serenity icon indicating copy to clipboard operation
serenity copied to clipboard

LibWeb: Crash on SVG clip-path reference to other SVG tree with display:none

Open awesomekling opened this issue 1 year ago • 1 comments

This is a reduction of https://github.com/awesomekling that currently crashes due to a bogus layout tree.

As I understand it, url(#jeez) in the second <svg> tree should not see the <clippath id="jeez"> in the first <svg> tree. In other words, ID references should be local to the current SVGSVGElement.

<!doctype html>
<svg style="display: none">
    <clippath id="jeez">
        <rect width="16" height="16"></rect>
    </clippath>
</svg>
<svg>
    <g clip-path="url(#jeez)"></g>
</svg>

cc @MacDue

awesomekling avatar Apr 22 '24 11:04 awesomekling

I don't think the clipPath elements need to be local to the SVG, the following example works in Chrome and Firefox (and I see nothing disallowing it within the spec):

<!doctype html>
<svg>
    <clippath id="jeez">
      <circle cx="50" cy="50" r="50" />
    </clippath>
</svg>
<svg>
    <g clip-path="url(#jeez)">
      <rect fill="red" width="100" height="100">
      </rect>
    </g>
</svg>

If you place display: none on the first SVG then the clip path does nothing in the second SVG. LibWeb only crashes when display: none is set on the first SVG, with it removed it does not crash, but the clipping is incorrect.

MacDue avatar Apr 25 '24 20:04 MacDue

Both the crash & painting issues are now fixed :)

MacDue avatar May 04 '24 19:05 MacDue