Title: [230063] trunk/Source/WebCore
- Revision
- 230063
- Author
- s...@apple.com
- Date
- 2018-03-28 18:10:13 -0700 (Wed, 28 Mar 2018)
Log Message
The SVGAnimatedProperty wrappers have to be detached from the referenced values before the SVGAnimatedType is deleted
https://bugs.webkit.org/show_bug.cgi?id=183972
Reviewed by Daniel Bates.
If the SVGAnimatedType is a list type, e.g. SVGLengthListValues, the wrappers
of the animated properties have to be detached from the items in the list
before it's deleted.
* svg/SVGAnimateElementBase.cpp:
(WebCore::SVGAnimateElementBase::clearAnimatedType):
Modified Paths
Diff
Modified: trunk/Source/WebCore/ChangeLog (230062 => 230063)
--- trunk/Source/WebCore/ChangeLog 2018-03-29 00:47:57 UTC (rev 230062)
+++ trunk/Source/WebCore/ChangeLog 2018-03-29 01:10:13 UTC (rev 230063)
@@ -1,3 +1,17 @@
+2018-03-28 Said Abou-Hallawa <sabouhall...@apple.com>
+
+ The SVGAnimatedProperty wrappers have to be detached from the referenced values before the SVGAnimatedType is deleted
+ https://bugs.webkit.org/show_bug.cgi?id=183972
+
+ Reviewed by Daniel Bates.
+
+ If the SVGAnimatedType is a list type, e.g. SVGLengthListValues, the wrappers
+ of the animated properties have to be detached from the items in the list
+ before it's deleted.
+
+ * svg/SVGAnimateElementBase.cpp:
+ (WebCore::SVGAnimateElementBase::clearAnimatedType):
+
2018-03-28 Ross Kirsling <ross.kirsl...@sony.com>
MSVC __forceinline slows down JSC release build fivefold after r229391
Modified: trunk/Source/WebCore/svg/SVGAnimateElementBase.cpp (230062 => 230063)
--- trunk/Source/WebCore/svg/SVGAnimateElementBase.cpp 2018-03-29 00:47:57 UTC (rev 230062)
+++ trunk/Source/WebCore/svg/SVGAnimateElementBase.cpp 2018-03-29 01:10:13 UTC (rev 230063)
@@ -303,6 +303,11 @@
if (!m_animatedType)
return;
+ // If the SVGAnimatedType is a list type, e.g. SVGLengthListValues, the wrappers of the
+ // animated properties have to be detached from the items in the list before it's deleted.
+ if (!m_animatedProperties.isEmpty())
+ m_animator->animValWillChange(m_animatedProperties);
+
if (!targetElement) {
m_animatedType = nullptr;
return;
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes
