Changeset 39149 in webkit


Ignore:
Timestamp:
Dec 9, 2008 3:36:39 PM (15 years ago)
Author:
weinig@apple.com
Message:

2008-12-09 Sam Weinig <sam@webkit.org>

Reviewed by Darin Adler.

Fix intermittent crash in buildbot. The CSSCursorImageValues and
SVGCursorElements held onto raw SVGElement pointers without any
guarantee that the element is still around.

We did not fix the design that resulted in this issue, we just fixed
the pointer lifetimes.

  • css/CSSCursorImageValue.cpp: (WebCore::CSSCursorImageValue::~CSSCursorImageValue): Zero out the back pointers. (WebCore::CSSCursorImageValue::updateIfSVGCursorIsUsed): Set up a back pointer. (WebCore::CSSCursorImageValue::removeReferencedElement): Added. Used when the element is destroyed.
  • css/CSSCursorImageValue.h: Added removeReferencedElement.
  • svg/SVGCursorElement.cpp: (WebCore::SVGCursorElement::~SVGCursorElement): Zero out the back pointers. (WebCore::SVGCursorElement::addClient): Set up a back pointer. (WebCore::SVGCursorElement::removeClient): Zero out the back pointer.
  • svg/SVGElement.cpp: (WebCore::SVGElement::SVGElement): Initialize back pointers to zero. (WebCore::SVGElement::~SVGElement): Call both the element and cursor image value to remove the element from their sets.
  • svg/SVGElement.h: (WebCore::SVGElement::setCursorElement): Added. (WebCore::SVGElement::setCursorImageValue): Added.
Location:
trunk/WebCore
Files:
6 edited

Legend:

Unmodified
Added
Removed
  • trunk/WebCore/ChangeLog

    r39146 r39149  
     12008-12-09  Sam Weinig  <sam@webkit.org>
     2
     3        Reviewed by Darin Adler.
     4
     5        Fix intermittent crash in buildbot. The CSSCursorImageValues and
     6        SVGCursorElements held onto raw SVGElement pointers without any
     7        guarantee that the element is still around.
     8
     9        We did not fix the design that resulted in this issue, we just fixed
     10        the pointer lifetimes.
     11
     12        * css/CSSCursorImageValue.cpp:
     13        (WebCore::CSSCursorImageValue::~CSSCursorImageValue): Zero out the back pointers.
     14        (WebCore::CSSCursorImageValue::updateIfSVGCursorIsUsed): Set up a back pointer.
     15        (WebCore::CSSCursorImageValue::removeReferencedElement): Added. Used when the element
     16        is destroyed.
     17        * css/CSSCursorImageValue.h: Added removeReferencedElement.
     18
     19        * svg/SVGCursorElement.cpp:
     20        (WebCore::SVGCursorElement::~SVGCursorElement): Zero out the back pointers.
     21        (WebCore::SVGCursorElement::addClient): Set up a back pointer.
     22        (WebCore::SVGCursorElement::removeClient): Zero out the back pointer.
     23
     24        * svg/SVGElement.cpp:
     25        (WebCore::SVGElement::SVGElement): Initialize back pointers to zero.
     26        (WebCore::SVGElement::~SVGElement): Call both the element and cursor image value
     27        to remove the element from their sets.
     28        * svg/SVGElement.h:
     29        (WebCore::SVGElement::setCursorElement): Added.
     30        (WebCore::SVGElement::setCursorImageValue): Added.
     31
    1322008-12-09  David Hyatt  <hyatt@apple.com>
    233
  • trunk/WebCore/css/CSSCursorImageValue.cpp

    r36700 r39149  
    7171    for (; it != end; ++it) {
    7272        SVGElement* referencedElement = *it;
     73        referencedElement->setCursorImageValue(0);
    7374        if (SVGCursorElement* cursorElement = resourceReferencedByCursorElement(url, referencedElement->document()))
    7475            cursorElement->removeClient(referencedElement);
     
