Title: [250525] branches/safari-608-branch
Revision
250525
Author
[email protected]
Date
2019-09-30 13:16:00 -0700 (Mon, 30 Sep 2019)

Log Message

Cherry-pick r250488. rdar://problem/55826334

    Crash when removing the target element while animating its attributes
    https://bugs.webkit.org/show_bug.cgi?id=202247

    Reviewed by Darin Adler.

    Source/WebCore:

    If SMIL is animating a CSS attribute, there is a chance the animation is
    ended while it is being started or progressed. For that reason, the member
    SVGAnimateElementBase::m_animator has to be made RefPtr and it has to be
    be protected in resetAnimatedType() and calculateAnimatedValue().

    While SMILTimeContainer::updateAnimations() is calling progress() for the
    scheduled animation elements, SMILTimeContainer::unschedule() might get
    called if processing an animation causes events to be dispatched. For that
    reason we need to copy the scheduled animations Vector before processing
    them so we avoid changing the Vector while looping through its items.

    Remove the guard SMILTimeContainer::m_preventScheduledAnimationsChanges
    which was added in r129670 for debugging purposes. In some situations,
    the scheduled animations map could be modified out from under some of the
    functions of SMILTimeContainer.

    Test: svg/animations/animate-and-remove-target-element.html

    * svg/SVGAnimateElementBase.cpp:
    (WebCore::SVGAnimateElementBase::resetAnimatedType):
    (WebCore::SVGAnimateElementBase::calculateAnimatedValue):
    * svg/SVGAnimateElementBase.h:
    * svg/SVGElement.cpp:
    (WebCore::SVGElement::createAnimator):
    * svg/SVGElement.h:
    * svg/animation/SMILTimeContainer.cpp:
    (WebCore::SMILTimeContainer::schedule):
    (WebCore::SMILTimeContainer::unschedule):
    (WebCore::SMILTimeContainer::setElapsed):
    (WebCore::SMILTimeContainer::sortByPriority):
    (WebCore::SMILTimeContainer::processAnimations):
    (WebCore::SMILTimeContainer::processScheduledAnimations):
    (WebCore::SMILTimeContainer::updateAnimations):
    (WebCore::SMILTimeContainer::~SMILTimeContainer): Deleted.
    * svg/animation/SMILTimeContainer.h:
    * svg/animation/SVGSMILElement.cpp:
    (WebCore::SVGSMILElement::calculateNextProgressTime const):
    * svg/properties/SVGAnimatedPropertyAccessorImpl.h:
    * svg/properties/SVGAnimatedPropertyAnimatorImpl.h:
    * svg/properties/SVGAnimatedPropertyPairAccessorImpl.h:
    * svg/properties/SVGAnimatedPropertyPairAnimator.h:
    * svg/properties/SVGAnimatedPropertyPairAnimatorImpl.h:
    * svg/properties/SVGAttributeAnimator.h:
    * svg/properties/SVGMemberAccessor.h:
    (WebCore::SVGMemberAccessor::createAnimator const):
    * svg/properties/SVGPrimitivePropertyAnimator.h:
    (WebCore::SVGPrimitivePropertyAnimator::create):
    * svg/properties/SVGPropertyAnimatorFactory.h:
    (WebCore::SVGPropertyAnimatorFactory::createAnimator):
    * svg/properties/SVGPropertyOwnerRegistry.h:
    * svg/properties/SVGPropertyRegistry.h:
    * svg/properties/SVGValuePropertyAnimatorImpl.h:
    * svg/properties/SVGValuePropertyListAnimatorImpl.h:

    LayoutTests:

    * svg/animations/animate-and-remove-target-element-expected.txt: Added.
    * svg/animations/animate-and-remove-target-element.html: Added.

    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@250488 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Modified Paths

Added Paths

Diff

Modified: branches/safari-608-branch/LayoutTests/ChangeLog (250524 => 250525)


--- branches/safari-608-branch/LayoutTests/ChangeLog	2019-09-30 20:15:52 UTC (rev 250524)
+++ branches/safari-608-branch/LayoutTests/ChangeLog	2019-09-30 20:16:00 UTC (rev 250525)
@@ -1,3 +1,85 @@
+2019-09-30  Kocsen Chung  <[email protected]>
+
+        Cherry-pick r250488. rdar://problem/55826334
+
+    Crash when removing the target element while animating its attributes
+    https://bugs.webkit.org/show_bug.cgi?id=202247
+    
+    Reviewed by Darin Adler.
+    
+    Source/WebCore:
+    
+    If SMIL is animating a CSS attribute, there is a chance the animation is
+    ended while it is being started or progressed. For that reason, the member
+    SVGAnimateElementBase::m_animator has to be made RefPtr and it has to be
+    be protected in resetAnimatedType() and calculateAnimatedValue().
+    
+    While SMILTimeContainer::updateAnimations() is calling progress() for the
+    scheduled animation elements, SMILTimeContainer::unschedule() might get
+    called if processing an animation causes events to be dispatched. For that
+    reason we need to copy the scheduled animations Vector before processing
+    them so we avoid changing the Vector while looping through its items.
+    
+    Remove the guard SMILTimeContainer::m_preventScheduledAnimationsChanges
+    which was added in r129670 for debugging purposes. In some situations,
+    the scheduled animations map could be modified out from under some of the
+    functions of SMILTimeContainer.
+    
+    Test: svg/animations/animate-and-remove-target-element.html
+    
+    * svg/SVGAnimateElementBase.cpp:
+    (WebCore::SVGAnimateElementBase::resetAnimatedType):
+    (WebCore::SVGAnimateElementBase::calculateAnimatedValue):
+    * svg/SVGAnimateElementBase.h:
+    * svg/SVGElement.cpp:
+    (WebCore::SVGElement::createAnimator):
+    * svg/SVGElement.h:
+    * svg/animation/SMILTimeContainer.cpp:
+    (WebCore::SMILTimeContainer::schedule):
+    (WebCore::SMILTimeContainer::unschedule):
+    (WebCore::SMILTimeContainer::setElapsed):
+    (WebCore::SMILTimeContainer::sortByPriority):
+    (WebCore::SMILTimeContainer::processAnimations):
+    (WebCore::SMILTimeContainer::processScheduledAnimations):
+    (WebCore::SMILTimeContainer::updateAnimations):
+    (WebCore::SMILTimeContainer::~SMILTimeContainer): Deleted.
+    * svg/animation/SMILTimeContainer.h:
+    * svg/animation/SVGSMILElement.cpp:
+    (WebCore::SVGSMILElement::calculateNextProgressTime const):
+    * svg/properties/SVGAnimatedPropertyAccessorImpl.h:
+    * svg/properties/SVGAnimatedPropertyAnimatorImpl.h:
+    * svg/properties/SVGAnimatedPropertyPairAccessorImpl.h:
+    * svg/properties/SVGAnimatedPropertyPairAnimator.h:
+    * svg/properties/SVGAnimatedPropertyPairAnimatorImpl.h:
+    * svg/properties/SVGAttributeAnimator.h:
+    * svg/properties/SVGMemberAccessor.h:
+    (WebCore::SVGMemberAccessor::createAnimator const):
+    * svg/properties/SVGPrimitivePropertyAnimator.h:
+    (WebCore::SVGPrimitivePropertyAnimator::create):
+    * svg/properties/SVGPropertyAnimatorFactory.h:
+    (WebCore::SVGPropertyAnimatorFactory::createAnimator):
+    * svg/properties/SVGPropertyOwnerRegistry.h:
+    * svg/properties/SVGPropertyRegistry.h:
+    * svg/properties/SVGValuePropertyAnimatorImpl.h:
+    * svg/properties/SVGValuePropertyListAnimatorImpl.h:
+    
+    LayoutTests:
+    
+    * svg/animations/animate-and-remove-target-element-expected.txt: Added.
+    * svg/animations/animate-and-remove-target-element.html: Added.
+    
+    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@250488 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+    2019-09-28  Said Abou-Hallawa  <[email protected]>
+
+            Crash when removing the target element while animating its attributes
+            https://bugs.webkit.org/show_bug.cgi?id=202247
+
+            Reviewed by Darin Adler.
+
+            * svg/animations/animate-and-remove-target-element-expected.txt: Added.
+            * svg/animations/animate-and-remove-target-element.html: Added.
+
 2019-09-30  Babak Shafiei  <[email protected]>
 
         Cherry-pick r248591. rdar://problem/55826878

Added: branches/safari-608-branch/LayoutTests/svg/animations/animate-and-remove-target-element-expected.txt (0 => 250525)


