Title: [86909] branches/safari-534.36-branch
- Revision
- 86909
- Author
- [email protected]
- Date
- 2011-05-19 17:56:09 -0700 (Thu, 19 May 2011)
Log Message
Merge r86748.
Modified Paths
Added Paths
Diff
Modified: branches/safari-534.36-branch/LayoutTests/ChangeLog (86908 => 86909)
--- branches/safari-534.36-branch/LayoutTests/ChangeLog 2011-05-20 00:20:11 UTC (rev 86908)
+++ branches/safari-534.36-branch/LayoutTests/ChangeLog 2011-05-20 00:56:09 UTC (rev 86909)
@@ -1,5 +1,20 @@
2011-05-19 Lucas Forschler <[email protected]
+ Merged r86748.
+
+ 2011-05-18 Abhishek Arya <[email protected]>
+
+ Reviewed by Dirk Schulze.
+
+ Tests that we do not crash when trying to access a removed
+ smil element in animated elements list.
+ https://bugs.webkit.org/show_bug.cgi?id=60980
+
+ * svg/animations/smil-element-not-removed-crash-expected.txt: Added.
+ * svg/animations/smil-element-not-removed-crash.html: Added.
+
+2011-05-19 Lucas Forschler <[email protected]
+
Merged r86781.
2011-05-18 Abhishek Arya <[email protected]>
Copied: branches/safari-534.36-branch/LayoutTests/svg/animations/smil-element-not-removed-crash-expected.txt (from rev 86748, trunk/LayoutTests/svg/animations/smil-element-not-removed-crash-expected.txt) (0 => 86909)
--- branches/safari-534.36-branch/LayoutTests/svg/animations/smil-element-not-removed-crash-expected.txt (rev 0)
+++ branches/safari-534.36-branch/LayoutTests/svg/animations/smil-element-not-removed-crash-expected.txt 2011-05-20 00:56:09 UTC (rev 86909)
@@ -0,0 +1 @@
+PASS
Copied: branches/safari-534.36-branch/LayoutTests/svg/animations/smil-element-not-removed-crash.html (from rev 86748, trunk/LayoutTests/svg/animations/smil-element-not-removed-crash.html) (0 => 86909)
--- branches/safari-534.36-branch/LayoutTests/svg/animations/smil-element-not-removed-crash.html (rev 0)
+++ branches/safari-534.36-branch/LayoutTests/svg/animations/smil-element-not-removed-crash.html 2011-05-20 00:56:09 UTC (rev 86909)
@@ -0,0 +1,35 @@
+<html>
+ <body>
+ <svg>
+ <animAttributeAttrs>
+ <feImage id="test"></feImage>
+ </animAttributeAttrs>
+ <set id="set1" xlink:href=""
+ </svg>
+ <script>
+ if (window.layoutTestController) {
+ layoutTestController.dumpAsText();
+ layoutTestController.waitUntilDone();
+ gc = function() { window.GCController.collect() };
+ } else if (!window.gc)
+ gc = function(){};
+
+ window._onload_ = function() {
+ if (location.hash != "#2") {
+ if (location.hash)
+ location.hash = "#" + (parseInt(location.hash.slice(1)) + 1).toString();
+ else
+ location.hash = "#1";
+
+ gc();
+ setTimeout(function(){location.reload()}, 0);
+ } else {
+ document.body.innerHTML = "PASS";
+ if (window.layoutTestController)
+ layoutTestController.notifyDone();
+ }
+ }
+ </script>
+ </body>
+</html>
+
Modified: branches/safari-534.36-branch/Source/WebCore/ChangeLog (86908 => 86909)
--- branches/safari-534.36-branch/Source/WebCore/ChangeLog 2011-05-20 00:20:11 UTC (rev 86908)
+++ branches/safari-534.36-branch/Source/WebCore/ChangeLog 2011-05-20 00:56:09 UTC (rev 86909)
@@ -1,5 +1,22 @@
2011-05-19 Lucas Forschler <[email protected]
+ Merged r86748.
+
+ 2011-05-18 Abhishek Arya <[email protected]>
+
+ Reviewed by Dirk Schulze.
+
+ When SMIL element is getting removed, make sure to remove it
+ from target's animation elements list.
+ https://bugs.webkit.org/show_bug.cgi?id=60980
+
+ Test: svg/animations/smil-element-not-removed-crash.html
+
+ * svg/animation/SVGSMILElement.cpp:
+ (WebCore::SVGSMILElement::~SVGSMILElement):
+
+2011-05-19 Lucas Forschler <[email protected]
+
Merged r86806.
2011-05-18 Chris Fleizach <[email protected]>
Modified: branches/safari-534.36-branch/Source/WebCore/svg/animation/SVGSMILElement.cpp (86908 => 86909)
--- branches/safari-534.36-branch/Source/WebCore/svg/animation/SVGSMILElement.cpp 2011-05-20 00:20:11 UTC (rev 86908)
+++ branches/safari-534.36-branch/Source/WebCore/svg/animation/SVGSMILElement.cpp 2011-05-20 00:56:09 UTC (rev 86909)
@@ -141,6 +141,8 @@
disconnectConditions();
if (m_timeContainer)
m_timeContainer->unschedule(this);
+ if (m_targetElement)
+ document()->accessSVGExtensions()->removeAnimationElementFromTarget(this, m_targetElement);
}
static inline QualifiedName constructQualifiedName(const SVGElement* svgElement, const String& attributeName)
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
