Title: [219325] trunk
- Revision
- 219325
- Author
- [email protected]
- Date
- 2017-07-11 03:44:18 -0700 (Tue, 11 Jul 2017)
Log Message
[SVG] Leak in SVGAnimatedListPropertyTearOff
https://bugs.webkit.org/show_bug.cgi?id=172545
Reviewed by Said Abou-Hallawa.
SVGAnimatedListPropertyTearOff maintains a vector m_wrappers with references to
SVGPropertyTraits<PropertyType>::ListItemTearOff. Apart from that SVGPropertyTearOff has a
reference to SVGAnimatedProperty.
When SVGListProperty::getItemValuesAndWrappers() is called, it creates a
SVGPropertyTraits<PropertyType>::ListItemTearOff pointing to the same SVGAnimatedProperty (a
SVGAnimatedListPropertyTearOff) which stores the m_wrappers vector where the ListItemTearOff
is going to be added to. This effectively creates a reference cycle between the
SVGAnimatedListPropertyTearOff and all the ListItemTearOff it stores in m_wrappers.
We should detach those wrappers in propertyWillBeDeleted() in order to break the cycle.
* svg/properties/SVGAnimatedListPropertyTearOff.h:
Modified Paths
Added Paths
Diff
Added: trunk/LayoutTests/svg/animations/animation-leak-list-property-instances-expected.txt (0 => 219325)
--- trunk/LayoutTests/svg/animations/animation-leak-list-property-instances-expected.txt (rev 0)
+++ trunk/LayoutTests/svg/animations/animation-leak-list-property-instances-expected.txt 2017-07-11 10:44:18 UTC (rev 219325)
@@ -0,0 +1,7 @@
+This test checks that adding an animation to a SVG element does not leak the whole SVGDocument.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS 0 is 0
+
Property changes on: trunk/LayoutTests/svg/animations/animation-leak-list-property-instances-expected.txt
___________________________________________________________________
Added: svn:eol-style
+LF
\ No newline at end of property
Added: trunk/LayoutTests/svg/animations/animation-leak-list-property-instances.html (0 => 219325)
--- trunk/LayoutTests/svg/animations/animation-leak-list-property-instances.html (rev 0)
+++ trunk/LayoutTests/svg/animations/animation-leak-list-property-instances.html 2017-07-11 10:44:18 UTC (rev 219325)
@@ -0,0 +1,59 @@
+<!DOCTYPE html>
+<script src=""
+
+<body _onload_="test()">
+ <svg id="rootSVG" width="300" height="300" xmlns="http://www.w3.org/2000/svg" version="1.1"></svg>
+</body>
+
+<script>
+ description("This test checks that adding an animation to a SVG element does not leak the whole SVGDocument.")
+
+ function addRect()
+ {
+ var elem = document.createElementNS("http://www.w3.org/2000/svg", "rect");
+ elem.setAttribute("id", "rect");
+ elem.setAttribute("x", 50);
+ elem.setAttribute("y", 50);
+ elem.setAttribute("width", 50);
+ elem.setAttribute("height", 50);
+ elem.setAttribute("fill", "blue");
+
+ document.getElementById("rootSVG").appendChild(elem);
+ }
+
+ function applyTransform()
+ {
+ var svgroot = document.getElementById("rootSVG");
+ var transformList = document.getElementById("rect").transform.baseVal;
+ var rotate = svgroot.createSVGTransform();
+ rotate.setRotate(15,0,0);
+ transformList.appendItem(rotate);
+ }
+
+ function removeRect()
+ {
+ document.getElementById("rootSVG").removeChild(document.getElementById("rect"));
+ }
+
+ function test()
+ {
+ if (!window.internals || !window.GCController) {
+ testFailed("This test requires internals and GCController");
+ return;
+ }
+
+ testRunner.dumpAsText();
+
+ gc();
+ var originalLiveElements = internals.numberOfLiveNodes();
+
+ addRect();
+ applyTransform();
+ removeRect();
+
+ gc();
+ var delta = internals.numberOfLiveNodes() - originalLiveElements;
+ shouldBeZero(delta.toString());
+ var successfullyParsed = true;
+ }
+</script>
Property changes on: trunk/LayoutTests/svg/animations/animation-leak-list-property-instances.html
___________________________________________________________________
Added: svn:eol-style
+LF
\ No newline at end of property
Added: svn:mime-type
+text/html
\ No newline at end of property
Modified: trunk/Source/WebCore/ChangeLog (219324 => 219325)
--- trunk/Source/WebCore/ChangeLog 2017-07-11 07:49:54 UTC (rev 219324)
+++ trunk/Source/WebCore/ChangeLog 2017-07-11 10:44:18 UTC (rev 219325)
@@ -1,3 +1,24 @@
+2017-05-24 Sergio Villar Senin <[email protected]>
+
+ [SVG] Leak in SVGAnimatedListPropertyTearOff
+ https://bugs.webkit.org/show_bug.cgi?id=172545
+
+ Reviewed by Said Abou-Hallawa.
+
+ SVGAnimatedListPropertyTearOff maintains a vector m_wrappers with references to
+ SVGPropertyTraits<PropertyType>::ListItemTearOff. Apart from that SVGPropertyTearOff has a
+ reference to SVGAnimatedProperty.
+
+ When SVGListProperty::getItemValuesAndWrappers() is called, it creates a
+ SVGPropertyTraits<PropertyType>::ListItemTearOff pointing to the same SVGAnimatedProperty (a
+ SVGAnimatedListPropertyTearOff) which stores the m_wrappers vector where the ListItemTearOff
+ is going to be added to. This effectively creates a reference cycle between the
+ SVGAnimatedListPropertyTearOff and all the ListItemTearOff it stores in m_wrappers.
+
+ We should detach those wrappers in propertyWillBeDeleted() in order to break the cycle.
+
+ * svg/properties/SVGAnimatedListPropertyTearOff.h:
+
2017-07-10 Simon Fraser <[email protected]>
[WK2 iOS] REGRESSION (r216803) During momentum scroll, getBoundingClientRect returns wrong coordinates (missing images on pinterest, elle.com and many other sites)
Modified: trunk/Source/WebCore/svg/properties/SVGAnimatedListPropertyTearOff.h (219324 => 219325)
--- trunk/Source/WebCore/svg/properties/SVGAnimatedListPropertyTearOff.h 2017-07-11 07:49:54 UTC (rev 219324)
+++ trunk/Source/WebCore/svg/properties/SVGAnimatedListPropertyTearOff.h 2017-07-11 10:44:18 UTC (rev 219325)
@@ -73,6 +73,8 @@
m_baseVal = nullptr;
else if (&property == m_animVal)
m_animVal = nullptr;
+ if (!m_baseVal && !m_animVal)
+ detachListWrappers(m_values.size());
}
int findItem(SVGProperty* property)
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