--- branches/safari-608-branch/LayoutTests/svg/animations/animate-and-remove-target-element-expected.txt	                        (rev 0)
+++ branches/safari-608-branch/LayoutTests/svg/animations/animate-and-remove-target-element-expected.txt	2019-09-30 20:16:00 UTC (rev 250525)
@@ -0,0 +1,4 @@
+Passes if it does not crash.
+
+ 
+

Added: branches/safari-608-branch/LayoutTests/svg/animations/animate-and-remove-target-element.html (0 => 250525)


--- branches/safari-608-branch/LayoutTests/svg/animations/animate-and-remove-target-element.html	                        (rev 0)
+++ branches/safari-608-branch/LayoutTests/svg/animations/animate-and-remove-target-element.html	2019-09-30 20:16:00 UTC (rev 250525)
@@ -0,0 +1,33 @@
+<body>
+    <p>Passes if it does not crash.</p>
+    <form>
+        <select id="select" _onfocus_="onFocus()" multiple></select>
+        <keygen/>
+    </form>
+    <svg id="svg">
+        <animate attributeName="opacity" _onbegin_="onBegin()"/>
+    </svg>
+    <script>
+        if (window.testRunner) {
+            testRunner.dumpAsText();
+            testRunner.waitUntilDone();
+        }
+
+        window.addEventListener('load', (event) => {
+            select.autofocus = true;
+        });
+
+        function onFocus(){
+            svg.remove();
+        }
+
+        function onBegin(){
+            select.removeAttribute("multiple");
+            svg.setCurrentTime(9);
+            setTimeout(() => {
+                if (window.testRunner)
+                    testRunner.notifyDone();
+            });
+        }
+    </script>
+</body>

Modified: branches/safari-608-branch/Source/WebCore/ChangeLog (250524 => 250525)


--- branches/safari-608-branch/Source/WebCore/ChangeLog	2019-09-30 20:15:52 UTC (rev 250524)
+++ branches/safari-608-branch/Source/WebCore/ChangeLog	2019-09-30 20:16:00 UTC (rev 250525)
@@ -1,5 +1,138 @@
 2019-09-30  Kocsen Chung  <[email protected]>
 
+        Cherry-pick r250488. rdar://problem/55826334
+
+    Crash when removing the target element while animating its attributes
+    https://bugs.webkit.org/show_bug.cgi?id=202247
+    
+    Reviewed by Darin Adler.
+    
+    Source/WebCore:
+    
+    If SMIL is animating a CSS attribute, there is a chance the animation is
+    ended while it is being started or progressed. For that reason, the member
+    SVGAnimateElementBase::m_animator has to be made RefPtr and it has to be
+    be protected in resetAnimatedType() and calculateAnimatedValue().
+    
+    While SMILTimeContainer::updateAnimations() is calling progress() for the
+    scheduled animation elements, SMILTimeContainer::unschedule() might get
+    called if processing an animation causes events to be dispatched. For that
+    reason we need to copy the scheduled animations Vector before processing
+    them so we avoid changing the Vector while looping through its items.
+    
+    Remove the guard SMILTimeContainer::m_preventScheduledAnimationsChanges
+    which was added in r129670 for debugging purposes. In some situations,
+    the scheduled animations map could be modified out from under some of the
+    functions of SMILTimeContainer.
+    
+    Test: svg/animations/animate-and-remove-target-element.html
+    
+    * svg/SVGAnimateElementBase.cpp:
+    (WebCore::SVGAnimateElementBase::resetAnimatedType):
+    (WebCore::SVGAnimateElementBase::calculateAnimatedValue):
+    * svg/SVGAnimateElementBase.h:
+    * svg/SVGElement.cpp:
+    (WebCore::SVGElement::createAnimator):
+    * svg/SVGElement.h:
+    * svg/animation/SMILTimeContainer.cpp:
+    (WebCore::SMILTimeContainer::schedule):
+    (WebCore::SMILTimeContainer::unschedule):
+    (WebCore::SMILTimeContainer::setElapsed):
+    (WebCore::SMILTimeContainer::sortByPriority):
+    (WebCore::SMILTimeContainer::processAnimations):
+    (WebCore::SMILTimeContainer::processScheduledAnimations):
+    (WebCore::SMILTimeContainer::updateAnimations):
+    (WebCore::SMILTimeContainer::~SMILTimeContainer): Deleted.
+    * svg/animation/SMILTimeContainer.h:
+    * svg/animation/SVGSMILElement.cpp:
+    (WebCore::SVGSMILElement::calculateNextProgressTime const):
+    * svg/properties/SVGAnimatedPropertyAccessorImpl.h:
+    * svg/properties/SVGAnimatedPropertyAnimatorImpl.h:
+    * svg/properties/SVGAnimatedPropertyPairAccessorImpl.h:
+    * svg/properties/SVGAnimatedPropertyPairAnimator.h:
+    * svg/properties/SVGAnimatedPropertyPairAnimatorImpl.h:
+    * svg/properties/SVGAttributeAnimator.h:
+    * svg/properties/SVGMemberAccessor.h:
+    (WebCore::SVGMemberAccessor::createAnimator const):
+    * svg/properties/SVGPrimitivePropertyAnimator.h:
+    (WebCore::SVGPrimitivePropertyAnimator::create):
+    * svg/properties/SVGPropertyAnimatorFactory.h:
+    (WebCore::SVGPropertyAnimatorFactory::createAnimator):
+    * svg/properties/SVGPropertyOwnerRegistry.h:
+    * svg/properties/SVGPropertyRegistry.h:
+    * svg/properties/SVGValuePropertyAnimatorImpl.h:
+    * svg/properties/SVGValuePropertyListAnimatorImpl.h:
+    
+    LayoutTests:
+    
+    * svg/animations/animate-and-remove-target-element-expected.txt: Added.
+    * svg/animations/animate-and-remove-target-element.html: Added.
+    
+    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@250488 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+    2019-09-28  Said Abou-Hallawa  <[email protected]>
+
+            Crash when removing the target element while animating its attributes
+            https://bugs.webkit.org/show_bug.cgi?id=202247
+
+            Reviewed by Darin Adler.
+
+            If SMIL is animating a CSS attribute, there is a chance the animation is
+            ended while it is being started or progressed. For that reason, the member
+            SVGAnimateElementBase::m_animator has to be made RefPtr and it has to be
+            be protected in resetAnimatedType() and calculateAnimatedValue().
+
+            While SMILTimeContainer::updateAnimations() is calling progress() for the
+            scheduled animation elements, SMILTimeContainer::unschedule() might get
+            called if processing an animation causes events to be dispatched. For that
+            reason we need to copy the scheduled animations Vector before processing
+            them so we avoid changing the Vector while looping through its items.
+
+            Remove the guard SMILTimeContainer::m_preventScheduledAnimationsChanges
+            which was added in r129670 for debugging purposes. In some situations,
+            the scheduled animations map could be modified out from under some of the
+            functions of SMILTimeContainer.
+
+            Test: svg/animations/animate-and-remove-target-element.html
+
+            * svg/SVGAnimateElementBase.cpp:
+            (WebCore::SVGAnimateElementBase::resetAnimatedType):
+            (WebCore::SVGAnimateElementBase::calculateAnimatedValue):
+            * svg/SVGAnimateElementBase.h:
+            * svg/SVGElement.cpp:
+            (WebCore::SVGElement::createAnimator):
+            * svg/SVGElement.h:
+            * svg/animation/SMILTimeContainer.cpp:
+            (WebCore::SMILTimeContainer::schedule):
+            (WebCore::SMILTimeContainer::unschedule):
+            (WebCore::SMILTimeContainer::setElapsed):
+            (WebCore::SMILTimeContainer::sortByPriority):
+            (WebCore::SMILTimeContainer::processAnimations):
+            (WebCore::SMILTimeContainer::processScheduledAnimations):
+            (WebCore::SMILTimeContainer::updateAnimations):
+            (WebCore::SMILTimeContainer::~SMILTimeContainer): Deleted.
+            * svg/animation/SMILTimeContainer.h:
+            * svg/animation/SVGSMILElement.cpp:
+            (WebCore::SVGSMILElement::calculateNextProgressTime const):
+            * svg/properties/SVGAnimatedPropertyAccessorImpl.h:
+            * svg/properties/SVGAnimatedPropertyAnimatorImpl.h:
+            * svg/properties/SVGAnimatedPropertyPairAccessorImpl.h:
+            * svg/properties/SVGAnimatedPropertyPairAnimator.h:
+            * svg/properties/SVGAnimatedPropertyPairAnimatorImpl.h:
+            * svg/properties/SVGAttributeAnimator.h:
+            * svg/properties/SVGMemberAccessor.h:
+            (WebCore::SVGMemberAccessor::createAnimator const):
+            * svg/properties/SVGPrimitivePropertyAnimator.h:
+            (WebCore::SVGPrimitivePropertyAnimator::create):
+            * svg/properties/SVGPropertyAnimatorFactory.h:
+            (WebCore::SVGPropertyAnimatorFactory::createAnimator):
+            * svg/properties/SVGPropertyOwnerRegistry.h:
+            * svg/properties/SVGPropertyRegistry.h:
+            * svg/properties/SVGValuePropertyAnimatorImpl.h:
+            * svg/properties/SVGValuePropertyListAnimatorImpl.h:
+
+2019-09-30  Kocsen Chung  <[email protected]>
+
         Cherry-pick r249822. rdar://problem/55826334
 
