Title: [219193] trunk
- Revision
- 219193
- Author
- svil...@igalia.com
- Date
- 2017-07-06 02:57:45 -0700 (Thu, 06 Jul 2017)
Log Message
[SVG] Leak in SVGAnimatedListPropertyTearOff
https://bugs.webkit.org/show_bug.cgi?id=172545
Reviewed by Said Abou-Hallawa.
SVGAnimatedListPropertyTearOff maintains a vector m_wrappers with references to
SVGPropertyTraits<PropertyType>::ListItemTearOff. Apart from that SVGPropertyTearOff has a
reference to SVGAnimatedProperty.
When SVGListProperty::getItemValuesAndWrappers() is called, it creates a
SVGPropertyTraits<PropertyType>::ListItemTearOff pointing to the same SVGAnimatedProperty (a
SVGAnimatedListPropertyTearOff) which stores the m_wrappers vector where the ListItemTearOff
is going to be added to. This effectively creates a reference cycle between the
SVGAnimatedListPropertyTearOff and all the ListItemTearOff it stores in m_wrappers.
We should detach those wrappers in propertyWillBeDeleted() in order to break the cycle.
* svg/properties/SVGAnimatedListPropertyTearOff.h:
Modified Paths
Added Paths
Diff
Added: trunk/LayoutTests/svg/animations/animation-leak-list-property-instances-expected.txt (0 => 219193)
--- trunk/LayoutTests/svg/animations/animation-leak-list-property-instances-expected.txt (rev 0)
+++ trunk/LayoutTests/svg/animations/animation-leak-list-property-instances-expected.txt 2017-07-06 09:57:45 UTC (rev 219193)
@@ -0,0 +1,3 @@
+This test checks that transform animations in SVG elements do not cause the whole SVGDocument to leak.
+
+PASS
Property changes on: trunk/LayoutTests/svg/animations/animation-leak-list-property-instances-expected.txt
___________________________________________________________________
Added: svn:eol-style
+LF
\ No newline at end of property
Added: trunk/LayoutTests/svg/animations/animation-leak-list-property-instances.html (0 => 219193)
--- trunk/LayoutTests/svg/animations/animation-leak-list-property-instances.html (rev 0)
+++ trunk/LayoutTests/svg/animations/animation-leak-list-property-instances.html 2017-07-06 09:57:45 UTC (rev 219193)
@@ -0,0 +1,53 @@
+<!DOCTYPE html>
+<script>
+ function log(message) {
+ var logDiv = document.getElementById('log');
+ logDiv.appendChild(document.createTextNode(message));
+ }
+ var originalLiveElements = 0;
+
+ function finishTest() {
+ GCController.collect();
+ var liveDelta = originalLiveElements - window.internals.numberOfLiveNodes();
+ if (liveDelta == 4)
+ log("PASS");
+ else
+ log("FAIL: not enough live nodes freed: " + liveDelta + " vs 4 expected");
+
+ testRunner.notifyDone();
+ }
+
+ function continueTest() {
+ GCController.collect();
+ originalLiveElements = window.internals.numberOfLiveNodes();
+ document.getElementById("container").removeChild(document.getElementById("rootSVG"));
+ }
+
+ function applyTransform(root, id) {
+ var svgroot = document.getElementById(root);
+ var transformList = document.getElementById(id).transform.baseVal;
+ var rotate = svgroot.createSVGTransform();
+ rotate.setRotate(10,0,0);
+ transformList.appendItem(rotate);
+ }
+
+ function load() {
+ testRunner.dumpAsText();
+ testRunner.waitUntilDone();
+
+ applyTransform("rootSVG", "rect");
+ continueTest();
+ finishTest();
+ }
+</script>
+
+<body _onload_="load()">
+ <p>This test checks that transform animations in SVG elements do not cause the whole SVGDocument to leak.</p>
+ <div id="container">
+ <svg id="rootSVG" width="300" height="300" xmlns="http://www.w3.org/2000/svg" version="1.1">
+ <rect id="rect" x="100" y="100" width="100" height="100" fill="yellow"/>
+ </svg>
+ </div>
+ <div id="log"></div>
+</body>
+
Property changes on: trunk/LayoutTests/svg/animations/animation-leak-list-property-instances.html
___________________________________________________________________
Added: svn:eol-style
+LF
\ No newline at end of property
Added: svn:mime-type
+text/html
\ No newline at end of property
Modified: trunk/Source/WebCore/ChangeLog (219192 => 219193)
--- trunk/Source/WebCore/ChangeLog 2017-07-06 09:07:01 UTC (rev 219192)
+++ trunk/Source/WebCore/ChangeLog 2017-07-06 09:57:45 UTC (rev 219193)
@@ -1,3 +1,24 @@
+2017-05-24 Sergio Villar Senin <svil...@igalia.com>
+
+ [SVG] Leak in SVGAnimatedListPropertyTearOff
+ https://bugs.webkit.org/show_bug.cgi?id=172545
+
+ Reviewed by Said Abou-Hallawa.
+
+ SVGAnimatedListPropertyTearOff maintains a vector m_wrappers with references to
+ SVGPropertyTraits<PropertyType>::ListItemTearOff. Apart from that SVGPropertyTearOff has a
+ reference to SVGAnimatedProperty.
+
+ When SVGListProperty::getItemValuesAndWrappers() is called, it creates a
+ SVGPropertyTraits<PropertyType>::ListItemTearOff pointing to the same SVGAnimatedProperty (a
+ SVGAnimatedListPropertyTearOff) which stores the m_wrappers vector where the ListItemTearOff
+ is going to be added to. This effectively creates a reference cycle between the
+ SVGAnimatedListPropertyTearOff and all the ListItemTearOff it stores in m_wrappers.
+
+ We should detach those wrappers in propertyWillBeDeleted() in order to break the cycle.
+
+ * svg/properties/SVGAnimatedListPropertyTearOff.h:
+
2017-07-05 Don Olmstead <don.olmst...@sony.com>
[WTF] Move SoftLinking.h into WTF
Modified: trunk/Source/WebCore/svg/properties/SVGAnimatedListPropertyTearOff.h (219192 => 219193)
--- trunk/Source/WebCore/svg/properties/SVGAnimatedListPropertyTearOff.h 2017-07-06 09:07:01 UTC (rev 219192)
+++ trunk/Source/WebCore/svg/properties/SVGAnimatedListPropertyTearOff.h 2017-07-06 09:57:45 UTC (rev 219193)
@@ -73,6 +73,8 @@
m_baseVal = nullptr;
else if (&property == m_animVal)
m_animVal = nullptr;
+ if (!m_baseVal && !m_animVal)
+ detachListWrappers(m_values.size());
}
int findItem(SVGProperty* property)
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes
