Title: [91150] branches/chromium/782
- Revision
- 91150
- Author
- [email protected]
- Date
- 2011-07-16 12:06:00 -0700 (Sat, 16 Jul 2011)
Log Message
Merge 91005
BUG=88730
Review URL: http://codereview.chromium.org/7396010
Modified Paths
Added Paths
Diff
Copied: branches/chromium/782/LayoutTests/svg/custom/use-crash-using-children-before-destroy-expected.txt (from rev 91005, trunk/LayoutTests/svg/custom/use-crash-using-children-before-destroy-expected.txt) (0 => 91150)
--- branches/chromium/782/LayoutTests/svg/custom/use-crash-using-children-before-destroy-expected.txt (rev 0)
+++ branches/chromium/782/LayoutTests/svg/custom/use-crash-using-children-before-destroy-expected.txt 2011-07-16 19:06:00 UTC (rev 91150)
@@ -0,0 +1,2 @@
+PASS if no crash/assert
+
Copied: branches/chromium/782/LayoutTests/svg/custom/use-crash-using-children-before-destroy.svg (from rev 91005, trunk/LayoutTests/svg/custom/use-crash-using-children-before-destroy.svg) (0 => 91150)
--- branches/chromium/782/LayoutTests/svg/custom/use-crash-using-children-before-destroy.svg (rev 0)
+++ branches/chromium/782/LayoutTests/svg/custom/use-crash-using-children-before-destroy.svg 2011-07-16 19:06:00 UTC (rev 91150)
@@ -0,0 +1,20 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
+ <text>PASS if no crash/assert</text>
+ <g id="outer"><use id="a"></use></g>
+ <use id="b" xlink:href="" />
+<script><![CDATA[
+var useobj = document.getElementById("b").instanceRoot;
+
+function test() {
+ var elem = document.getElementById("b");
+ elem.parentNode.removeChild(elem);
+}
+test();
+
+document.getElementById("a").appendChild(document.createElement("g"));
+
+if (window.layoutTestController) {
+ layoutTestController.dumpAsText();
+}
+]]></script>
+</svg>
\ No newline at end of file
Modified: branches/chromium/782/Source/WebCore/svg/SVGElementInstance.cpp (91149 => 91150)
--- branches/chromium/782/Source/WebCore/svg/SVGElementInstance.cpp 2011-07-16 12:37:41 UTC (rev 91149)
+++ branches/chromium/782/Source/WebCore/svg/SVGElementInstance.cpp 2011-07-16 19:06:00 UTC (rev 91150)
@@ -70,6 +70,11 @@
// Deregister as instance for passed element.
m_element->removeInstanceMapping(this);
+ clearChildren();
+}
+
+void SVGElementInstance::clearChildren()
+{
removeAllChildrenInContainer<SVGElementInstance, SVGElementInstance>(this);
}
@@ -105,8 +110,10 @@
const HashSet<SVGElementInstance*>::const_iterator end = set.end();
for (HashSet<SVGElementInstance*>::const_iterator it = set.begin(); it != end; ++it) {
ASSERT((*it)->correspondingElement() == element);
- if (SVGUseElement* element = (*it)->correspondingUseElement())
+ if (SVGUseElement* element = (*it)->correspondingUseElement()) {
+ ASSERT(element->inDocument());
element->invalidateShadowTree();
+ }
}
// Be sure to rebuild use trees, if needed
Modified: branches/chromium/782/Source/WebCore/svg/SVGElementInstance.h (91149 => 91150)
--- branches/chromium/782/Source/WebCore/svg/SVGElementInstance.h 2011-07-16 12:37:41 UTC (rev 91149)
+++ branches/chromium/782/Source/WebCore/svg/SVGElementInstance.h 2011-07-16 19:06:00 UTC (rev 91150)
@@ -59,6 +59,7 @@
SVGUseElement* correspondingUseElement() const { return m_correspondingUseElement; }
SVGUseElement* directUseElement() const { return m_directUseElement; }
SVGElement* shadowTreeElement() const { return m_shadowTreeElement.get(); }
+ void clearChildren();
void clearUseElements()
{
m_directUseElement = 0;
Modified: branches/chromium/782/Source/WebCore/svg/SVGUseElement.cpp (91149 => 91150)
--- branches/chromium/782/Source/WebCore/svg/SVGUseElement.cpp 2011-07-16 12:37:41 UTC (rev 91149)
+++ branches/chromium/782/Source/WebCore/svg/SVGUseElement.cpp 2011-07-16 19:06:00 UTC (rev 91150)
@@ -709,6 +709,7 @@
if (!m_targetElementInstance)
return;
m_targetElementInstance->clearUseElements();
+ m_targetElementInstance->clearChildren();
m_targetElementInstance = 0;
}
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
