Title: [94568] trunk
- Revision
- 94568
- Author
- [email protected]
- Date
- 2011-09-06 07:11:27 -0700 (Tue, 06 Sep 2011)
Log Message
Unreviewed, rolling out r94564.
http://trac.webkit.org/changeset/94564
https://bugs.webkit.org/show_bug.cgi?id=67555
It broke many tests
Source/WebCore:
* svg/SVGTRefElement.cpp:
(WebCore::SVGTRefElement::svgAttributeChanged):
LayoutTests:
* svg/custom/tref-clone-crash-expected.txt: Removed.
* svg/custom/tref-clone-crash.html: Removed.
Modified Paths
Removed Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (94567 => 94568)
--- trunk/LayoutTests/ChangeLog 2011-09-06 14:07:08 UTC (rev 94567)
+++ trunk/LayoutTests/ChangeLog 2011-09-06 14:11:27 UTC (rev 94568)
@@ -1,3 +1,14 @@
+2011-09-06 Csaba Osztrogonác <[email protected]>
+
+ Unreviewed, rolling out r94564.
+ http://trac.webkit.org/changeset/94564
+ https://bugs.webkit.org/show_bug.cgi?id=67555
+
+ It broke many tests
+
+ * svg/custom/tref-clone-crash-expected.txt: Removed.
+ * svg/custom/tref-clone-crash.html: Removed.
+
2011-09-06 Laszlo Gombos <[email protected]>
Web Inspector: nuke background events collection (dead feature)
Deleted: trunk/LayoutTests/svg/custom/tref-clone-crash-expected.txt (94567 => 94568)
--- trunk/LayoutTests/svg/custom/tref-clone-crash-expected.txt 2011-09-06 14:07:08 UTC (rev 94567)
+++ trunk/LayoutTests/svg/custom/tref-clone-crash-expected.txt 2011-09-06 14:11:27 UTC (rev 94568)
@@ -1 +0,0 @@
-PASS
Deleted: trunk/LayoutTests/svg/custom/tref-clone-crash.html (94567 => 94568)
--- trunk/LayoutTests/svg/custom/tref-clone-crash.html 2011-09-06 14:07:08 UTC (rev 94567)
+++ trunk/LayoutTests/svg/custom/tref-clone-crash.html 2011-09-06 14:11:27 UTC (rev 94568)
@@ -1,28 +0,0 @@
-<svg _onload_="runTest()">
- <defs>
- <style id="style"/>
- <text id="ref"></text>
- </defs>
- <g><use xlink:href=""
- <g><text><tref id="tref" xlink:href=""
- <script>
- if (window.layoutTestController) {
- layoutTestController.dumpAsText();
- layoutTestController.waitUntilDone();
- }
- function runTest() {
- var tref = document.getElementById("tref");
- tref.cloneNode(true);
- window.setTimeout("finishTest()", 500);
- }
- function finishTest() {
- var elem = document.getElementById("style");
- var parent = elem.parentNode;
- // trigger tref event listeners
- parent.insertBefore(document.createElement("source"), elem);
- document.body.innerHTML = "PASS";
- if (window.layoutTestController)
- layoutTestController.notifyDone();
- }
- </script>
-</svg>
Modified: trunk/Source/WebCore/ChangeLog (94567 => 94568)
--- trunk/Source/WebCore/ChangeLog 2011-09-06 14:07:08 UTC (rev 94567)
+++ trunk/Source/WebCore/ChangeLog 2011-09-06 14:11:27 UTC (rev 94568)
@@ -1,3 +1,14 @@
+2011-09-06 Csaba Osztrogonác <[email protected]>
+
+ Unreviewed, rolling out r94564.
+ http://trac.webkit.org/changeset/94564
+ https://bugs.webkit.org/show_bug.cgi?id=67555
+
+ It broke many tests
+
+ * svg/SVGTRefElement.cpp:
+ (WebCore::SVGTRefElement::svgAttributeChanged):
+
2011-09-06 Rob Buis <[email protected]>
use after free in WebCore::SVGTRefElement::updateReferencedText
Modified: trunk/Source/WebCore/svg/SVGTRefElement.cpp (94567 => 94568)
--- trunk/Source/WebCore/svg/SVGTRefElement.cpp 2011-09-06 14:07:08 UTC (rev 94567)
+++ trunk/Source/WebCore/svg/SVGTRefElement.cpp 2011-09-06 14:11:27 UTC (rev 94568)
@@ -182,8 +182,6 @@
SVGElementInstance::InvalidationGuard invalidationGuard(this);
if (SVGURIReference::isKnownAttribute(attrName)) {
- if (!inDocument())
- return;
if (m_eventListener) {
m_eventListener->removeFromTarget();
m_eventListener = 0;
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
