Title: [99861] trunk
- Revision
- 99861
- Author
- [email protected]
- Date
- 2011-11-10 08:31:33 -0800 (Thu, 10 Nov 2011)
Log Message
Unreviewed, rolling out r99851.
http://trac.webkit.org/changeset/99851
https://bugs.webkit.org/show_bug.cgi?id=72029
Patch breaks Qt tests (Requested by schenney on #webkit).
Patch by Sheriff Bot <[email protected]> on 2011-11-10
Source/WebCore:
* svg/SVGElementInstance.cpp:
(WebCore::SVGElementInstance::~SVGElementInstance):
(WebCore::SVGElementInstance::clearChildren):
* svg/SVGElementInstance.h:
(WebCore::SVGElementInstance::clearUseElements):
* svg/SVGUseElement.cpp:
(WebCore::SVGUseElement::detachInstance):
LayoutTests:
* svg/custom/element-instance-held-by-js-crash-expected.txt: Removed.
* svg/custom/element-instance-held-by-js-crash.svg: Removed.
Modified Paths
Removed Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (99860 => 99861)
--- trunk/LayoutTests/ChangeLog 2011-11-10 16:27:58 UTC (rev 99860)
+++ trunk/LayoutTests/ChangeLog 2011-11-10 16:31:33 UTC (rev 99861)
@@ -1,3 +1,14 @@
+2011-11-10 Sheriff Bot <[email protected]>
+
+ Unreviewed, rolling out r99851.
+ http://trac.webkit.org/changeset/99851
+ https://bugs.webkit.org/show_bug.cgi?id=72029
+
+ Patch breaks Qt tests (Requested by schenney on #webkit).
+
+ * svg/custom/element-instance-held-by-js-crash-expected.txt: Removed.
+ * svg/custom/element-instance-held-by-js-crash.svg: Removed.
+
2011-11-10 Nikolas Zimmermann <[email protected]>
Not reviewed. Rebaseline one test on Mac, to turn SL bots green again.
Deleted: trunk/LayoutTests/svg/custom/element-instance-held-by-js-crash-expected.txt (99860 => 99861)
--- trunk/LayoutTests/svg/custom/element-instance-held-by-js-crash-expected.txt 2011-11-10 16:27:58 UTC (rev 99860)
+++ trunk/LayoutTests/svg/custom/element-instance-held-by-js-crash-expected.txt 2011-11-10 16:31:33 UTC (rev 99861)
@@ -1,2 +0,0 @@
-PASS - Null corresponding element dereference does not crash.
-
Deleted: trunk/LayoutTests/svg/custom/element-instance-held-by-js-crash.svg (99860 => 99861)
--- trunk/LayoutTests/svg/custom/element-instance-held-by-js-crash.svg 2011-11-10 16:27:58 UTC (rev 99860)
+++ trunk/LayoutTests/svg/custom/element-instance-held-by-js-crash.svg 2011-11-10 16:31:33 UTC (rev 99861)
@@ -1,27 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
- <script>
- <![CDATA[
- window._onload_ = function() {
- // Grab a reference to an SVGElementInstance native object. This reference will prevent the
- // object from deletion when the shadow DOM is removed due to a style change.
- instance = document.getElementById("use_elem").instanceRoot;
-
- // Setting an attribute forces re-creation of the shadow DOM
- document.getElementById("circleID").setAttribute("cx", 30);
-
- // The animate element tries to modify the element, which tries to update the
- // instances in the circle, which crashes if it holds a pointer to a non-existent element.
-
- if (window.layoutTestController)
- layoutTestController.dumpAsText();
- }
- //]]>
- </script>
- <circle transform="translate(1)" id="circleID" fill="green" cy="15" cx="15" r="10" >
- <animate attributeName="cy" />
- </circle>
- <text id="resultText" y="20" x="50" >
- PASS - Null corresponding element dereference does not crash.