     SVGLengthValue should use two enums for 'type' and 'mode' instead of one unsigned for 'units'

Modified: branches/safari-608-branch/Source/WebCore/svg/SVGAnimateElementBase.cpp (250524 => 250525)


--- branches/safari-608-branch/Source/WebCore/svg/SVGAnimateElementBase.cpp	2019-09-30 20:15:52 UTC (rev 250524)
+++ branches/safari-608-branch/Source/WebCore/svg/SVGAnimateElementBase.cpp	2019-09-30 20:16:00 UTC (rev 250525)
@@ -147,8 +147,8 @@
     if (!targetElement())
         return;
 
-    if (auto* animator = this->animator())
-        animator->start(targetElement());
+    if (auto protectedAnimator = makeRefPtr(this->animator()))
+        protectedAnimator->start(targetElement());
 }
 
 void SVGAnimateElementBase::calculateAnimatedValue(float progress, unsigned repeatCount, SVGSMILElement*)
@@ -163,8 +163,8 @@
     if (calcMode() == CalcMode::Discrete)
         progress = progress < 0.5 ? 0 : 1;
 
-    if (auto* animator = this->animator())
-        animator->animate(targetElement(), progress, repeatCount);
+    if (auto protectedAnimator = makeRefPtr(this->animator()))
+        protectedAnimator->animate(targetElement(), progress, repeatCount);
 }
 
 void SVGAnimateElementBase::applyResultsToTarget()

Modified: branches/safari-608-branch/Source/WebCore/svg/SVGAnimateElementBase.h (250524 => 250525)


--- branches/safari-608-branch/Source/WebCore/svg/SVGAnimateElementBase.h	2019-09-30 20:15:52 UTC (rev 250524)
+++ branches/safari-608-branch/Source/WebCore/svg/SVGAnimateElementBase.h	2019-09-30 20:16:00 UTC (rev 250525)
@@ -62,7 +62,7 @@
 private:
     bool hasInvalidCSSAttributeType() const;
 
-    mutable std::unique_ptr<SVGAttributeAnimator> m_animator;
+    mutable RefPtr<SVGAttributeAnimator> m_animator;
     mutable Optional<bool> m_hasInvalidCSSAttributeType;
 };
 

Modified: branches/safari-608-branch/Source/WebCore/svg/SVGElement.cpp (250524 => 250525)


--- branches/safari-608-branch/Source/WebCore/svg/SVGElement.cpp	2019-09-30 20:15:52 UTC (rev 250524)
+++ branches/safari-608-branch/Source/WebCore/svg/SVGElement.cpp	2019-09-30 20:16:00 UTC (rev 250525)
@@ -611,7 +611,7 @@
     return SVGPropertyAnimatorFactory::isKnownAttribute(attributeName) || propertyRegistry().isAnimatedStylePropertyAttribute(attributeName);
 }
 
-std::unique_ptr<SVGAttributeAnimator> SVGElement::createAnimator(const QualifiedName& attributeName, AnimationMode animationMode, CalcMode calcMode, bool isAccumulated, bool isAdditive)
+RefPtr<SVGAttributeAnimator> SVGElement::createAnimator(const QualifiedName& attributeName, AnimationMode animationMode, CalcMode calcMode, bool isAccumulated, bool isAdditive)
 {
     // Property animator, e.g. "fill" or "fill-opacity".
     if (auto animator = propertyAnimatorFactory().createAnimator(attributeName, animationMode, calcMode, isAccumulated, isAdditive))

Modified: branches/safari-608-branch/Source/WebCore/svg/SVGElement.h (250524 => 250525)


--- branches/safari-608-branch/Source/WebCore/svg/SVGElement.h	2019-09-30 20:15:52 UTC (rev 250524)
+++ branches/safari-608-branch/Source/WebCore/svg/SVGElement.h	2019-09-30 20:16:00 UTC (rev 250525)
@@ -143,7 +143,7 @@
 
     const SVGElement* attributeContextElement() const override { return this; }
     SVGPropertyAnimatorFactory& propertyAnimatorFactory() { return *m_propertyAnimatorFactory; }
-    std::unique_ptr<SVGAttributeAnimator> createAnimator(const QualifiedName&, AnimationMode, CalcMode, bool isAccumulated, bool isAdditive);
+    RefPtr<SVGAttributeAnimator> createAnimator(const QualifiedName&, AnimationMode, CalcMode, bool isAccumulated, bool isAdditive);
     void animatorWillBeDeleted(const QualifiedName&);
 
     // These are needed for the RenderTree, animation and DOM.

Modified: branches/safari-608-branch/Source/WebCore/svg/animation/SMILTimeContainer.cpp (250524 => 250525)


--- branches/safari-608-branch/Source/WebCore/svg/animation/SMILTimeContainer.cpp	2019-09-30 20:15:52 UTC (rev 250524)
+++ branches/safari-608-branch/Source/WebCore/svg/animation/SMILTimeContainer.cpp	2019-09-30 20:16:00 UTC (rev 250525)
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008-2019 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -44,13 +44,6 @@
 {
 }
 
-SMILTimeContainer::~SMILTimeContainer()
-{
-#ifndef NDEBUG
-    ASSERT(!m_preventScheduledAnimationsChanges);
-#endif
-}
-
 void SMILTimeContainer::schedule(SVGSMILElement* animation, SVGElement* target, const QualifiedName& attributeName)
 {
     ASSERT(animation->timeContainer() == this);
@@ -57,10 +50,6 @@
     ASSERT(target);
     ASSERT(animation->hasValidAttributeName());
 
-#ifndef NDEBUG
-    ASSERT(!m_preventScheduledAnimationsChanges);
-#endif
-
     ElementAttributePair key(target, attributeName);
     std::unique_ptr<AnimationsVector>& scheduled = m_scheduledAnimations.add(key, nullptr).iterator->value;
     if (!scheduled)
@@ -77,10 +66,6 @@
 {
     ASSERT(animation->timeContainer() == this);
 
-#ifndef NDEBUG
-    ASSERT(!m_preventScheduledAnimationsChanges);
-#endif
-
     ElementAttributePair key(target, attributeName);
     AnimationsVector* scheduled = m_scheduledAnimations.get(key);
     ASSERT(scheduled);
@@ -184,16 +169,9 @@
     } else
         m_resumeTime = m_beginTime;
 
-#ifndef NDEBUG
-    m_preventScheduledAnimationsChanges = true;
-#endif
-    for (auto& animation : m_scheduledAnimations.values()) {
-        for (auto& element : *animation)
-            element->reset();
-    }
-#ifndef NDEBUG
-    m_preventScheduledAnimationsChanges = false;
-#endif
+    processScheduledAnimations([](auto* animation) {
+        animation->reset();
+    });
 
     updateAnimations(time, true);
 }
@@ -244,86 +222,78 @@
     SMILTime m_elapsed;
 };
 
-void SMILTimeContainer::sortByPriority(Vector<SVGSMILElement*>& smilElements, SMILTime elapsed)
+void SMILTimeContainer::sortByPriority(AnimationsVector& animations, SMILTime elapsed)
 {
     if (m_documentOrderIndexesDirty)
         updateDocumentOrderIndexes();
-    std::sort(smilElements.begin(), smilElements.end(), PriorityCompare(elapsed));
+    std::sort(animations.begin(), animations.end(), PriorityCompare(elapsed));
 }
 
+void SMILTimeContainer::processAnimations(const AnimationsVector& animations, Function<void(SVGSMILElement*)>&& callback)
+{
+    // 'animations' may change if 'callback' causes an animation to end which will end up calling
+    // unschedule(). Copy 'animations' so none of the items gets deleted out from underneath us.
+    auto animationsCopy = animations;
+    for (auto* animation : animations)
+        callback(animation);
+}
+
+void SMILTimeContainer::processScheduledAnimations(Function<void(SVGSMILElement*)>&& callback)
+{
+    for (auto& it : m_scheduledAnimations)
+        processAnimations(*it.value, WTFMove(callback));
+}
+
 void SMILTimeContainer::updateAnimations(SMILTime elapsed, bool seekToTime)
 {
-    SMILTime earliestFireTime = SMILTime::unresolved();
-
     // Don't mutate the DOM while updating the animations.
     EventQueueScope scope;
-    
-#ifndef NDEBUG
-    // This boolean will catch any attempts to schedule/unschedule scheduledAnimations during this critical section.
-    // Similarly, any elements removed will unschedule themselves, so this will catch modification of animationsToApply.
-    m_preventScheduledAnimationsChanges = true;
-#endif
 
