Changeset 109391 in webkit

Timestamp:

Mar 1, 2012, 12:29:47 PM (15 years ago)

Author:

cevans@google.com

Message:

Merge 109345
BUG=116093
Review URL: ​https://chromiumcodereview.appspot.com/9562022

Location:

branches/chromium/1025

Files:

• LayoutTests/svg/animations/resources/smil-element-target-crash.svg (copied) (copied from trunk/LayoutTests/svg/animations/resources/smil-element-target-crash.svg )
• LayoutTests/svg/animations/smil-element-target-crash-main-expected.txt (copied) (copied from trunk/LayoutTests/svg/animations/smil-element-target-crash-main-expected.txt )
• LayoutTests/svg/animations/smil-element-target-crash-main.html (copied) (copied from trunk/LayoutTests/svg/animations/smil-element-target-crash-main.html )
• Source/WebCore/svg/animation/SVGSMILElement.cpp (modified) (1 diff)

branches/chromium/1025/Source/WebCore/svg/animation/SVGSMILElement.cpp

@@ -216 +216 @@
         m_timeContainer = 0;
     }
-    if (m_targetElement) {
-        document()->accessSVGExtensions()->removeAnimationElementFromTarget(this, m_targetElement);
-        m_targetElement = 0;
-    }
     // Calling disconnectConditions() may kill us if there are syncbase conditions.
     // OK, but we don't want to die inside the call.
     RefPtr<SVGSMILElement> keepAlive(this);
     disconnectConditions();
+
+    // Clear target now, because disconnectConditions calls targetElement() which will recreate the target if we removed it sooner. 
+    if (m_targetElement) {
+        document()->accessSVGExtensions()->removeAnimationElementFromTarget(this, m_targetElement);
+        m_targetElement = 0;
+    }
+
     SVGElement::removedFromDocument();
 }