- </text>
- <use id="use_elem" xlink:href="" />
-</svg>
Modified: trunk/Source/WebCore/ChangeLog (99860 => 99861)
--- trunk/Source/WebCore/ChangeLog 2011-11-10 16:27:58 UTC (rev 99860)
+++ trunk/Source/WebCore/ChangeLog 2011-11-10 16:31:33 UTC (rev 99861)
@@ -1,3 +1,19 @@
+2011-11-10 Sheriff Bot <[email protected]>
+
+ Unreviewed, rolling out r99851.
+ http://trac.webkit.org/changeset/99851
+ https://bugs.webkit.org/show_bug.cgi?id=72029
+
+ Patch breaks Qt tests (Requested by schenney on #webkit).
+
+ * svg/SVGElementInstance.cpp:
+ (WebCore::SVGElementInstance::~SVGElementInstance):
+ (WebCore::SVGElementInstance::clearChildren):
+ * svg/SVGElementInstance.h:
+ (WebCore::SVGElementInstance::clearUseElements):
+ * svg/SVGUseElement.cpp:
+ (WebCore::SVGUseElement::detachInstance):
+
2011-11-10 Nikolas Zimmermann <[email protected]>
[GTK] svg/as-image/svg-image-change-content-size.xhtml crashes
Modified: trunk/Source/WebCore/svg/SVGElementInstance.cpp (99860 => 99861)
--- trunk/Source/WebCore/svg/SVGElementInstance.cpp 2011-11-10 16:27:58 UTC (rev 99860)
+++ trunk/Source/WebCore/svg/SVGElementInstance.cpp 2011-11-10 16:31:33 UTC (rev 99861)
@@ -61,30 +61,18 @@
SVGElementInstance::~SVGElementInstance()
{
- // Call detach because we may be deleted directly if we are a child of a detached instance.
- detach();
-
#ifndef NDEBUG
instanceCounter.decrement();
#endif
-}
-
-void SVGElementInstance::detach()
-{
- // Clear all pointers. When the node is detached from the shadow DOM it should be removed but,
- // due to ref counting, it may not be. So clear everything to avoid dangling pointers.
-
// Deregister as instance for passed element.
- if (m_element)
- m_element->removeInstanceMapping(this);
- m_element = 0;
+ m_element->removeInstanceMapping(this);
- m_shadowTreeElement = 0;
+ clearChildren();
+}
- m_directUseElement = 0;
- m_correspondingUseElement = 0;
-
+void SVGElementInstance::clearChildren()
+{
removeAllChildrenInContainer<SVGElementInstance, SVGElementInstance>(this);
}
Modified: trunk/Source/WebCore/svg/SVGElementInstance.h (99860 => 99861)
--- trunk/Source/WebCore/svg/SVGElementInstance.h 2011-11-10 16:27:58 UTC (rev 99860)
+++ trunk/Source/WebCore/svg/SVGElementInstance.h 2011-11-10 16:31:33 UTC (rev 99861)
@@ -60,9 +60,13 @@
SVGUseElement* correspondingUseElement() const { return m_correspondingUseElement; }
SVGUseElement* directUseElement() const { return m_directUseElement; }
SVGElement* shadowTreeElement() const { return m_shadowTreeElement.get(); }
+ void clearChildren();
+ void clearUseElements()
+ {
+ m_directUseElement = 0;
+ m_correspondingUseElement = 0;
+ }
- void detach();
-
SVGElementInstance* parentNode() const { return parent(); }
PassRefPtr<SVGElementInstanceList> childNodes();
Modified: trunk/Source/WebCore/svg/SVGUseElement.cpp (99860 => 99861)
--- trunk/Source/WebCore/svg/SVGUseElement.cpp 2011-11-10 16:27:58 UTC (rev 99860)
+++ trunk/Source/WebCore/svg/SVGUseElement.cpp 2011-11-10 16:31:33 UTC (rev 99861)
@@ -624,7 +624,8 @@
{
if (!m_targetElementInstance)
return;
- m_targetElementInstance->detach();
+ m_targetElementInstance->clearUseElements();
+ m_targetElementInstance->clearChildren();
m_targetElementInstance = 0;
}
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