+    processScheduledAnimations([](auto* animation) {
+        if (!animation->hasConditionsConnected())
+            animation->connectConditions();
+    });
+
     AnimationsVector animationsToApply;
+    SMILTime earliestFireTime = SMILTime::unresolved();
+
     for (auto& it : m_scheduledAnimations) {
-        AnimationsVector* scheduled = it.value.get();
-        for (auto* animation : *scheduled) {
-            if (!animation->hasConditionsConnected())
-                animation->connectConditions();
-        }
-    }
-    
-    for (auto& it : m_scheduledAnimations) {
-        AnimationsVector* scheduled = it.value.get();
-
         // Sort according to priority. Elements with later begin time have higher priority.
-        // In case of a tie, document order decides. 
+        // In case of a tie, document order decides.
         // FIXME: This should also consider timing relationships between the elements. Dependents
         // have higher priority.
-        sortByPriority(*scheduled, elapsed);
+        sortByPriority(*it.value, elapsed);
 
-        RefPtr<SVGSMILElement> resultElement;
-        for (auto& animation : *scheduled) {
+        RefPtr<SVGSMILElement> firstAnimation;
+        processAnimations(*it.value, [&](auto* animation) {
             ASSERT(animation->timeContainer() == this);
             ASSERT(animation->targetElement());
             ASSERT(animation->hasValidAttributeName());
 
             // Results are accumulated to the first animation that animates and contributes to a particular element/attribute pair.
-            if (!resultElement) {
+            if (!firstAnimation) {
                 if (!animation->hasValidAttributeType())
-                    continue;
-                resultElement = animation;
+                    return;
+                firstAnimation = animation;
             }
 
             // This will calculate the contribution from the animation and add it to the resultsElement.
-            if (!animation->progress(elapsed, resultElement.get(), seekToTime) && resultElement == animation)
-                resultElement = nullptr;
+            if (!animation->progress(elapsed, firstAnimation.get(), seekToTime) && firstAnimation == animation)
+                firstAnimation = nullptr;
 
             SMILTime nextFireTime = animation->nextProgressTime();
             if (nextFireTime.isFinite())
                 earliestFireTime = std::min(nextFireTime, earliestFireTime);
-        }
+        });
 
-        if (resultElement)
-            animationsToApply.append(resultElement.get());
+        if (firstAnimation)
+            animationsToApply.append(firstAnimation.get());
     }
 
-    if (animationsToApply.isEmpty()) {
-#ifndef NDEBUG
-        m_preventScheduledAnimationsChanges = false;
-#endif
-        startTimer(elapsed, earliestFireTime, animationFrameDelay());
-        return;
-    }
-
     // Apply results to target elements.
     for (auto& animation : animationsToApply)
         animation->applyResultsToTarget();
 
-#ifndef NDEBUG
-    m_preventScheduledAnimationsChanges = false;
-#endif
-
     startTimer(elapsed, earliestFireTime, animationFrameDelay());
 }
 

Modified: branches/safari-608-branch/Source/WebCore/svg/animation/SMILTimeContainer.h (250524 => 250525)


--- branches/safari-608-branch/Source/WebCore/svg/animation/SMILTimeContainer.h	2019-09-30 20:15:52 UTC (rev 250524)
+++ branches/safari-608-branch/Source/WebCore/svg/animation/SMILTimeContainer.h	2019-09-30 20:16:00 UTC (rev 250525)
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008-2019 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -42,7 +42,6 @@
 class SMILTimeContainer final : public RefCounted<SMILTimeContainer>  {
 public:
     static Ref<SMILTimeContainer> create(SVGSVGElement& owner) { return adoptRef(*new SMILTimeContainer(owner)); }
-    ~SMILTimeContainer();
 
     void schedule(SVGSMILElement*, SVGElement*, const QualifiedName&);
     void unschedule(SVGSMILElement*, SVGElement*, const QualifiedName&);
@@ -69,9 +68,15 @@
     void timerFired();
     void startTimer(SMILTime elapsed, SMILTime fireTime, SMILTime minimumDelay = 0);
     void updateAnimations(SMILTime elapsed, bool seekToTime = false);
-    
+
+    typedef std::pair<SVGElement*, QualifiedName> ElementAttributePair;
+    typedef Vector<SVGSMILElement*> AnimationsVector;
+    typedef HashMap<ElementAttributePair, std::unique_ptr<AnimationsVector>> GroupedAnimationsMap;
+
+    void processAnimations(const AnimationsVector&, Function<void(SVGSMILElement*)>&&);
+    void processScheduledAnimations(Function<void(SVGSMILElement*)>&&);
     void updateDocumentOrderIndexes();
-    void sortByPriority(Vector<SVGSMILElement*>& smilElements, SMILTime elapsed);
+    void sortByPriority(AnimationsVector& smilElements, SMILTime elapsed);
 
     MonotonicTime m_beginTime;
     MonotonicTime m_pauseTime;
@@ -80,19 +85,9 @@
     Seconds m_presetStartTime { 0_s };
 
     bool m_documentOrderIndexesDirty { false };
-    
     Timer m_timer;
-
-    typedef std::pair<SVGElement*, QualifiedName> ElementAttributePair;
-    typedef Vector<SVGSMILElement*> AnimationsVector;
-    typedef HashMap<ElementAttributePair, std::unique_ptr<AnimationsVector>> GroupedAnimationsMap;
     GroupedAnimationsMap m_scheduledAnimations;
-
     SVGSVGElement& m_ownerSVGElement;
-
-#ifndef NDEBUG
-    bool m_preventScheduledAnimationsChanges { false };
-#endif
 };
 
 } // namespace WebCore

Modified: branches/safari-608-branch/Source/WebCore/svg/animation/SVGSMILElement.cpp (250524 => 250525)


--- branches/safari-608-branch/Source/WebCore/svg/animation/SVGSMILElement.cpp	2019-09-30 20:15:52 UTC (rev 250524)
+++ branches/safari-608-branch/Source/WebCore/svg/animation/SVGSMILElement.cpp	2019-09-30 20:16:00 UTC (rev 250525)
@@ -1040,8 +1040,7 @@
     
 SMILTime SVGSMILElement::calculateNextProgressTime(SMILTime elapsed) const
 {
-    ASSERT(m_timeContainer);
-    if (m_activeState == Active) {
+    if (m_timeContainer && m_activeState == Active) {
         // If duration is indefinite the value does not actually change over time. Same is true for <set>.
         SMILTime simpleDuration = this->simpleDuration();
         if (simpleDuration.isIndefinite() || hasTagName(SVGNames::setTag)) {

Modified: branches/safari-608-branch/Source/WebCore/svg/properties/SVGAnimatedPropertyAccessorImpl.h (250524 => 250525)


--- branches/safari-608-branch/Source/WebCore/svg/properties/SVGAnimatedPropertyAccessorImpl.h	2019-09-30 20:15:52 UTC (rev 250524)
+++ branches/safari-608-branch/Source/WebCore/svg/properties/SVGAnimatedPropertyAccessorImpl.h	2019-09-30 20:16:00 UTC (rev 250525)
@@ -53,7 +53,7 @@
     constexpr static const SVGMemberAccessor<OwnerType>& singleton() { return Base::template singleton<SVGAnimatedBooleanAccessor, property>(); }
 
 private:
-    std::unique_ptr<SVGAttributeAnimator> createAnimator(OwnerType& owner, const QualifiedName& attributeName, AnimationMode animationMode, CalcMode calcMode, bool isAccumulated, bool isAdditive) const final
+    RefPtr<SVGAttributeAnimator> createAnimator(OwnerType& owner, const QualifiedName& attributeName, AnimationMode animationMode, CalcMode calcMode, bool isAccumulated, bool isAdditive) const final
     {
         return SVGAnimatedBooleanAnimator::create(attributeName, property(owner), animationMode, calcMode, isAccumulated, isAdditive);
     }
@@ -75,7 +75,7 @@
     constexpr static const SVGMemberAccessor<OwnerType>& singleton() { return Base::template singleton<SVGAnimatedEnumerationAccessor, property>(); }
 
