Title: [116860] trunk
- Revision
- 116860
- Author
- [email protected]
- Date
- 2012-05-12 12:14:19 -0700 (Sat, 12 May 2012)
Log Message
Cleanup before changing attributeName in SVG <animate>
https://bugs.webkit.org/show_bug.cgi?id=86100
Reviewed by Nikolas Zimmermann.
Source/WebCore:
Changing attributeName caused a crash because references were not removed from the old target.
This change simply cleans up before changing attributeName in SVG animation elements.
Test: svg/animations/dynamic-modify-attributename-crash.svg
* svg/animation/SVGSMILElement.cpp:
(WebCore::SVGSMILElement::svgAttributeChanged):
LayoutTests:
* svg/animations/dynamic-modify-attributename-crash-expected.txt: Added.
* svg/animations/dynamic-modify-attributename-crash.svg: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (116859 => 116860)
--- trunk/LayoutTests/ChangeLog 2012-05-12 18:08:59 UTC (rev 116859)
+++ trunk/LayoutTests/ChangeLog 2012-05-12 19:14:19 UTC (rev 116860)
@@ -1,3 +1,13 @@
+2012-05-12 Philip Rogers <[email protected]>
+
+ Cleanup before changing attributeName in SVG <animate>
+ https://bugs.webkit.org/show_bug.cgi?id=86100
+
+ Reviewed by Nikolas Zimmermann.
+
+ * svg/animations/dynamic-modify-attributename-crash-expected.txt: Added.
+ * svg/animations/dynamic-modify-attributename-crash.svg: Added.
+
2012-05-12 Max Feil <[email protected]>
[BlackBerry] Allow the platform media player to determine the media element's paused/playing status
Added: trunk/LayoutTests/svg/animations/dynamic-modify-attributename-crash-expected.txt (0 => 116860)
--- trunk/LayoutTests/svg/animations/dynamic-modify-attributename-crash-expected.txt (rev 0)
+++ trunk/LayoutTests/svg/animations/dynamic-modify-attributename-crash-expected.txt 2012-05-12 19:14:19 UTC (rev 116860)
@@ -0,0 +1 @@
+PASS
Added: trunk/LayoutTests/svg/animations/dynamic-modify-attributename-crash.svg (0 => 116860)
--- trunk/LayoutTests/svg/animations/dynamic-modify-attributename-crash.svg (rev 0)
+++ trunk/LayoutTests/svg/animations/dynamic-modify-attributename-crash.svg 2012-05-12 19:14:19 UTC (rev 116860)
@@ -0,0 +1,24 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+ <!-- Test for WK86100 - passes if there is no crash -->
+ <animate id="animate" attributeName="x" dur="9s"/>
+ <text id="log"/>
+ <script>
+ <![CDATA[
+ if (window.layoutTestController) {
+ layoutTestController.waitUntilDone();
+ layoutTestController.dumpAsText();
+ }
+
+ window.setTimeout(function() {
+ var elem = document.getElementById("animate");
+ elem.setAttribute("attributeName", "transform");
+ }, 10);
+
+ window.setTimeout(function() {
+ document.getElementById("log").appendChild(document.createTextNode("PASS"));
+ if (window.layoutTestController)
+ layoutTestController.notifyDone();
+ }, 100);
+ ]]>
+ </script>
+</svg>
Modified: trunk/Source/WebCore/ChangeLog (116859 => 116860)
--- trunk/Source/WebCore/ChangeLog 2012-05-12 18:08:59 UTC (rev 116859)
+++ trunk/Source/WebCore/ChangeLog 2012-05-12 19:14:19 UTC (rev 116860)
@@ -1,3 +1,18 @@
+2012-05-12 Philip Rogers <[email protected]>
+
+ Cleanup before changing attributeName in SVG <animate>
+ https://bugs.webkit.org/show_bug.cgi?id=86100
+
+ Reviewed by Nikolas Zimmermann.
+
+ Changing attributeName caused a crash because references were not removed from the old target.
+ This change simply cleans up before changing attributeName in SVG animation elements.
+
+ Test: svg/animations/dynamic-modify-attributename-crash.svg
+
+ * svg/animation/SVGSMILElement.cpp:
+ (WebCore::SVGSMILElement::svgAttributeChanged):
+
2012-05-12 Max Feil <[email protected]>
[BlackBerry] Allow the platform media player to determine the media element's paused/playing status
Modified: trunk/Source/WebCore/svg/animation/SVGSMILElement.cpp (116859 => 116860)
--- trunk/Source/WebCore/svg/animation/SVGSMILElement.cpp 2012-05-12 18:08:59 UTC (rev 116859)
+++ trunk/Source/WebCore/svg/animation/SVGSMILElement.cpp 2012-05-12 19:14:19 UTC (rev 116860)
@@ -466,9 +466,13 @@
beginListChanged(elapsed());
else if (attrName == SVGNames::endAttr)
endListChanged(elapsed());
- else if (attrName == SVGNames::attributeNameAttr)
+ else if (attrName == SVGNames::attributeNameAttr) {
m_attributeName = constructQualifiedName(this, fastGetAttribute(SVGNames::attributeNameAttr));
- else if (attrName.matches(XLinkNames::hrefAttr)) {
+ if (m_targetElement) {
+ resetTargetElement();
+ return;
+ }
+ } else if (attrName.matches(XLinkNames::hrefAttr)) {
if (SVGElement* targetElement = this->targetElement())
document()->accessSVGExtensions()->removeAllAnimationElementsFromTarget(targetElement);
}
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
