Changeset 110591 in webkit

Timestamp:

Mar 13, 2012 12:27:51 PM (12 years ago)

Author:

Nikolas Zimmermann

Message:

SVG Animations update baseVal instead of animVal
​https://bugs.webkit.org/show_bug.cgi?id=12437

Reviewed by Dirk Schulze.

Blind fix for some GC related assertions firing on v8.

Assure that animationStarted/animationEnded calls are happening
on the same SVGAnimatedProperty. Always call animationEnded(),
even if we shouldn't do anything for the target element, as its
destructed, as we still have to reset m_isAnimating.

• svg/SVGAnimateElement.cpp:

(WebCore::SVGAnimateElement::SVGAnimateElement):
(WebCore::SVGAnimateElement::resetToBaseValue):
(WebCore::SVGAnimateElement::targetElementWillChange):

• svg/SVGAnimateElement.h:

(SVGAnimateElement):

• svg/properties/SVGAnimatedPropertyTearOff.h:

(WebCore::SVGAnimatedPropertyTearOff::animationEnded):

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• svg/SVGAnimateElement.cpp (modified) (3 diffs)
• svg/SVGAnimateElement.h (modified) (2 diffs)
• svg/properties/SVGAnimatedPropertyTearOff.h (modified) (1 diff)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2012-03-13  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        SVG Animations update baseVal instead of animVal
+        https://bugs.webkit.org/show_bug.cgi?id=12437
+
+        Reviewed by Dirk Schulze.
+
+        Blind fix for some GC related assertions firing on v8.
+
+        Assure that animationStarted/animationEnded calls are happening
+        on the same SVGAnimatedProperty. Always call animationEnded(),
+        even if we shouldn't do anything for the target element, as its
+        destructed, as we still have to reset m_isAnimating.
+
+        * svg/SVGAnimateElement.cpp:
+        (WebCore::SVGAnimateElement::SVGAnimateElement):
+        (WebCore::SVGAnimateElement::resetToBaseValue):
+        (WebCore::SVGAnimateElement::targetElementWillChange):
+        * svg/SVGAnimateElement.h:
+        (SVGAnimateElement):
+        * svg/properties/SVGAnimatedPropertyTearOff.h:
+        (WebCore::SVGAnimatedPropertyTearOff::animationEnded):
+
 2012-03-13  Mark Pilgrim  <pilgrim@chromium.org>
 

trunk/Source/WebCore/svg/SVGAnimateElement.cpp

@@ -42 +42 @@
     , m_fromPropertyValueType(RegularPropertyValue)
     , m_toPropertyValueType(RegularPropertyValue)
+    , m_animatedProperty(0)
 {
     ASSERT(hasTagName(SVGNames::animateTag) || hasTagName(SVGNames::setTag) || hasTagName(SVGNames::animateColorTag));
@@ -220 +221 @@
     // SVG DOM primitives, like SVGLength.
     SVGAnimatedTypeAnimator* animator = ensureAnimator();
-    if (SVGAnimatedProperty* animatedProperty = animatedPropertyForType(animator->type())) {
+    m_animatedProperty = animatedPropertyForType(animator->type());
+    if (m_animatedProperty) {
         if (!m_animatedType) {
-            m_animatedType = animator->constructFromCopy(animatedProperty->currentBaseValue(animator->type()));
-            animationStarted(animatedProperty, m_animatedType.get());
+            m_animatedType = animator->constructFromCopy(m_animatedProperty->currentBaseValue(animator->type()));
+            animationStarted(m_animatedProperty, m_animatedType.get());
         } else
-            m_animatedType->setVariantValue(animatedProperty->currentBaseValue(m_animator->type()));
+            m_animatedType->setVariantValue(m_animatedProperty->currentBaseValue(m_animator->type()));
         ASSERT(m_animatedPropertyType == animator->type());
+        ASSERT(m_animatedPropertyType == m_animatedProperty->animatedPropertyType());
         return;
     }
@@ -260 +263 @@
     SVGSMILElement::targetElementWillChange(currentTarget, newTarget);
 
-    // Be sure to never execute any of this, while the target element is being removed from the document or destructed.
-    if (currentTarget && currentTarget->inDocument() && currentTarget->parentNode()) {
-        ASSERT(!currentTarget->m_deletionHasBegun);
-        if (SVGAnimatedProperty* animatedProperty = animatedPropertyForType(m_animatedPropertyType))
-            animationEnded(animatedProperty);
+    if (m_animatedProperty) {
+        animationEnded(m_animatedProperty);
+        m_animatedProperty = 0;
     }
 

trunk/Source/WebCore/svg/SVGAnimateElement.h

@@ -41 +41 @@
 };
 
+class SVGAnimatedProperty;
+
 class SVGAnimateElement : public SVGAnimationElement {
 public:
@@ -80 +82 @@
     OwnPtr<SVGAnimatedType> m_toType;
     OwnPtr<SVGAnimatedType> m_animatedType;
-    
+
+    SVGAnimatedProperty* m_animatedProperty;
     OwnPtr<SVGAnimatedTypeAnimator> m_animator;
 };

trunk/Source/WebCore/svg/properties/SVGAnimatedPropertyTearOff.h

@@ -80 +80 @@
         m_isAnimating = false;
 
-        ASSERT(contextElement());
-        contextElement()->svgAttributeChanged(attributeName());
+        SVGElement* element = contextElement();
+        if (!element || !element->inDocument() || !element->parentNode())
+            return;
+        ASSERT(!element->m_deletionHasBegun);
+        element->svgAttributeChanged(attributeName());
     }