 private:
-    std::unique_ptr<SVGAttributeAnimator> createAnimator(OwnerType& owner, const QualifiedName& attributeName, AnimationMode animationMode, CalcMode calcMode, bool isAccumulated, bool isAdditive) const final
+    RefPtr<SVGAttributeAnimator> createAnimator(OwnerType& owner, const QualifiedName& attributeName, AnimationMode animationMode, CalcMode calcMode, bool isAccumulated, bool isAdditive) const final
     {
         return SVGAnimatedEnumerationAnimator<EnumType>::create(attributeName, property(owner), animationMode, calcMode, isAccumulated, isAdditive);
     }
@@ -97,7 +97,7 @@
     constexpr static const SVGMemberAccessor<OwnerType>& singleton() { return Base::template singleton<SVGAnimatedIntegerAccessor, property>(); }
 
 private:
-    std::unique_ptr<SVGAttributeAnimator> createAnimator(OwnerType& owner, const QualifiedName& attributeName, AnimationMode animationMode, CalcMode calcMode, bool isAccumulated, bool isAdditive) const final
+    RefPtr<SVGAttributeAnimator> createAnimator(OwnerType& owner, const QualifiedName& attributeName, AnimationMode animationMode, CalcMode calcMode, bool isAccumulated, bool isAdditive) const final
     {
         return SVGAnimatedIntegerAnimator::create(attributeName, property(owner), animationMode, calcMode, isAccumulated, isAdditive);
     }
@@ -121,7 +121,7 @@
 private:
     bool isAnimatedLength() const override { return true; }
 
-    std::unique_ptr<SVGAttributeAnimator> createAnimator(OwnerType& owner, const QualifiedName& attributeName, AnimationMode animationMode, CalcMode calcMode, bool isAccumulated, bool isAdditive) const final
+    RefPtr<SVGAttributeAnimator> createAnimator(OwnerType& owner, const QualifiedName& attributeName, AnimationMode animationMode, CalcMode calcMode, bool isAccumulated, bool isAdditive) const final
     {
         SVGLengthMode lengthMode = property(owner)->baseVal()->value().lengthMode();
         return SVGAnimatedLengthAnimator::create(attributeName, property(owner), animationMode, calcMode, isAccumulated, isAdditive, lengthMode);
@@ -144,7 +144,7 @@
     constexpr static const SVGMemberAccessor<OwnerType>& singleton() { return Base::template singleton<SVGAnimatedLengthListAccessor, property>(); }
 
 private:
-    std::unique_ptr<SVGAttributeAnimator> createAnimator(OwnerType& owner, const QualifiedName& attributeName, AnimationMode animationMode, CalcMode calcMode, bool isAccumulated, bool isAdditive) const final
+    RefPtr<SVGAttributeAnimator> createAnimator(OwnerType& owner, const QualifiedName& attributeName, AnimationMode animationMode, CalcMode calcMode, bool isAccumulated, bool isAdditive) const final
     {
         return SVGAnimatedLengthListAnimator::create(attributeName, property(owner), animationMode, calcMode, isAccumulated, isAdditive, SVGLengthMode::Width);
     }
@@ -166,7 +166,7 @@
     constexpr static const SVGMemberAccessor<OwnerType>& singleton() { return Base::template singleton<SVGAnimatedNumberAccessor, property>(); }
 
 private:
-    std::unique_ptr<SVGAttributeAnimator> createAnimator(OwnerType& owner, const QualifiedName& attributeName, AnimationMode animationMode, CalcMode calcMode, bool isAccumulated, bool isAdditive) const final
+    RefPtr<SVGAttributeAnimator> createAnimator(OwnerType& owner, const QualifiedName& attributeName, AnimationMode animationMode, CalcMode calcMode, bool isAccumulated, bool isAdditive) const final
     {
         return SVGAnimatedNumberAnimator::create(attributeName, property(owner), animationMode, calcMode, isAccumulated, isAdditive);
     }
@@ -188,7 +188,7 @@
     constexpr static const SVGMemberAccessor<OwnerType>& singleton() { return Base::template singleton<SVGAnimatedNumberListAccessor, property>(); }
 
 private:
-    std::unique_ptr<SVGAttributeAnimator> createAnimator(OwnerType& owner, const QualifiedName& attributeName, AnimationMode animationMode, CalcMode calcMode, bool isAccumulated, bool isAdditive) const final
+    RefPtr<SVGAttributeAnimator> createAnimator(OwnerType& owner, const QualifiedName& attributeName, AnimationMode animationMode, CalcMode calcMode, bool isAccumulated, bool isAdditive) const final
     {
         return SVGAnimatedNumberListAnimator::create(attributeName, property(owner), animationMode, calcMode, isAccumulated, isAdditive);
     }
@@ -210,7 +210,7 @@
     constexpr static const SVGMemberAccessor<OwnerType>& singleton() { return Base::template singleton<SVGAnimatedPathSegListAccessor, property>(); }
 
 private:
-    std::unique_ptr<SVGAttributeAnimator> createAnimator(OwnerType& owner, const QualifiedName& attributeName, AnimationMode animationMode, CalcMode calcMode, bool isAccumulated, bool isAdditive) const final
+    RefPtr<SVGAttributeAnimator> createAnimator(OwnerType& owner, const QualifiedName& attributeName, AnimationMode animationMode, CalcMode calcMode, bool isAccumulated, bool isAdditive) const final
     {
         return SVGAnimatedPathSegListAnimator::create(attributeName, property(owner), animationMode, calcMode, isAccumulated, isAdditive);
     }
@@ -232,7 +232,7 @@
     constexpr static const SVGMemberAccessor<OwnerType>& singleton() { return Base::template singleton<SVGAnimatedPointListAccessor, property>(); }
 
 private:
-    std::unique_ptr<SVGAttributeAnimator> createAnimator(OwnerType& owner, const QualifiedName& attributeName, AnimationMode animationMode, CalcMode calcMode, bool isAccumulated, bool isAdditive) const final
+    RefPtr<SVGAttributeAnimator> createAnimator(OwnerType& owner, const QualifiedName& attributeName, AnimationMode animationMode, CalcMode calcMode, bool isAccumulated, bool isAdditive) const final
     {
         return SVGAnimatedPointListAnimator::create(attributeName, property(owner), animationMode, calcMode, isAccumulated, isAdditive);
     }
@@ -264,7 +264,7 @@
     constexpr static const SVGMemberAccessor<OwnerType>& singleton() { return Base::template singleton<SVGAnimatedPreserveAspectRatioAccessor, property>(); }
 
 private:
-    std::unique_ptr<SVGAttributeAnimator> createAnimator(OwnerType& owner, const QualifiedName& attributeName, AnimationMode animationMode, CalcMode calcMode, bool isAccumulated, bool isAdditive) const final
+    RefPtr<SVGAttributeAnimator> createAnimator(OwnerType& owner, const QualifiedName& attributeName, AnimationMode animationMode, CalcMode calcMode, bool isAccumulated, bool isAdditive) const final
     {
         return SVGAnimatedPreserveAspectRatioAnimator::create(attributeName, property(owner), animationMode, calcMode, isAccumulated, isAdditive);
     }
@@ -286,7 +286,7 @@
     constexpr static const SVGMemberAccessor<OwnerType>& singleton() { return Base::template singleton<SVGAnimatedRectAccessor, property>(); }
 
 private:
-    std::unique_ptr<SVGAttributeAnimator> createAnimator(OwnerType& owner, const QualifiedName& attributeName, AnimationMode animationMode, CalcMode calcMode, bool isAccumulated, bool isAdditive) const final
+    RefPtr<SVGAttributeAnimator> createAnimator(OwnerType& owner, const QualifiedName& attributeName, AnimationMode animationMode, CalcMode calcMode, bool isAccumulated, bool isAdditive) const final
     {
         return SVGAnimatedRectAnimator::create(attributeName, property(owner), animationMode, calcMode, isAccumulated, isAdditive);
     }
@@ -308,7 +308,7 @@
     constexpr static const SVGMemberAccessor<OwnerType>& singleton() { return Base::template singleton<SVGAnimatedStringAccessor, property>(); }
 
 private:
-    std::unique_ptr<SVGAttributeAnimator> createAnimator(OwnerType& owner, const QualifiedName& attributeName, AnimationMode animationMode, CalcMode calcMode, bool isAccumulated, bool isAdditive) const final
+    RefPtr<SVGAttributeAnimator> createAnimator(OwnerType& owner, const QualifiedName& attributeName, AnimationMode animationMode, CalcMode calcMode, bool isAccumulated, bool isAdditive) const final
     {
         return SVGAnimatedStringAnimator::create(attributeName, property(owner), animationMode, calcMode, isAccumulated, isAdditive);
     }
@@ -330,7 +330,7 @@
     constexpr static const SVGMemberAccessor<OwnerType>& singleton() { return Base::template singleton<SVGAnimatedTransformListAccessor, property>(); }
 
 private:
-    std::unique_ptr<SVGAttributeAnimator> createAnimator(OwnerType& owner, const QualifiedName& attributeName, AnimationMode animationMode, CalcMode calcMode, bool isAccumulated, bool isAdditive) const final
+    RefPtr<SVGAttributeAnimator> createAnimator(OwnerType& owner, const QualifiedName& attributeName, AnimationMode animationMode, CalcMode calcMode, bool isAccumulated, bool isAdditive) const final
     {
         return SVGAnimatedTransformListAnimator::create(attributeName, property(owner), animationMode, calcMode, isAccumulated, isAdditive);
     }