    99100        SVGElement* svgElement = static_cast<SVGElement*>(element);
    100101        m_referencedElements.add(svgElement);
     102        svgElement->setCursorImageValue(this);
    101103        cursorElement->addClient(svgElement);
    102104        return true;
     
    121123}
    122124
     125#if ENABLE(SVG)
     126void CSSCursorImageValue::removeReferencedElement(SVGElement* element)
     127{
     128    m_referencedElements.remove(element);
     129}
     130#endif
     131
    123132} // namespace WebCore
  • trunk/WebCore/css/CSSCursorImageValue.h

    r34627 r39149  
    4545    virtual StyleCachedImage* cachedImage(DocLoader*);
    4646
     47#if ENABLE(SVG)
     48    void removeReferencedElement(SVGElement*);
     49#endif
     50
    4751private:
    4852    CSSCursorImageValue(const String& url, const IntPoint& hotspot);
  • trunk/WebCore/svg/SVGCursorElement.cpp

    r39065 r39149  
    4545SVGCursorElement::~SVGCursorElement()
    4646{
     47    HashSet<SVGElement*>::iterator end = m_clients.end();
     48    for (HashSet<SVGElement*>::iterator it = m_clients.begin(); it != end; ++it)
     49        (*it)->setCursorElement(0);
    4750}
    4851
     
    6871{
    6972    m_clients.add(element);
     73    element->setCursorElement(this);
    7074}
    7175
     
    7377{
    7478    m_clients.remove(element);
     79    element->setCursorElement(0);
    7580}
    7681
  • trunk/WebCore/svg/SVGElement.cpp

    r38094 r39149  
    2626#include "SVGElement.h"
    2727
     28#include "CSSCursorImageValue.h"
    2829#include "DOMImplementation.h"
    2930#include "Document.h"
     
    3435#include "HTMLNames.h"
    3536#include "PlatformString.h"
     37#include "RegisteredEventListener.h"
    3638#include "RenderObject.h"
     39#include "SVGCursorElement.h"
    3740#include "SVGDocumentExtensions.h"
    3841#include "SVGElementInstance.h"
     
    4346#include "SVGUseElement.h"
    4447#include "XMLNames.h"
    45 #include "RegisteredEventListener.h"
    4648
    4749namespace WebCore {
     
    5254    : StyledElement(tagName, doc)
    5355    , m_shadowParent(0)
     56    , m_cursorElement(0)
     57    , m_cursorImageValue(0)
    5458{
    5559}
     
    5761SVGElement::~SVGElement()
    5862{
     63    if (m_cursorElement)
     64        m_cursorElement->removeClient(this);
     65    if (m_cursorImageValue)
     66        m_cursorImageValue->removeReferencedElement(this);
    5967}
    6068
  • trunk/WebCore/svg/SVGElement.h

    r36823 r39149  
    3232
    3333    class AffineTransform;
     34    class CSSCursorImageValue;
    3435    class Document;
     36    class SVGCursorElement;
     37    class SVGDocumentExtensions;
    3538    class SVGElementInstance;
    36     class SVGDocumentExtensions;
    3739    class SVGSVGElement;
    3840
     
    118120        }
    119121
     122        void setCursorElement(SVGCursorElement* cursorElement) { m_cursorElement = cursorElement; }
     123        void setCursorImageValue(CSSCursorImageValue* cursorImageValue) { m_cursorImageValue = cursorImageValue; }
     124
    120125    private:
    121126        friend class SVGElementInstance;
     
    129134        mutable HashMap<String, const SVGAnimatedPropertyBase*> m_svgPropertyMap;
    130135
     136        SVGCursorElement* m_cursorElement;
     137        CSSCursorImageValue* m_cursorImageValue;
     138
    131139        HashSet<SVGElementInstance*> m_elementInstances;
    132140    };
Note: See TracChangeset for help on using the changeset viewer.