Title: [239070] trunk
Revision
239070
Author
[email protected]
Date
2018-12-10 22:50:33 -0800 (Mon, 10 Dec 2018)

Log Message

SVGViewSpec objects should mark relevant SVG elements
https://bugs.webkit.org/show_bug.cgi?id=192567
<rdar://problem/46491325>

Reviewed by Ryosuke Niwa.

Source/WebCore:

SVGViewSpec elements reflect the state of an underlying SVGElement. Teach the mark algorithm to
recognize the relevant SVGElement as active as long as the SVGViewSpec is active.

Update SVGElement so that it can vend WeakPtrs. I also noticed that SVGAttributeOwner used a bare
pointer to the SVGElement, so switched to a WeakPtr.

Test: svg/animations/view-dependency-crash.html

* Sources.txt: Add new files.
* WebCore.xcodeproj/project.pbxproj: Ditto.
* bindings/js/JSSVGViewSpecCustom.cpp: Added.
(WebCore::JSSVGViewSpec::visitAdditionalChildren):
* svg/SVGElement.h:
* svg/SVGPathElement.h:
* svg/SVGViewSpec.cpp:
(WebCore::SVGViewSpec::SVGViewSpec): Hold a weak pointer (rather than a bare pointer) to the underlying element.
* svg/SVGViewSpec.h:
* svg/SVGViewSpec.idl:
* svg/properties/SVGAttributeOwnerProxy.cpp: Added.
(WebCore::SVGAttributeOwnerProxy::SVGAttributeOwnerProxy): Hold a weak pointer (rather than a bare pointer) to
the underling SVGElement.
(WebCore::SVGAttributeOwnerProxy::element const): Ditto.
* svg/properties/SVGAttributeOwnerProxy.h:
(WebCore::SVGAttributeOwnerProxy::SVGAttributeOwnerProxy): Move implementation to cpp file.
(WebCore::SVGAttributeOwnerProxy::element const): Ditto.
* svg/properties/SVGAttributeOwnerProxyImpl.h: Update for WeakPtr use.

LayoutTests:

* svg/animations/view-dependency-crash-expected.txt: Added.
* svg/animations/view-dependency-crash.html: Added.

Modified Paths

Added Paths

Diff

Modified: trunk/LayoutTests/ChangeLog (239069 => 239070)


--- trunk/LayoutTests/ChangeLog	2018-12-11 05:37:24 UTC (rev 239069)
+++ trunk/LayoutTests/ChangeLog	2018-12-11 06:50:33 UTC (rev 239070)
@@ -1,3 +1,14 @@
+2018-12-10  Brent Fulgham  <[email protected]>
+
+        SVGViewSpec objects should mark relevant SVG elements
+        https://bugs.webkit.org/show_bug.cgi?id=192567
+        <rdar://problem/46491325>
+
+        Reviewed by Ryosuke Niwa.
+
+        * svg/animations/view-dependency-crash-expected.txt: Added.
+        * svg/animations/view-dependency-crash.html: Added.
+
 2018-12-10  Benjamin Poulain  <[email protected]>
 
         <rdar://problem/45296285> Content blocker rule "raw" blocks media elements from loading

Added: trunk/LayoutTests/svg/animations/view-dependency-crash-expected.txt (0 => 239070)


--- trunk/LayoutTests/svg/animations/view-dependency-crash-expected.txt	                        (rev 0)
+++ trunk/LayoutTests/svg/animations/view-dependency-crash-expected.txt	2018-12-11 06:50:33 UTC (rev 239070)
@@ -0,0 +1,2 @@
+This test passes if it does not crash
+

Added: trunk/LayoutTests/svg/animations/view-dependency-crash.html (0 => 239070)


