Title: [134851] trunk
- Revision
- 134851
- Author
- [email protected]
- Date
- 2012-11-15 16:22:02 -0800 (Thu, 15 Nov 2012)
Log Message
mpath elements do not clear resource lists before destruction
https://bugs.webkit.org/show_bug.cgi?id=101505
Reviewed by Abhishek Arya.
Source/WebCore:
The destructor for SVGMPathElement should clear its resources before
deletion, so as not to leave hanging pointers in resource lists.
Test: svg/animations/mpath-remove-from-dependents-on-delete-crash.html
* svg/SVGMPathElement.cpp:
(WebCore::SVGMPathElement::~SVGMPathElement): Add destructor that calls clearResourceReferences.
(WebCore):
* svg/SVGMPathElement.h:
(SVGMPathElement): Add destructor.
LayoutTests:
Test that causes a mpath element to be deleted before the path that it
references.
* svg/animations/mpath-remove-from-dependents-on-delete-crash-expected.html: Added.
* svg/animations/mpath-remove-from-dependents-on-delete-crash.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (134850 => 134851)
--- trunk/LayoutTests/ChangeLog 2012-11-16 00:17:56 UTC (rev 134850)
+++ trunk/LayoutTests/ChangeLog 2012-11-16 00:22:02 UTC (rev 134851)
@@ -1,5 +1,18 @@
2012-11-15 Stephen Chenney <[email protected]>
+ mpath elements do not clear resource lists before destruction
+ https://bugs.webkit.org/show_bug.cgi?id=101505
+
+ Reviewed by Abhishek Arya.
+
+ Test that causes a mpath element to be deleted before the path that it
+ references.
+
+ * svg/animations/mpath-remove-from-dependents-on-delete-crash-expected.html: Added.
+ * svg/animations/mpath-remove-from-dependents-on-delete-crash.html: Added.
+
+2012-11-15 Stephen Chenney <[email protected]>
+
[Chromium] Test expectations - we're passing!
Unreviewed expectations for canvas-shadow.html
Added: trunk/LayoutTests/svg/animations/mpath-remove-from-dependents-on-delete-crash-expected.html (0 => 134851)
--- trunk/LayoutTests/svg/animations/mpath-remove-from-dependents-on-delete-crash-expected.html (rev 0)
+++ trunk/LayoutTests/svg/animations/mpath-remove-from-dependents-on-delete-crash-expected.html 2012-11-16 00:22:02 UTC (rev 134851)
@@ -0,0 +1,5 @@
+<html>
+ <body>
+ PASS: WebKit did not crash.
+ </body>
+</html>
Added: trunk/LayoutTests/svg/animations/mpath-remove-from-dependents-on-delete-crash.html (0 => 134851)
--- trunk/LayoutTests/svg/animations/mpath-remove-from-dependents-on-delete-crash.html (rev 0)
+++ trunk/LayoutTests/svg/animations/mpath-remove-from-dependents-on-delete-crash.html 2012-11-16 00:22:02 UTC (rev 134851)
@@ -0,0 +1,37 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+ <body>
+ <svg id="svgRoot" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w-611.org/1999/xlink">
+ <path id="path_a" />
+ <circle id="myc">
+ <animateMotion id="A" >
+ <mpath xlink:href="" />
+ </animateMotion>
+ </circle>
+ </svg>
+
+ <script type="text/_javascript_">
+ if (window.testRunner) {
+ testRunner.waitUntilDone();
+ }
+ _onload_ = function() {
+ if (location.hash != '#10') {
+ if (window.GCController)
+ window.GCController.collect();
+ else if (window.gc)
+ gc();
+ document.getElementById("A").insertBefore(document.getElementById("path_a"));
+ if (location.hash == '')
+ location.hash = '#1';
+ else
+ location.hash = "#" + (parseInt(location.hash.slice(1)) + 1).toString();
+ setTimeout(function(){ location.reload() }, 0);
+ } else {
+ document.body.innerText = 'PASS: WebKit did not crash.';
+ if (window.testRunner)
+ testRunner.notifyDone();
+ }
+ }
+ </script>
+
+ </body>
+</html>
Modified: trunk/Source/WebCore/ChangeLog (134850 => 134851)
--- trunk/Source/WebCore/ChangeLog 2012-11-16 00:17:56 UTC (rev 134850)
+++ trunk/Source/WebCore/ChangeLog 2012-11-16 00:22:02 UTC (rev 134851)
@@ -1,3 +1,21 @@
+2012-11-15 Stephen Chenney <[email protected]>
+
+ mpath elements do not clear resource lists before destruction
+ https://bugs.webkit.org/show_bug.cgi?id=101505
+
+ Reviewed by Abhishek Arya.
+
+ The destructor for SVGMPathElement should clear its resources before
+ deletion, so as not to leave hanging pointers in resource lists.
+
+ Test: svg/animations/mpath-remove-from-dependents-on-delete-crash.html
+
+ * svg/SVGMPathElement.cpp:
+ (WebCore::SVGMPathElement::~SVGMPathElement): Add destructor that calls clearResourceReferences.
+ (WebCore):
+ * svg/SVGMPathElement.h:
+ (SVGMPathElement): Add destructor.
+
2012-11-15 Kentaro Hara <[email protected]>
Remove CodeGenerator::StripModule
Modified: trunk/Source/WebCore/svg/SVGMPathElement.cpp (134850 => 134851)
--- trunk/Source/WebCore/svg/SVGMPathElement.cpp 2012-11-16 00:17:56 UTC (rev 134850)
+++ trunk/Source/WebCore/svg/SVGMPathElement.cpp 2012-11-16 00:22:02 UTC (rev 134851)
@@ -50,6 +50,11 @@
return adoptRef(new SVGMPathElement(tagName, document));
}
+SVGMPathElement::~SVGMPathElement()
+{
+ clearResourceReferences();
+}
+
void SVGMPathElement::buildPendingResource()
{
clearResourceReferences();
Modified: trunk/Source/WebCore/svg/SVGMPathElement.h (134850 => 134851)
--- trunk/Source/WebCore/svg/SVGMPathElement.h 2012-11-16 00:17:56 UTC (rev 134850)
+++ trunk/Source/WebCore/svg/SVGMPathElement.h 2012-11-16 00:22:02 UTC (rev 134851)
@@ -37,6 +37,8 @@
public:
static PassRefPtr<SVGMPathElement> create(const QualifiedName&, Document*);
+ virtual ~SVGMPathElement();
+
SVGPathElement* pathElement();
void targetPathChanged();
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo/webkit-changes
