Title: [118878] branches/chromium/1132
- Revision
- 118878
- Author
- [email protected]
- Date
- 2012-05-29 18:55:21 -0700 (Tue, 29 May 2012)
Log Message
Merge 117792
BUG=127234
Review URL: https://chromiumcodereview.appspot.com/10443074
Modified Paths
Added Paths
Diff
Copied: branches/chromium/1132/LayoutTests/svg/custom/bug86119-expected.txt (from rev 117792, trunk/LayoutTests/svg/custom/bug86119-expected.txt) (0 => 118878)
--- branches/chromium/1132/LayoutTests/svg/custom/bug86119-expected.txt (rev 0)
+++ branches/chromium/1132/LayoutTests/svg/custom/bug86119-expected.txt 2012-05-30 01:55:21 UTC (rev 118878)
@@ -0,0 +1 @@
+Test for Bug 86119. Test passes if it does not crash.
Copied: branches/chromium/1132/LayoutTests/svg/custom/bug86119.html (from rev 117792, trunk/LayoutTests/svg/custom/bug86119.html) (0 => 118878)
--- branches/chromium/1132/LayoutTests/svg/custom/bug86119.html (rev 0)
+++ branches/chromium/1132/LayoutTests/svg/custom/bug86119.html 2012-05-30 01:55:21 UTC (rev 118878)
@@ -0,0 +1,47 @@
+<html>
+ <head>
+ <script>
+ if (window.layoutTestController) {
+ layoutTestController.dumpAsText();
+ }
+
+ function onload()
+ {
+ window.svgRoot = document.getElementById("svgRoot");
+ window.svgViewBaseVal = window.svgRoot.viewBox.baseVal;
+
+ // Cause GC of window.svgRoot.viewBox
+ if (window.GCController)
+ GCController.collect();
+
+ // Set a value on window.svgViewBaseVal
+ window.svgViewBaseVal.height = 56;
+ if (window.svgRoot.viewBox.baseVal.height != 56)
+ document.body.innerHTML = "FAIL";
+
+ // Repeat with a non-dom-attached viewBox
+ window.viewElement = parent.document.createElementNS("http://www.w3.org/2000/svg", "view");
+ window.viewBaseVal = window.viewElement.viewBox.baseVal;
+ if (window.GCController)
+ GCController.collect();
+ window.viewBaseVal.height = 12;
+ if (window.viewElement.viewBox.baseVal.height != 12)
+ document.body.innerHTML = "FAIL";
+ else {
+ document.body.appendChild(window.viewElement);
+ window.viewBaseVal.height = 34;
+ if (window.viewElement.viewBox.baseVal.height != 34)
+ document.body.innerHTML = "FAIL";
+ }
+ }
+ </script>
+ </head>
+ <body _onload_="onload()">
+ Test for Bug 86119. Test passes if it does not crash and you see a green
+ rectangle above this text.
+ <svg id="svgRoot" width="100" height="100" xmlns:svg="http://www.w3.org/2000/svg">
+ <rect x="10" height="80" width="80" y="10" fill="green"/>
+ </svg>
+ </body>
+</html>
+
Modified: branches/chromium/1132/Source/WebCore/svg/properties/SVGAnimatedPropertyTearOff.h (118877 => 118878)
--- branches/chromium/1132/Source/WebCore/svg/properties/SVGAnimatedPropertyTearOff.h 2012-05-30 01:52:13 UTC (rev 118877)
+++ branches/chromium/1132/Source/WebCore/svg/properties/SVGAnimatedPropertyTearOff.h 2012-05-30 01:55:21 UTC (rev 118878)
@@ -32,6 +32,18 @@
typedef SVGPropertyTearOff<PropertyType> PropertyTearOff;
typedef PropertyType ContentType;
+ virtual ~SVGAnimatedPropertyTearOff()
+ {
+ if (m_baseVal) {
+ ASSERT(m_baseVal->animatedProperty() == this);
+ m_baseVal->setAnimatedProperty(0);
+ }
+ if (m_animVal) {
+ ASSERT(m_animVal->animatedProperty() == this);
+ m_animVal->setAnimatedProperty(0);
+ }
+ }
+
PropertyTearOff* baseVal()
{
if (!m_baseVal)
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