--- trunk/LayoutTests/svg/animations/view-dependency-crash.html	                        (rev 0)
+++ trunk/LayoutTests/svg/animations/view-dependency-crash.html	2018-12-11 06:50:33 UTC (rev 239070)
@@ -0,0 +1,24 @@
+<!DOCTYPE html>
+<html>
+<head>
+    <script src=""
+</head>
+<body _onload_="runTest()">
+This test passes if it does not crash<br/>
+<script>
+if (window.testRunner)
+  testRunner.dumpAsText();
+
+function runTest() {
+    var svg = document.createElementNS("http://www.w3.org/2000/svg", "svg");
+    var view = svg.currentView;
+    svg.pauseAnimations();
+    svg = null;
+    if (window.gc)
+        gc();
+    var rect = document.createElementNS("http://www.w3.org/2000/svg", "rect");
+    var viewBox = view.viewBox;
+}
+</script>
+</body>
+</html>

Modified: trunk/Source/WebCore/ChangeLog (239069 => 239070)


--- trunk/Source/WebCore/ChangeLog	2018-12-11 05:37:24 UTC (rev 239069)
+++ trunk/Source/WebCore/ChangeLog	2018-12-11 06:50:33 UTC (rev 239070)
@@ -1,3 +1,38 @@
+2018-12-10  Brent Fulgham  <[email protected]>
+
+        SVGViewSpec objects should mark relevant SVG elements
+        https://bugs.webkit.org/show_bug.cgi?id=192567
+        <rdar://problem/46491325>
+
+        Reviewed by Ryosuke Niwa.
+
+        SVGViewSpec elements reflect the state of an underlying SVGElement. Teach the mark algorithm to
+        recognize the relevant SVGElement as active as long as the SVGViewSpec is active.
+
+        Update SVGElement so that it can vend WeakPtrs. I also noticed that SVGAttributeOwner used a bare
+        pointer to the SVGElement, so switched to a WeakPtr.
+
+        Test: svg/animations/view-dependency-crash.html
+
+        * Sources.txt: Add new files.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * bindings/js/JSSVGViewSpecCustom.cpp: Added.
+        (WebCore::JSSVGViewSpec::visitAdditionalChildren):
+        * svg/SVGElement.h:
+        * svg/SVGPathElement.h:
+        * svg/SVGViewSpec.cpp:
+        (WebCore::SVGViewSpec::SVGViewSpec): Hold a weak pointer (rather than a bare pointer) to the underlying element.
+        * svg/SVGViewSpec.h:
+        * svg/SVGViewSpec.idl:
+        * svg/properties/SVGAttributeOwnerProxy.cpp: Added.
+        (WebCore::SVGAttributeOwnerProxy::SVGAttributeOwnerProxy): Hold a weak pointer (rather than a bare pointer) to
+        the underling SVGElement.
+        (WebCore::SVGAttributeOwnerProxy::element const): Ditto.
+        * svg/properties/SVGAttributeOwnerProxy.h:
+        (WebCore::SVGAttributeOwnerProxy::SVGAttributeOwnerProxy): Move implementation to cpp file.
+        (WebCore::SVGAttributeOwnerProxy::element const): Ditto.
+        * svg/properties/SVGAttributeOwnerProxyImpl.h: Update for WeakPtr use.
+
 2018-12-10  Benjamin Poulain  <[email protected]>
 
         <rdar://problem/45296285> Content blocker rule "raw" blocks media elements from loading

Modified: trunk/Source/WebCore/Sources.txt (239069 => 239070)


--- trunk/Source/WebCore/Sources.txt	2018-12-11 05:37:24 UTC (rev 239069)
+++ trunk/Source/WebCore/Sources.txt	2018-12-11 06:50:33 UTC (rev 239070)
@@ -468,6 +468,7 @@
 bindings/js/JSRemoteDOMWindowBase.cpp
 bindings/js/JSRemoteDOMWindowCustom.cpp
 bindings/js/JSSVGPathSegCustom.cpp
+bindings/js/JSSVGViewSpecCustom.cpp
 bindings/js/JSStyleSheetCustom.cpp
 bindings/js/JSServiceWorkerClientCustom.cpp
 bindings/js/JSServiceWorkerGlobalScopeCustom.cpp
@@ -2342,6 +2343,7 @@
 
 svg/properties/SVGAnimatedPathSegListPropertyTearOff.cpp
 svg/properties/SVGAnimatedProperty.cpp
+svg/properties/SVGAttributeOwnerProxy.cpp
 
 workers/AbstractWorker.cpp
 workers/DedicatedWorkerGlobalScope.cpp

Modified: trunk/Source/WebCore/WebCore.xcodeproj/project.pbxproj (239069 => 239070)