Modified: branches/safari-608-branch/Source/WebCore/svg/properties/SVGAnimatedPropertyAnimatorImpl.h (250524 => 250525)


--- branches/safari-608-branch/Source/WebCore/svg/properties/SVGAnimatedPropertyAnimatorImpl.h	2019-09-30 20:15:52 UTC (rev 250524)
+++ branches/safari-608-branch/Source/WebCore/svg/properties/SVGAnimatedPropertyAnimatorImpl.h	2019-09-30 20:16:00 UTC (rev 250525)
@@ -50,7 +50,7 @@
 public:
     static auto create(const QualifiedName& attributeName, Ref<SVGAnimatedAngle>& animated, AnimationMode animationMode, CalcMode calcMode, bool isAccumulated, bool isAdditive)
     {
-        return std::make_unique<SVGAnimatedAngleAnimator>(attributeName, animated, animationMode, calcMode, isAccumulated, isAdditive);
+        return adoptRef(*new SVGAnimatedAngleAnimator(attributeName, animated, animationMode, calcMode, isAccumulated, isAdditive));
     }
 
 private:
@@ -68,7 +68,7 @@
 
     static auto create(const QualifiedName& attributeName, Ref<SVGAnimatedBoolean>& animated, AnimationMode animationMode, CalcMode calcMode, bool isAccumulated, bool isAdditive)
     {
-        return std::make_unique<SVGAnimatedBooleanAnimator>(attributeName, animated, animationMode, calcMode, isAccumulated, isAdditive);
+        return adoptRef(*new SVGAnimatedBooleanAnimator(attributeName, animated, animationMode, calcMode, isAccumulated, isAdditive));
     }
 
 private:
@@ -89,7 +89,7 @@
 public:
     static auto create(const QualifiedName& attributeName, Ref<SVGAnimatedEnumeration>& animated, AnimationMode animationMode, CalcMode calcMode, bool isAccumulated, bool isAdditive)
     {
-        return std::make_unique<SVGAnimatedEnumerationAnimator<EnumType>>(attributeName, animated, animationMode, calcMode, isAccumulated, isAdditive);
+        return adoptRef(*new SVGAnimatedEnumerationAnimator<EnumType>(attributeName, animated, animationMode, calcMode, isAccumulated, isAdditive));
     }
 
 private:
@@ -111,7 +111,7 @@
 
     static auto create(const QualifiedName& attributeName, Ref<SVGAnimatedInteger>& animated, AnimationMode animationMode, CalcMode calcMode, bool isAccumulated, bool isAdditive)
     {
-        return std::make_unique<SVGAnimatedIntegerAnimator>(attributeName, animated, animationMode, calcMode, isAccumulated, isAdditive);
+        return adoptRef(*new SVGAnimatedIntegerAnimator(attributeName, animated, animationMode, calcMode, isAccumulated, isAdditive));
     }
 
 private:
@@ -132,7 +132,7 @@
 
     static auto create(const QualifiedName& attributeName, Ref<SVGAnimatedLength>& animated, AnimationMode animationMode, CalcMode calcMode, bool isAccumulated, bool isAdditive, SVGLengthMode lengthMode)
     {
-        return std::make_unique<SVGAnimatedLengthAnimator>(attributeName, animated, animationMode, calcMode, isAccumulated, isAdditive, lengthMode);
+        return adoptRef(*new SVGAnimatedLengthAnimator(attributeName, animated, animationMode, calcMode, isAccumulated, isAdditive, lengthMode));
     }
 
 private:
@@ -153,7 +153,7 @@
 
     static auto create(const QualifiedName& attributeName, Ref<SVGAnimatedLengthList>& animated, AnimationMode animationMode, CalcMode calcMode, bool isAccumulated, bool isAdditive, SVGLengthMode lengthMode)
     {
-        return std::make_unique<SVGAnimatedLengthListAnimator>(attributeName, animated, animationMode, calcMode, isAccumulated, isAdditive, lengthMode);
+        return adoptRef(*new SVGAnimatedLengthListAnimator(attributeName, animated, animationMode, calcMode, isAccumulated, isAdditive, lengthMode));
     }
 
 private:
@@ -172,7 +172,7 @@
 public:
     static auto create(const QualifiedName& attributeName, Ref<SVGAnimatedNumber>& animated, AnimationMode animationMode, CalcMode calcMode, bool isAccumulated, bool isAdditive)
     {
-        return std::make_unique<SVGAnimatedNumberAnimator>(attributeName, animated, animationMode, calcMode, isAccumulated, isAdditive);
+        return adoptRef(*new SVGAnimatedNumberAnimator(attributeName, animated, animationMode, calcMode, isAccumulated, isAdditive));
     }
 
 private:
@@ -189,7 +189,7 @@
 public:
     static auto create(const QualifiedName& attributeName, Ref<SVGAnimatedNumberList>& animated, AnimationMode animationMode, CalcMode calcMode, bool isAccumulated, bool isAdditive)
     {
-        return std::make_unique<SVGAnimatedNumberListAnimator>(attributeName, animated, animationMode, calcMode, isAccumulated, isAdditive);
+        return adoptRef(*new SVGAnimatedNumberListAnimator(attributeName, animated, animationMode, calcMode, isAccumulated, isAdditive));
     }
     
 private:
@@ -206,7 +206,7 @@
 public:
     static auto create(const QualifiedName& attributeName, Ref<SVGAnimatedPathSegList>& animated, AnimationMode animationMode, CalcMode calcMode, bool isAccumulated, bool isAdditive)
     {
-        return std::make_unique<SVGAnimatedPathSegListAnimator>(attributeName, animated, animationMode, calcMode, isAccumulated, isAdditive);
+        return adoptRef(*new SVGAnimatedPathSegListAnimator(attributeName, animated, animationMode, calcMode, isAccumulated, isAdditive));
     }
 
 private:
@@ -224,7 +224,7 @@
 public:
     static auto create(const QualifiedName& attributeName, Ref<SVGAnimatedPointList>& animated, AnimationMode animationMode, CalcMode calcMode, bool isAccumulated, bool isAdditive)
     {
-        return std::make_unique<SVGAnimatedPointListAnimator>(attributeName, animated, animationMode, calcMode, isAccumulated, isAdditive);
+        return adoptRef(*new SVGAnimatedPointListAnimator(attributeName, animated, animationMode, calcMode, isAccumulated, isAdditive));
     }
     
 private:
@@ -243,7 +243,7 @@
 public:
     static auto create(const QualifiedName& attributeName, Ref<SVGAnimatedOrientType>& animated, AnimationMode animationMode, CalcMode calcMode, bool isAccumulated, bool isAdditive)
     {
-        return std::make_unique<SVGAnimatedOrientTypeAnimator>(attributeName, animated, animationMode, calcMode, isAccumulated, isAdditive);
+        return adoptRef(*new SVGAnimatedOrientTypeAnimator(attributeName, animated, animationMode, calcMode, isAccumulated, isAdditive));
     }
 
 private:
@@ -262,7 +262,7 @@
 public:
     static auto create(const QualifiedName& attributeName, Ref<SVGAnimatedPreserveAspectRatio>& animated, AnimationMode animationMode, CalcMode calcMode, bool isAccumulated, bool isAdditive)
     {
-        return std::make_unique<SVGAnimatedPreserveAspectRatioAnimator>(attributeName, animated, animationMode, calcMode, isAccumulated, isAdditive);
+        return adoptRef(*new SVGAnimatedPreserveAspectRatioAnimator(attributeName, animated, animationMode, calcMode, isAccumulated, isAdditive));
     }
 
