Changeset 117792 in webkit

Timestamp:

May 21, 2012, 9:19:58 AM (14 years ago)

Author:

schenney@chromium.org

Message:

SVGAnimatedPropertyTearOff does not clear a self pointer on deletion
​https://bugs.webkit.org/show_bug.cgi?id=86119

Reviewed by Nikolas Zimmermann.

Source/WebCore:

SVGAnimatedPropertyTearOff contains two SVGPropertyTearOff objects
that have a pointer back to the SVGAnimatedPropertyTearOff. JS may
also have a reference to these SVGPropertyTearOff objects. When the
SVGAnimatedPropertyTearOff is deleted, the SVGPropertyTearOff objects
may live on, but the pointer back to the deleted animated property
tear off is left invalid. This patch clears the pointers on destruction
of the SVGAnimatedPropertyTearOff.

Test: svg/custom/bug86119.html

• svg/properties/SVGAnimatedPropertyTearOff.h:

(WebCore::SVGAnimatedPropertyTearOff::~SVGAnimatedPropertyTearOff):
(SVGAnimatedPropertyTearOff):

LayoutTests:

• svg/custom/bug86119.html: Added.
• svg/custom/bug86119-expected.txt: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/svg/custom/bug86119-expected.txt (added)
• LayoutTests/svg/custom/bug86119.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/svg/properties/SVGAnimatedPropertyTearOff.h (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2012-05-21  Stephen Chenney  <schenney@chromium.org>
+
+        SVGAnimatedPropertyTearOff does not clear a self pointer on deletion
+        https://bugs.webkit.org/show_bug.cgi?id=86119
+
+        Reviewed by Nikolas Zimmermann.
+
+        * svg/custom/bug86119.html: Added.
+        * svg/custom/bug86119-expected.txt: Added.
+
 2012-05-21  Luke Macpherson  <macpherson@chromium.org>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2012-05-21  Stephen Chenney  <schenney@chromium.org>
+
+        SVGAnimatedPropertyTearOff does not clear a self pointer on deletion
+        https://bugs.webkit.org/show_bug.cgi?id=86119
+
+        Reviewed by Nikolas Zimmermann.
+
+        SVGAnimatedPropertyTearOff contains two SVGPropertyTearOff objects
+        that have a pointer back to the SVGAnimatedPropertyTearOff. JS may
+        also have a reference to these SVGPropertyTearOff objects. When the
+        SVGAnimatedPropertyTearOff is deleted, the SVGPropertyTearOff objects
+        may live on, but the pointer back to the deleted animated property
+        tear off is left invalid. This patch clears the pointers on destruction
+        of the SVGAnimatedPropertyTearOff.
+
+        Test: svg/custom/bug86119.html
+
+        * svg/properties/SVGAnimatedPropertyTearOff.h:
+        (WebCore::SVGAnimatedPropertyTearOff::~SVGAnimatedPropertyTearOff):
+        (SVGAnimatedPropertyTearOff):
+
 2012-05-21  Stephen Chenney  <schenney@chromium.org>
 

trunk/Source/WebCore/svg/properties/SVGAnimatedPropertyTearOff.h

@@ -32 +32 @@
     typedef SVGPropertyTearOff<PropertyType> PropertyTearOff;
     typedef PropertyType ContentType;
+
+    virtual ~SVGAnimatedPropertyTearOff()
+    {
+        if (m_baseVal) {
+            ASSERT(m_baseVal->animatedProperty() == this);
+            m_baseVal->setAnimatedProperty(0);
+        }
+        if (m_animVal) {
+            ASSERT(m_animVal->animatedProperty() == this);
+            m_animVal->setAnimatedProperty(0);
+        }
+    }
 
     PropertyTearOff* baseVal()