--- trunk/Source/WebCore/WebCore.xcodeproj/project.pbxproj	2018-12-11 05:37:24 UTC (rev 239069)
+++ trunk/Source/WebCore/WebCore.xcodeproj/project.pbxproj	2018-12-11 06:50:33 UTC (rev 239070)
@@ -9444,6 +9444,8 @@
 		7A29BA67187B732200F29CEB /* TemporaryOpenGLSetting.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = TemporaryOpenGLSetting.h; sourceTree = "<group>"; };
 		7A29BA69187B781C00F29CEB /* TemporaryOpenGLSetting.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = TemporaryOpenGLSetting.cpp; sourceTree = "<group>"; };
 		7A29F57118C69514004D0F81 /* OutOfBandTextTrackPrivateAVF.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = OutOfBandTextTrackPrivateAVF.h; sourceTree = "<group>"; };
+		7A3EBEAA21BF054C000D043D /* JSSVGViewSpecCustom.cpp */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.cpp; path = JSSVGViewSpecCustom.cpp; sourceTree = "<group>"; };
+		7A3EBEAC21BF0921000D043D /* SVGAttributeOwnerProxy.cpp */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.cpp; path = SVGAttributeOwnerProxy.cpp; sourceTree = "<group>"; };
 		7A45032D18DB717200377B34 /* BufferedLineReader.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = BufferedLineReader.cpp; sourceTree = "<group>"; };
 		7A45032E18DB717200377B34 /* BufferedLineReader.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = BufferedLineReader.h; sourceTree = "<group>"; };
 		7A54857D14E02D51006AE05A /* InspectorHistory.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InspectorHistory.cpp; sourceTree = "<group>"; };
@@ -15829,6 +15831,7 @@
 				085A15921289A8DD002710E3 /* SVGAnimatedTransformListPropertyTearOff.h */,
 				55FA7FEF210FA386005AEFE7 /* SVGAttribute.h */,
 				55FA7FF4210FB688005AEFE7 /* SVGAttributeAccessor.h */,
+				7A3EBEAC21BF0921000D043D /* SVGAttributeOwnerProxy.cpp */,
 				55346AF021150FAF0059BCDD /* SVGAttributeOwnerProxy.h */,
 				55346AFA2117FFAF0059BCDD /* SVGAttributeOwnerProxyImpl.h */,
 				55FA7FF6210FBE3E005AEFE7 /* SVGAttributeRegistry.h */,
@@ -24570,6 +24573,7 @@
 				4B6B5CBE216434FB00603817 /* JSPaintWorkletGlobalScopeCustom.cpp */,
 				418C395D1C8F0AAB0051C8A3 /* JSReadableStreamSourceCustom.cpp */,
 				46BCBBBE2085005B00710638 /* JSRemoteDOMWindowCustom.cpp */,
+				7A3EBEAA21BF054C000D043D /* JSSVGViewSpecCustom.cpp */,
 			);
 			name = Custom;
 			sourceTree = "<group>";
@@ -29986,7 +29990,6 @@
 				11310CF620BA4A560065A8D0 /* LayoutChildIterator.h in Headers */,
 				1199FA46208E35A3002358CC /* LayoutContainer.h in Headers */,
 				11310CF520BA4A4C0065A8D0 /* LayoutDescendantIterator.h in Headers */,
-				6F7CA3C6208C2957002F29AB /* LayoutState.h in Headers */,
 				1199FA53208E38D3002358CC /* LayoutInlineBox.h in Headers */,
 				1199FA4F208E3899002358CC /* LayoutInlineContainer.h in Headers */,
 				11310CF420BA4A3D0065A8D0 /* LayoutIterator.h in Headers */,
@@ -29997,7 +30000,7 @@
 				A12538D413F9B60A00024754 /* LayoutRepainter.h in Headers */,
 				11310CF320BA4A370065A8D0 /* LayoutReplaced.h in Headers */,
 				141DC054164834B900371E5A /* LayoutSize.h in Headers */,
-				2D9066070BE141D400956998 /* RenderLayoutState.h in Headers */,
+				6F7CA3C6208C2957002F29AB /* LayoutState.h in Headers */,
 				11310CF220BA4A320065A8D0 /* LayoutTreeBuilder.h in Headers */,
 				141DC0481648348F00371E5A /* LayoutUnit.h in Headers */,
 				CDE8B5ED1A69777300B4B66A /* LegacyCDMPrivateClearKey.h in Headers */,
@@ -30598,6 +30601,7 @@
 				0F580CFF0F12DE9B0051D689 /* RenderLayerBacking.h in Headers */,
 				0F580CFD0F12DE9B0051D689 /* RenderLayerCompositor.h in Headers */,
 				3C244FEAA375AC633F88BE6F /* RenderLayerModelObject.h in Headers */,
+				2D9066070BE141D400956998 /* RenderLayoutState.h in Headers */,
 				0BE030A20F3112FB003C1A46 /* RenderLineBoxList.h in Headers */,
 				BCEA4864097D93020094C9E4 /* RenderLineBreak.h in Headers */,
 				ABB5419F0ACDDFE4002820EB /* RenderListBox.h in Headers */,

