Don't expand <symbol> elements in <use> that are not targets

third_party/WebKit/Source/core/svg/SVGUseElement.cpp

 /*
  * Copyright (C) 2004, 2005, 2006, 2007, 2008 Nikolas Zimmermann <zimmermann@kde.org>
  * Copyright (C) 2004, 2005, 2006, 2007 Rob Buis <buis@kde.org>
  * Copyright (C) Research In Motion Limited 2009-2010. All rights reserved.
  * Copyright (C) 2011 Torch Mobile (Beijing) Co. Ltd. All rights reserved.
  * Copyright (C) 2012 University of Szeged
  * Copyright (C) 2012 Renata Hodovan <reni@webkit.org>
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ skipping 362 matching lines @@
             Element* next = ElementTraversal::nextSkippingChildren(*element, &subtree);
             // The subtree is not in document so this won't generate events that could mutate the tree.
             element->parentNode()->removeChild(element);
             element = next;
         } else {
             element = ElementTraversal::next(*element, &subtree);
         }
     }
 }
 
+static void moveChildrenToReplacementElement(ContainerNode& sourceRoot, ContainerNode& destinationRoot)
+{
+    for (RefPtrWillBeRawPtr<Node> child = sourceRoot.firstChild(); child; ) {
+        RefPtrWillBeRawPtr<Node> nextChild = child->nextSibling();
+        destinationRoot.appendChild(child);
+        child = nextChild.release();
+    }
+}
+
 PassRefPtrWillBeRawPtr<Element> SVGUseElement::createInstanceTree(SVGElement& targetRoot) const
 {
     RefPtrWillBeRawPtr<Element> instanceRoot = targetRoot.cloneElementWithChildren();
     ASSERT(instanceRoot->isSVGElement());
+    if (isSVGSymbolElement(targetRoot)) {
+        // Spec: The referenced 'symbol' and its contents are deep-cloned into
+        // the generated tree, with the exception that the 'symbol' is replaced
+        // by an 'svg'. This generated 'svg' will always have explicit values
+        // for attributes width and height. If attributes width and/or height
+        // are provided on the 'use' element, then these attributes will be
+        // transferred to the generated 'svg'. If attributes width and/or
+        // height are not specified, the generated 'svg' element will use
+        // values of 100% for these attributes.
+        RefPtrWillBeRawPtr<SVGSVGElement> svgElement = SVGSVGElement::create(targetRoot.document());
+        // Transfer all data (attributes, etc.) from the <symbol> to the new
+        // <svg> element.
+        svgElement->cloneDataFromElement(*instanceRoot);
+        // Move already cloned elements to the new <svg> element.
+        moveChildrenToReplacementElement(*instanceRoot, *svgElement);
+        instanceRoot = svgElement.release();
+    }
+    transferUseWidthAndHeightIfNeeded(*this, toSVGElement(*instanceRoot), targetRoot);
     associateCorrespondingElements(targetRoot, toSVGElement(*instanceRoot));
     removeDisallowedElementsFromSubtree(toSVGElement(*instanceRoot));
     return instanceRoot.release();
 }
 
 void SVGUseElement::buildShadowAndInstanceTree(SVGElement& target)
 {
     ASSERT(!m_targetElementInstance);
     ASSERT(!m_needsShadowTreeRecreation);
 
@@ skipping 26 matching lines @@
     ASSERT(m_targetElementInstance->correspondingUseElement() == this);
     ASSERT(m_targetElementInstance->correspondingElement() == &target);
 
     // Expand all <use> elements in the shadow tree.
     // Expand means: replace the actual <use> element by what it references.
     if (!expandUseElementsInShadowTree()) {
         clearShadowTree();
         return;
     }
 
-    // Expand all <symbol> elements in the shadow tree.
-    // Expand means: replace the actual <symbol> element by the <svg> element.
-    expandSymbolElementsInShadowTree();
+    // If the instance root was a <use>, it could have been replaced now, so
+    // reset |m_targetElementInstance|.
+    m_targetElementInstance = toSVGElement(shadowTreeRootElement->firstChild());
+    ASSERT(m_targetElementInstance->parentNode() == shadowTreeRootElement);
 
-    m_targetElementInstance = toSVGElement(shadowTreeRootElement->firstChild());
-    transferUseWidthAndHeightIfNeeded(*this, *m_targetElementInstance, *m_targetElementInstance->correspondingElement());
     cloneNonMarkupEventListeners();
 
-    ASSERT(m_targetElementInstance->parentNode() == shadowTreeRootElement);
-
     // Update relative length information.
     updateRelativeLengthsInformation();
 }
 