 private:
@@ -281,7 +281,7 @@
 
     static auto create(const QualifiedName& attributeName, Ref<SVGAnimatedRect>& animated, AnimationMode animationMode, CalcMode calcMode, bool isAccumulated, bool isAdditive)
     {
-        return std::make_unique<SVGAnimatedRectAnimator>(attributeName, animated, animationMode, calcMode, isAccumulated, isAdditive);
+        return adoptRef(*new SVGAnimatedRectAnimator(attributeName, animated, animationMode, calcMode, isAccumulated, isAdditive));
     }
 
 private:
@@ -298,7 +298,7 @@
 public:
     static auto create(const QualifiedName& attributeName, Ref<SVGAnimatedString>& animated, AnimationMode animationMode, CalcMode calcMode, bool isAccumulated, bool isAdditive)
     {
-        return std::make_unique<SVGAnimatedStringAnimator>(attributeName, animated, animationMode, calcMode, isAccumulated, isAdditive);
+        return adoptRef(*new SVGAnimatedStringAnimator(attributeName, animated, animationMode, calcMode, isAccumulated, isAdditive));
     }
 
 private:
@@ -338,7 +338,7 @@
 public:
     static auto create(const QualifiedName& attributeName, Ref<SVGAnimatedTransformList>& animated, AnimationMode animationMode, CalcMode calcMode, bool isAccumulated, bool isAdditive)
     {
-        return std::make_unique<SVGAnimatedTransformListAnimator>(attributeName, animated, animationMode, calcMode, isAccumulated, isAdditive);
+        return adoptRef(*new SVGAnimatedTransformListAnimator(attributeName, animated, animationMode, calcMode, isAccumulated, isAdditive));
     }
 
 private:

Modified: branches/safari-608-branch/Source/WebCore/svg/properties/SVGAnimatedPropertyPairAccessorImpl.h (250524 => 250525)


--- branches/safari-608-branch/Source/WebCore/svg/properties/SVGAnimatedPropertyPairAccessorImpl.h	2019-09-30 20:15:52 UTC (rev 250524)
+++ branches/safari-608-branch/Source/WebCore/svg/properties/SVGAnimatedPropertyPairAccessorImpl.h	2019-09-30 20:16:00 UTC (rev 250525)
@@ -60,7 +60,7 @@
         return type == SVGMarkerOrientAuto || type == SVGMarkerOrientAutoStartReverse ? string2 : string1;
     }
 
-    std::unique_ptr<SVGAttributeAnimator> createAnimator(OwnerType& owner, const QualifiedName& attributeName, AnimationMode animationMode, CalcMode calcMode, bool isAccumulated, bool isAdditive) const final
+    RefPtr<SVGAttributeAnimator> createAnimator(OwnerType& owner, const QualifiedName& attributeName, AnimationMode animationMode, CalcMode calcMode, bool isAccumulated, bool isAdditive) const final
     {
         return SVGAnimatedAngleOrientAnimator::create(attributeName, property1(owner), property2(owner), animationMode, calcMode, isAccumulated, isAdditive);
     }
@@ -95,7 +95,7 @@
         return string1 == string2 ? string1 : string1 + ", " + string2;
     }
 
-    std::unique_ptr<SVGAttributeAnimator> createAnimator(OwnerType& owner, const QualifiedName& attributeName, AnimationMode animationMode, CalcMode calcMode, bool isAccumulated, bool isAdditive) const final
+    RefPtr<SVGAttributeAnimator> createAnimator(OwnerType& owner, const QualifiedName& attributeName, AnimationMode animationMode, CalcMode calcMode, bool isAccumulated, bool isAdditive) const final
     {
         return SVGAnimatedIntegerPairAnimator::create(attributeName, property1(owner), property2(owner), animationMode, calcMode, isAccumulated, isAdditive);
     }
@@ -130,7 +130,7 @@
         return string1 == string2 ? string1 : string1 + ", " + string2;
     }
 
-    std::unique_ptr<SVGAttributeAnimator> createAnimator(OwnerType& owner, const QualifiedName& attributeName, AnimationMode animationMode, CalcMode calcMode, bool isAccumulated, bool isAdditive) const final
+    RefPtr<SVGAttributeAnimator> createAnimator(OwnerType& owner, const QualifiedName& attributeName, AnimationMode animationMode, CalcMode calcMode, bool isAccumulated, bool isAdditive) const final
     {
         return SVGAnimatedNumberPairAnimator::create(attributeName, property1(owner), property2(owner), animationMode, calcMode, isAccumulated, isAdditive);
     }

Modified: branches/safari-608-branch/Source/WebCore/svg/properties/SVGAnimatedPropertyPairAnimator.h (250524 => 250525)


--- branches/safari-608-branch/Source/WebCore/svg/properties/SVGAnimatedPropertyPairAnimator.h	2019-09-30 20:15:52 UTC (rev 250524)
+++ branches/safari-608-branch/Source/WebCore/svg/properties/SVGAnimatedPropertyPairAnimator.h	2019-09-30 20:16:00 UTC (rev 250525)
@@ -74,8 +74,8 @@
         m_animatedPropertyAnimator2->stop(targetElement);
     }
 
-    std::unique_ptr<AnimatedPropertyAnimator1> m_animatedPropertyAnimator1;
-    std::unique_ptr<AnimatedPropertyAnimator2> m_animatedPropertyAnimator2;
+    Ref<AnimatedPropertyAnimator1> m_animatedPropertyAnimator1;
+    Ref<AnimatedPropertyAnimator2> m_animatedPropertyAnimator2;
 };
 
 }

Modified: branches/safari-608-branch/Source/WebCore/svg/properties/SVGAnimatedPropertyPairAnimatorImpl.h (250524 => 250525)


--- branches/safari-608-branch/Source/WebCore/svg/properties/SVGAnimatedPropertyPairAnimatorImpl.h	2019-09-30 20:15:52 UTC (rev 250524)
+++ branches/safari-608-branch/Source/WebCore/svg/properties/SVGAnimatedPropertyPairAnimatorImpl.h	2019-09-30 20:16:00 UTC (rev 250525)
@@ -40,7 +40,7 @@
 public:
     static auto create(const QualifiedName& attributeName, Ref<SVGAnimatedAngle>& animated1, Ref<SVGAnimatedOrientType>& animated2, AnimationMode animationMode, CalcMode calcMode, bool isAccumulated, bool isAdditive)
     {
-        return std::make_unique<SVGAnimatedAngleOrientAnimator>(attributeName, animated1, animated2, animationMode, calcMode, isAccumulated, isAdditive);
+        return adoptRef(*new SVGAnimatedAngleOrientAnimator(attributeName, animated1, animated2, animationMode, calcMode, isAccumulated, isAdditive));
     }
 
 private:
@@ -113,7 +113,7 @@
 public:
     static auto create(const QualifiedName& attributeName, Ref<SVGAnimatedInteger>& animated1, Ref<SVGAnimatedInteger>& animated2, AnimationMode animationMode, CalcMode calcMode, bool isAccumulated, bool isAdditive)
     {
-        return std::make_unique<SVGAnimatedIntegerPairAnimator>(attributeName, animated1, animated2, animationMode, calcMode, isAccumulated, isAdditive);
+        return adoptRef(*new SVGAnimatedIntegerPairAnimator(attributeName, animated1, animated2, animationMode, calcMode, isAccumulated, isAdditive));
     }
 
 private:
@@ -156,7 +156,7 @@
 public:
     static auto create(const QualifiedName& attributeName, Ref<SVGAnimatedNumber>& animated1, Ref<SVGAnimatedNumber>& animated2, AnimationMode animationMode, CalcMode calcMode, bool isAccumulated, bool isAdditive)
     {
-        return std::make_unique<SVGAnimatedNumberPairAnimator>(attributeName, animated1, animated2, animationMode, calcMode, isAccumulated, isAdditive);
+        return adoptRef(*new SVGAnimatedNumberPairAnimator(attributeName, animated1, animated2, animationMode, calcMode, isAccumulated, isAdditive));
     }
 
 private:

Modified: branches/safari-608-branch/Source/WebCore/svg/properties/SVGAttributeAnimator.h (250524 => 250525)


--- branches/safari-608-branch/Source/WebCore/svg/properties/SVGAttributeAnimator.h	2019-09-30 20:15:52 UTC (rev 250524)
+++ branches/safari-608-branch/Source/WebCore/svg/properties/SVGAttributeAnimator.h	2019-09-30 20:16:00 UTC (rev 250525)
@@ -51,7 +51,7 @@
     Spline
 };
 
-class SVGAttributeAnimator {
+class SVGAttributeAnimator : public RefCounted<SVGAttributeAnimator> {
 public:
     SVGAttributeAnimator(const QualifiedName& attributeName)
         : m_attributeName(attributeName)

Modified: branches/safari-608-branch/Source/WebCore/svg/properties/SVGMemberAccessor.h (250524 => 250525)