Copied: trunk/Source/WebCore/bindings/js/JSSVGViewSpecCustom.cpp (from rev 239069, trunk/Source/WebCore/svg/SVGViewSpec.idl) (0 => 239070)


--- trunk/Source/WebCore/bindings/js/JSSVGViewSpecCustom.cpp	                        (rev 0)
+++ trunk/Source/WebCore/bindings/js/JSSVGViewSpecCustom.cpp	2018-12-11 06:50:33 UTC (rev 239070)
@@ -0,0 +1,39 @@
+/*
+ * Copyright (C) 2018 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSSVGViewSpec.h"
+
+#include "JSNode.h"
+
+namespace WebCore {
+
+void JSSVGViewSpec::visitAdditionalChildren(JSC::SlotVisitor& visitor)
+{
+    ASSERT(wrapped().contextElementConcurrently().get());
+    visitor.addOpaqueRoot(root(wrapped().contextElementConcurrently().get()));
+}
+
+}

Modified: trunk/Source/WebCore/svg/SVGElement.h (239069 => 239070)


--- trunk/Source/WebCore/svg/SVGElement.h	2018-12-11 05:37:24 UTC (rev 239069)
+++ trunk/Source/WebCore/svg/SVGElement.h	2018-12-11 06:50:33 UTC (rev 239070)
@@ -31,6 +31,7 @@
 #include "StyledElement.h"
 #include <wtf/HashMap.h>
 #include <wtf/HashSet.h>
+#include <wtf/WeakPtr.h>
 
 namespace WebCore {
 
@@ -45,7 +46,7 @@
 
 void mapAttributeToCSSProperty(HashMap<AtomicStringImpl*, CSSPropertyID>* propertyNameToIdMap, const QualifiedName& attrName);
 
-class SVGElement : public StyledElement, public SVGLangSpace {
+class SVGElement : public StyledElement, public SVGLangSpace, public CanMakeWeakPtr<SVGElement> {
     WTF_MAKE_ISO_ALLOCATED(SVGElement);
 public:
     bool isOutermostSVGSVGElement() const;

Modified: trunk/Source/WebCore/svg/SVGPathElement.h (239069 => 239070)


--- trunk/Source/WebCore/svg/SVGPathElement.h	2018-12-11 05:37:24 UTC (rev 239069)
+++ trunk/Source/WebCore/svg/SVGPathElement.h	2018-12-11 06:50:33 UTC (rev 239070)
@@ -55,7 +55,7 @@
 class SVGPathSegList;
 class SVGPoint;
 