 LayoutObject* SVGUseElement::createLayoutObject(const ComputedStyle&)
 {
     return new LayoutSVGTransformableContainer(this);
 }
 
 static bool isDirectReference(const SVGElement& element)
@@ skipping 90 matching lines @@
     while (instance && instance->isSVGElement()) {
         SVGElement* element = toSVGElement(instance);
         if (element->hasID() && element->getIdAttribute() == targetId && element->document() == newTarget->document())
             return true;
 
         instance = instance->parentNode();
     }
     return false;
 }
 
-static void moveChildrenToReplacementElement(ContainerNode& sourceRoot, ContainerNode& destinationRoot)
-{
-    for (RefPtrWillBeRawPtr<Node> child = sourceRoot.firstChild(); child; ) {
-        RefPtrWillBeRawPtr<Node> nextChild = child->nextSibling();
-        destinationRoot.appendChild(child);
-        child = nextChild.release();
-    }
-}
-
 // Spec: In the generated content, the 'use' will be replaced by 'g', where all
 // attributes from the 'use' element except for x, y, width, height and
 // xlink:href are transferred to the generated 'g' element.
 static void removeAttributesFromReplacementElement(SVGElement& replacementElement)
 {
     replacementElement.removeAttribute(SVGNames::xAttr);
     replacementElement.removeAttribute(SVGNames::yAttr);
     replacementElement.removeAttribute(SVGNames::widthAttr);
     replacementElement.removeAttribute(SVGNames::heightAttr);
     replacementElement.removeAttribute(SVGNames::hrefAttr);
@@ skipping 25 matching lines @@
         RefPtrWillBeRawPtr<SVGGElement> cloneParent = SVGGElement::create(originalUse.document());
         // Transfer all data (attributes, etc.) from <use> to the new <g> element.
         cloneParent->cloneDataFromElement(*use);
         cloneParent->setCorrespondingElement(&originalUse);
 
         removeAttributesFromReplacementElement(*cloneParent);
 
         // Move already cloned elements to the new <g> element.
         moveChildrenToReplacementElement(*use, *cloneParent);
 
-        if (target) {
-            RefPtrWillBeRawPtr<Element> instanceRoot = use->createInstanceTree(*target);
-            transferUseWidthAndHeightIfNeeded(*use, toSVGElement(*instanceRoot), *target);
-            cloneParent->appendChild(instanceRoot.release());
-        }
+        if (target)
+            cloneParent->appendChild(use->createInstanceTree(*target));
 
         RefPtrWillBeRawPtr<SVGElement> replacingElement(cloneParent.get());
 
         // Replace <use> with referenced content.
         use->parentNode()->replaceChild(cloneParent.release(), use);
 
         use = Traversal<SVGUseElement>::next(*replacingElement, shadowRoot);
     }
     return true;
 }
 
-void SVGUseElement::expandSymbolElementsInShadowTree()
-{
-    ShadowRoot* shadowRoot = userAgentShadowRoot();
-    for (RefPtrWillBeRawPtr<SVGSymbolElement> symbol = Traversal<SVGSymbolElement>::firstWithin(*shadowRoot); symbol; ) {
-        // Spec: The referenced 'symbol' and its contents are deep-cloned into the generated tree,
-        // with the exception that the 'symbol' is replaced by an 'svg'. This generated 'svg' will
-        // always have explicit values for attributes width and height. If attributes width and/or
-        // height are provided on the 'use' element, then these attributes will be transferred to
-        // the generated 'svg'. If attributes width and/or height are not specified, the generated
-        // 'svg' element will use values of 100% for these attributes.
-        SVGElement& originalSymbol = *symbol->correspondingElement();
-        RefPtrWillBeRawPtr<SVGSVGElement> svgElement = SVGSVGElement::create(originalSymbol.document());
-        // Transfer all data (attributes, etc.) from <symbol> to the new <svg> element.
-        svgElement->cloneDataFromElement(*symbol);
-        svgElement->setCorrespondingElement(&originalSymbol);
-
-        // Move already cloned elements to the new <svg> element.
-        moveChildrenToReplacementElement(*symbol, *svgElement);
-
-        RefPtrWillBeRawPtr<SVGElement> replacingElement(svgElement.get());
-
-        // Replace <symbol> with <svg>.
-        symbol->parentNode()->replaceChild(svgElement.release(), symbol);
-
-        symbol = Traversal<SVGSymbolElement>::next(*replacingElement, shadowRoot);
-    }
-}
-
 void SVGUseElement::invalidateShadowTree()
 {
     if (!inActiveDocument() || m_needsShadowTreeRecreation)
         return;
     clearInstanceRoot();
     scheduleShadowTreeRecreation();
     invalidateDependentShadowTrees();
 }
 
 void SVGUseElement::invalidateDependentShadowTrees()
@@ skipping 103 matching lines @@
 
     if (m_resource)
         m_resource->removeClient(this);
 
     m_resource = resource;
     if (m_resource)
         m_resource->addClient(this);
 }
 
 } // namespace blink