--- branches/safari-608-branch/Source/WebCore/svg/properties/SVGMemberAccessor.h	2019-09-30 20:15:52 UTC (rev 250524)
+++ branches/safari-608-branch/Source/WebCore/svg/properties/SVGMemberAccessor.h	2019-09-30 20:16:00 UTC (rev 250525)
@@ -47,7 +47,7 @@
     virtual bool matches(const OwnerType&, const SVGAnimatedProperty&) const { return false; }
     virtual Optional<String> synchronize(const OwnerType&) const { return WTF::nullopt; }
 
-    virtual std::unique_ptr<SVGAttributeAnimator> createAnimator(OwnerType&, const QualifiedName&, AnimationMode, CalcMode, bool, bool) const { return nullptr; }
+    virtual RefPtr<SVGAttributeAnimator> createAnimator(OwnerType&, const QualifiedName&, AnimationMode, CalcMode, bool, bool) const { return nullptr; }
     virtual void appendAnimatedInstance(OwnerType&, SVGAttributeAnimator&) const { }
 
 protected:

Modified: branches/safari-608-branch/Source/WebCore/svg/properties/SVGPrimitivePropertyAnimator.h (250524 => 250525)


--- branches/safari-608-branch/Source/WebCore/svg/properties/SVGPrimitivePropertyAnimator.h	2019-09-30 20:15:52 UTC (rev 250524)
+++ branches/safari-608-branch/Source/WebCore/svg/properties/SVGPrimitivePropertyAnimator.h	2019-09-30 20:16:00 UTC (rev 250525)
@@ -44,7 +44,7 @@
 public:
     static auto create(const QualifiedName& attributeName, Ref<SVGProperty>&& property, AnimationMode animationMode, CalcMode calcMode, bool isAccumulated, bool isAdditive)
     {
-        return std::make_unique<SVGPrimitivePropertyAnimator>(attributeName, WTFMove(property), animationMode, calcMode, isAccumulated, isAdditive);
+        return adoptRef(*new SVGPrimitivePropertyAnimator(attributeName, WTFMove(property), animationMode, calcMode, isAccumulated, isAdditive));
     }
     
     template<typename... Arguments>

Modified: branches/safari-608-branch/Source/WebCore/svg/properties/SVGPropertyAnimatorFactory.h (250524 => 250525)


--- branches/safari-608-branch/Source/WebCore/svg/properties/SVGPropertyAnimatorFactory.h	2019-09-30 20:15:52 UTC (rev 250524)
+++ branches/safari-608-branch/Source/WebCore/svg/properties/SVGPropertyAnimatorFactory.h	2019-09-30 20:16:00 UTC (rev 250525)
@@ -42,7 +42,7 @@
         return attributeAnimatorCreator().contains(attributeName.impl());
     }
 
-    std::unique_ptr<SVGAttributeAnimator> createAnimator(const QualifiedName& attributeName, AnimationMode animationMode, CalcMode calcMode, bool isAccumulated, bool isAdditive)
+    RefPtr<SVGAttributeAnimator> createAnimator(const QualifiedName& attributeName, AnimationMode animationMode, CalcMode calcMode, bool isAccumulated, bool isAdditive)
     {
         auto iterator = attributeAnimatorCreator().find(attributeName.impl());
         if (iterator == attributeAnimatorCreator().end())
@@ -74,7 +74,7 @@
         QualifiedName::QualifiedNameImpl*,
         std::pair<
             std::function<Ref<SVGProperty>()>,
-            std::function<std::unique_ptr<SVGAttributeAnimator>(const QualifiedName&, Ref<SVGProperty>&&, AnimationMode, CalcMode, bool, bool)>
+            std::function<Ref<SVGAttributeAnimator>(const QualifiedName&, Ref<SVGProperty>&&, AnimationMode, CalcMode, bool, bool)>
         >
     >;
 

Modified: branches/safari-608-branch/Source/WebCore/svg/properties/SVGPropertyOwnerRegistry.h (250524 => 250525)


--- branches/safari-608-branch/Source/WebCore/svg/properties/SVGPropertyOwnerRegistry.h	2019-09-30 20:15:52 UTC (rev 250524)
+++ branches/safari-608-branch/Source/WebCore/svg/properties/SVGPropertyOwnerRegistry.h	2019-09-30 20:16:00 UTC (rev 250525)
@@ -266,9 +266,9 @@
         return isAnimatedLengthAttribute(attributeName) && animatedStyleAttributes.get().contains(attributeName.impl());
     }
 
-    std::unique_ptr<SVGAttributeAnimator> createAnimator(const QualifiedName& attributeName, AnimationMode animationMode, CalcMode calcMode, bool isAccumulated, bool isAdditive) const override
+    RefPtr<SVGAttributeAnimator> createAnimator(const QualifiedName& attributeName, AnimationMode animationMode, CalcMode calcMode, bool isAccumulated, bool isAdditive) const override
     {
-        std::unique_ptr<SVGAttributeAnimator> animator;
+        RefPtr<SVGAttributeAnimator> animator;
         enumerateRecursively([&](const auto& entry) -> bool {
             if (!entry.key.matches(attributeName))
                 return true;

Modified: branches/safari-608-branch/Source/WebCore/svg/properties/SVGPropertyRegistry.h (250524 => 250525)


--- branches/safari-608-branch/Source/WebCore/svg/properties/SVGPropertyRegistry.h	2019-09-30 20:15:52 UTC (rev 250524)
+++ branches/safari-608-branch/Source/WebCore/svg/properties/SVGPropertyRegistry.h	2019-09-30 20:16:00 UTC (rev 250525)
@@ -44,7 +44,7 @@
 
     virtual bool isAnimatedPropertyAttribute(const QualifiedName&) const = 0;
     virtual bool isAnimatedStylePropertyAttribute(const QualifiedName&) const = 0;
-    virtual std::unique_ptr<SVGAttributeAnimator> createAnimator(const QualifiedName&, AnimationMode, CalcMode, bool isAccumulated, bool isAdditive) const = 0;
+    virtual RefPtr<SVGAttributeAnimator> createAnimator(const QualifiedName&, AnimationMode, CalcMode, bool isAccumulated, bool isAdditive) const = 0;
     virtual void appendAnimatedInstance(const QualifiedName& attributeName, SVGAttributeAnimator&) const = 0;
 };
 

Modified: branches/safari-608-branch/Source/WebCore/svg/properties/SVGValuePropertyAnimatorImpl.h (250524 => 250525)


--- branches/safari-608-branch/Source/WebCore/svg/properties/SVGValuePropertyAnimatorImpl.h	2019-09-30 20:15:52 UTC (rev 250524)
+++ branches/safari-608-branch/Source/WebCore/svg/properties/SVGValuePropertyAnimatorImpl.h	2019-09-30 20:16:00 UTC (rev 250525)
@@ -39,7 +39,7 @@
 public:
     static auto create(const QualifiedName& attributeName, Ref<SVGProperty>&& property, AnimationMode animationMode, CalcMode calcMode, bool isAccumulated, bool isAdditive)
     {
-        return std::make_unique<SVGLengthAnimator>(attributeName, WTFMove(property), animationMode, calcMode, isAccumulated, isAdditive, SVGLengthMode::Other);
+        return adoptRef(*new SVGLengthAnimator(attributeName, WTFMove(property), animationMode, calcMode, isAccumulated, isAdditive, SVGLengthMode::Other));
     }
 
     void start(SVGElement* targetElement) override

Modified: branches/safari-608-branch/Source/WebCore/svg/properties/SVGValuePropertyListAnimatorImpl.h (250524 => 250525)


--- branches/safari-608-branch/Source/WebCore/svg/properties/SVGValuePropertyListAnimatorImpl.h	2019-09-30 20:15:52 UTC (rev 250524)
+++ branches/safari-608-branch/Source/WebCore/svg/properties/SVGValuePropertyListAnimatorImpl.h	2019-09-30 20:16:00 UTC (rev 250525)
@@ -39,7 +39,7 @@
 public:
     static auto create(const QualifiedName& attributeName, Ref<SVGProperty>&& property, AnimationMode animationMode, CalcMode calcMode, bool isAccumulated, bool isAdditive)
     {
-        return std::make_unique<SVGLengthListAnimator>(attributeName, WTFMove(property), animationMode, calcMode, isAccumulated, isAdditive, SVGLengthMode::Other);
+        return adoptRef(*new SVGLengthListAnimator(attributeName, WTFMove(property), animationMode, calcMode, isAccumulated, isAdditive, SVGLengthMode::Other));
     }
 
     void start(SVGElement* targetElement) override
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes

Reply via email to