-class SVGPathElement final : public SVGGeometryElement, public SVGExternalResourcesRequired, public CanMakeWeakPtr<SVGPathElement> {
+class SVGPathElement final : public SVGGeometryElement, public SVGExternalResourcesRequired {
     WTF_MAKE_ISO_ALLOCATED(SVGPathElement);
 public:
     static Ref<SVGPathElement> create(const QualifiedName&, Document&);

Modified: trunk/Source/WebCore/svg/SVGViewSpec.cpp (239069 => 239070)


--- trunk/Source/WebCore/svg/SVGViewSpec.cpp	2018-12-11 05:37:24 UTC (rev 239069)
+++ trunk/Source/WebCore/svg/SVGViewSpec.cpp	2018-12-11 06:50:33 UTC (rev 239070)
@@ -34,7 +34,7 @@
 
 SVGViewSpec::SVGViewSpec(SVGElement& contextElement)
     : SVGFitToViewBox(&contextElement, PropertyIsReadOnly)
-    , m_contextElement(&contextElement)
+    , m_contextElement(makeWeakPtr(contextElement))
     , m_attributeOwnerProxy(*this, contextElement)
 {
     registerAttributes();

Modified: trunk/Source/WebCore/svg/SVGViewSpec.h (239069 => 239070)


--- trunk/Source/WebCore/svg/SVGViewSpec.h	2018-12-11 05:37:24 UTC (rev 239069)
+++ trunk/Source/WebCore/svg/SVGViewSpec.h	2018-12-11 06:50:33 UTC (rev 239070)
@@ -49,6 +49,8 @@
     RefPtr<SVGTransformList> transform();
     SVGTransformListValues transformValue() const { return m_transform.value(); }
 
+    const WeakPtr<SVGElement>& contextElementConcurrently() const { return m_contextElement; }
+
 private:
     explicit SVGViewSpec(SVGElement&);
 
@@ -58,7 +60,7 @@
     static AttributeOwnerProxy::AttributeRegistry& attributeRegistry() { return AttributeOwnerProxy::attributeRegistry(); }
     static bool isKnownAttribute(const QualifiedName& attributeName) { return AttributeOwnerProxy::isKnownAttribute(attributeName); }
 
-    SVGElement* m_contextElement;
+    WeakPtr<SVGElement> m_contextElement;
     String m_viewTargetString;
     AttributeOwnerProxy m_attributeOwnerProxy;
     SVGAnimatedTransformListAttribute m_transform;

Modified: trunk/Source/WebCore/svg/SVGViewSpec.idl (239069 => 239070)


--- trunk/Source/WebCore/svg/SVGViewSpec.idl	2018-12-11 05:37:24 UTC (rev 239069)
+++ trunk/Source/WebCore/svg/SVGViewSpec.idl	2018-12-11 06:50:33 UTC (rev 239070)
@@ -28,6 +28,7 @@
 // It would require that any of those classes would be RefCounted, and we want to avoid that.
 [
     ImplementationLacksVTable,
+    JSCustomMarkFunction,
     JSGenerateToJSObject,
 ] interface SVGViewSpec {
     readonly attribute SVGTransformList transform;

Copied: trunk/Source/WebCore/svg/properties/SVGAttributeOwnerProxy.cpp (from rev 239069, trunk/Source/WebCore/svg/SVGViewSpec.idl) (0 => 239070)


--- trunk/Source/WebCore/svg/properties/SVGAttributeOwnerProxy.cpp	                        (rev 0)
+++ trunk/Source/WebCore/svg/properties/SVGAttributeOwnerProxy.cpp	2018-12-11 06:50:33 UTC (rev 239070)
@@ -0,0 +1,43 @@
+/*
+ * Copyright (C) 2018 Apple Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "config.h"
+#include "SVGAttributeOwnerProxy.h"
+
+namespace WebCore {
+
+SVGAttributeOwnerProxy::SVGAttributeOwnerProxy(SVGElement& element)
+    : m_element(makeWeakPtr(element))
+{
+}
+
+SVGElement& SVGAttributeOwnerProxy::element() const
+{
+    return *m_element;
+}
+
+}

