build the shadow/instance tree for <use>
     // elements living in a user agent shadow tree because they will get expanded in a second
     // pass -- see expandUseElementsInShadowTree().
     if (inUseShadowTree())
         return;
 
     // Do not allow self-referencing.
     // 'target' may be null, if it's a non SVG namespaced element.
     if (!target || target == this || isDisallowedElement(target))
         return;
 
     // Set up root SVG element in shadow tree.
     RefPtrWillBeRawPtr<Element> newChild = target->cloneElementWithoutChildren();
     m_targetElementInstance = toSVGElement(newChild.get());
     ShadowRoot* shadowTreeRootElement = userAgentShadowRoot();
     shadowTreeRootElement->appendChild(newChild.release());
 
     // Clone the target subtree into the shadow tree, not handling <use> and <symbol> yet.
 
     // SVG specification does not say a word about <use> & cycles. My view on this is: just ignore it!
     // Non-appearing <use> content is easier to debug, then half-appearing content.
     if (!buildShadowTree(target, m_targetElementInstance.get(), false)) {
-        clearResourceReferences();
+        clearShadowTree();
         return;
     }
 
     if (instanceTreeIsLoading(m_targetElementInstance.get()))
         return;
 
     // Assure shadow tree building was successfull
     ASSERT(m_targetElementInstance);
     ASSERT(m_targetElementInstance->correspondingUseElement() == this);
     ASSERT(m_targetElementInstance->correspondingElement() == target);
 
     // Expand all <use> elements in the shadow tree.
     // Expand means: replace the actual <use> element by what it references.
     if (!expandUseElementsInShadowTree(m_targetElementInstance.get())) {
-        clearResourceReferences();
+        clearShadowTree();
         return;
     }
 
     // Expand all <symbol> elements in the shadow tree.
     // Expand means: replace the actual <symbol> element by the <svg> element.
     expandSymbolElementsInShadowTree(toSVGElement(shadowTreeRootElement->firstChild()));
 
     m_targetElementInstance = toSVGElement(shadowTreeRootElement->firstChild());
     transferUseWidthAndHeightIfNeeded(*this, m_targetElementInstance.get(), *m_targetElementInstance->correspondingElement());
 
@@ skipping 258 matching lines @@
     }
 
     for (RefPtrWillBeRawPtr<SVGElement> child = Traversal<SVGElement>::firstChild(*element); child; child = Traversal<SVGElement>::nextSibling(*child))
         expandSymbolElementsInShadowTree(child.get());
 }
 
 void SVGUseElement::invalidateShadowTree()
 {
     if (!inActiveDocument() || m_needsShadowTreeRecreation)
         return;
+    clearInstanceRoot();
     scheduleShadowTreeRecreation();
     invalidateDependentShadowTrees();
 }
 
 void SVGUseElement::invalidateDependentShadowTrees()
 {
     // Recursively invalidate dependent <use> shadow trees
     const WillBeHeapHashSet<RawPtrWillBeWeakMember<SVGElement>>& instances = instancesForElement();
     for (SVGElement* instance : instances) {
         if (SVGUseElement* element = instance->correspondingUseElement()) {
@@ skipping 84 matching lines @@
 
     if (m_resource)
         m_resource->removeClient(this);
 
     m_resource = resource;
     if (m_resource)
         m_resource->addClient(this);
 }
 
 }