Changeset 96050 in webkit

Timestamp:

Sep 26, 2011 5:24:17 PM (13 years ago)

Author:

cdn@chromium.org

Message:

Revert 96034 - Merge 95791 - use after free in WebCore::SVGTRefElement::updateReferencedText

BUG=95359
Review URL: ​http://codereview.chromium.org/8046025

TBR=​cdn@chromium.org
Review URL: ​http://codereview.chromium.org/8041053

Location:

branches/chromium/835

Files:

• LayoutTests/svg/custom/tref-clone-crash-expected.txt (deleted)
• LayoutTests/svg/custom/tref-clone-crash.html (deleted)
• Source/WebCore/svg/SVGTRefElement.cpp (modified) (2 diffs)
• Source/WebCore/svg/SVGTRefElement.h (modified) (1 diff)

branches/chromium/835/Source/WebCore/svg/SVGTRefElement.cpp

@@ -194 +194 @@
         }
         updateReferencedText();
-        if (inDocument()) {
-            m_eventListener = SubtreeModificationEventListener::create(this, id);
-            ASSERT(target->parentNode());
-            target->parentNode()->addEventListener(eventNames().DOMSubtreeModifiedEvent, m_eventListener.get(), false);
-        }
+        m_eventListener = SubtreeModificationEventListener::create(this, id);
+        ASSERT(target->parentNode());
+        target->parentNode()->addEventListener(eventNames().DOMSubtreeModifiedEvent, m_eventListener.get(), false);
         if (RenderObject* renderer = this->renderer())
             RenderSVGResource::markForLayoutAndParentResourceInvalidation(renderer);
@@ -244 +242 @@
 }
 
-void SVGTRefElement::insertedIntoDocument()
-{
-    SVGStyledElement::insertedIntoDocument();
-    String id;
-    Element* target = SVGURIReference::targetElementFromIRIString(href(), document(), &id);
-    if (!target) {
-        document()->accessSVGExtensions()->addPendingResource(id, this);
-        return;
-    }
-    updateReferencedText();
-    m_eventListener = SubtreeModificationEventListener::create(this, id);
-    ASSERT(target->parentNode());
-    target->parentNode()->addEventListener(eventNames().DOMSubtreeModifiedEvent, m_eventListener.get(), false);
-}
-
 void SVGTRefElement::removedFromDocument()
 {

branches/chromium/835/Source/WebCore/svg/SVGTRefElement.h

@@ -48 +48 @@
     virtual bool rendererIsNeeded(const NodeRenderingContext&);
 
-    virtual void insertedIntoDocument();
     virtual void removedFromDocument();