Modified: trunk/Source/WebCore/svg/properties/SVGAttributeOwnerProxy.h (239069 => 239070)


--- trunk/Source/WebCore/svg/properties/SVGAttributeOwnerProxy.h	2018-12-11 05:37:24 UTC (rev 239069)
+++ trunk/Source/WebCore/svg/properties/SVGAttributeOwnerProxy.h	2018-12-11 06:50:33 UTC (rev 239070)
@@ -26,6 +26,7 @@
 #pragma once
 
 #include "SVGAnimatedPropertyType.h"
+#include <wtf/WeakPtr.h>
 
 namespace WebCore {
 
@@ -35,14 +36,11 @@
 
 class SVGAttributeOwnerProxy {
 public:
-    SVGAttributeOwnerProxy(SVGElement& element)
-        : m_element(element)
-    {
-    }
+    SVGAttributeOwnerProxy(SVGElement&);
 
     virtual ~SVGAttributeOwnerProxy() = default;
 
-    SVGElement& element() const { return m_element; }
+    SVGElement& element() const;
 
     virtual void synchronizeAttributes() const = 0;
     virtual void synchronizeAttribute(const QualifiedName&) const = 0;
@@ -54,7 +52,7 @@
     virtual Vector<RefPtr<SVGAnimatedProperty>> lookupOrCreateAnimatedProperties(const QualifiedName&) const = 0;
 
 protected:
-    SVGElement& m_element;
+    WeakPtr<SVGElement> m_element;
 };
 
 }

Modified: trunk/Source/WebCore/svg/properties/SVGAttributeOwnerProxyImpl.h (239069 => 239070)


--- trunk/Source/WebCore/svg/properties/SVGAttributeOwnerProxyImpl.h	2018-12-11 05:37:24 UTC (rev 239069)
+++ trunk/Source/WebCore/svg/properties/SVGAttributeOwnerProxyImpl.h	2018-12-11 06:50:33 UTC (rev 239070)
@@ -68,12 +68,12 @@
 private:
     void synchronizeAttributes() const override
     {
-        attributeRegistry().synchronizeAttributes(m_owner, m_element);
+        attributeRegistry().synchronizeAttributes(m_owner, *m_element);
     }
 
     void synchronizeAttribute(const QualifiedName& attributeName) const override
     {
-        attributeRegistry().synchronizeAttribute(m_owner, m_element, attributeName);
+        attributeRegistry().synchronizeAttribute(m_owner, *m_element, attributeName);
     }
 
     Vector<AnimatedPropertyType> animatedTypes(const QualifiedName& attributeName) const override
@@ -83,17 +83,17 @@
 
     RefPtr<SVGAnimatedProperty> lookupOrCreateAnimatedProperty(const SVGAttribute& attribute) const override
     {
-        return attributeRegistry().lookupOrCreateAnimatedProperty(m_owner, m_element, attribute, m_animatedState);
+        return attributeRegistry().lookupOrCreateAnimatedProperty(m_owner, *m_element, attribute, m_animatedState);
     }
 
     RefPtr<SVGAnimatedProperty> lookupAnimatedProperty(const SVGAttribute& attribute) const override
     {
-        return attributeRegistry().lookupAnimatedProperty(m_owner, m_element, attribute);
+        return attributeRegistry().lookupAnimatedProperty(m_owner, *m_element, attribute);
     }
 
     Vector<RefPtr<SVGAnimatedProperty>> lookupOrCreateAnimatedProperties(const QualifiedName& attributeName) const override
     {
-        return attributeRegistry().lookupOrCreateAnimatedProperties(m_owner, m_element, attributeName, m_animatedState);
+        return attributeRegistry().lookupOrCreateAnimatedProperties(m_owner, *m_element, attributeName, m_animatedState);
     }
 
     OwnerType& m_owner;
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes

Reply via email to