Modified: trunk/Source/WebCore/ChangeLog (135792 => 135793)
--- trunk/Source/WebCore/ChangeLog 2012-11-27 01:50:21 UTC (rev 135792)
+++ trunk/Source/WebCore/ChangeLog 2012-11-27 01:52:14 UTC (rev 135793)
@@ -1,3 +1,23 @@
+2012-11-26 Andreas Kling <[email protected]>
+
+ Node: Remove IsSynchronizingSVGAttributesFlag.
+ <http://webkit.org/b/103328>
+
+ Reviewed by Antti Koivisto.
+
+ Animated SVG attributes used to be synchronized by using DOM API which could use unwanted re-entrancy
+ via callbacks below Element::attributeChanged(). The "is synchronizing SVG attributes" flag was used
+ to protect against such re-entrancy.
+
+ These days, lazy attributes are synchronized using Element::setSynchronizedLazyAttribute() to avoid
+ issues like this. The flag does nothing, so we can just remove it.
+
+ * dom/Node.h:
+ (WebCore):
+ * svg/SVGElement.cpp:
+ (WebCore::SVGElement::attributeChanged):
+ (WebCore::SVGElement::updateAnimatedSVGAttribute):
+
2012-11-26 Kentaro Hara <[email protected]>
[V8] Refactor WorkerScriptController
Modified: trunk/Source/WebCore/dom/Node.h (135792 => 135793)
--- trunk/Source/WebCore/dom/Node.h 2012-11-27 01:50:21 UTC (rev 135792)
+++ trunk/Source/WebCore/dom/Node.h 2012-11-27 01:52:14 UTC (rev 135793)
@@ -98,7 +98,7 @@
typedef int ExceptionCode;
-const int nodeStyleChangeShift = 19;
+const int nodeStyleChangeShift = 18;
// SyntheticStyleChange means that we need to go through the entire style change logic even though
// no style property has actually changed. It is used to restructure the tree when, for instance,
@@ -706,23 +706,22 @@
IsParsingChildrenFinishedFlag = 1 << 15, // Element
#if ENABLE(SVG)
AreSVGAttributesValidFlag = 1 << 16, // Element
- IsSynchronizingSVGAttributesFlag = 1 << 17, // SVGElement
- HasSVGRareDataFlag = 1 << 18, // SVGElement
+ HasSVGRareDataFlag = 1 << 17, // SVGElement
#endif
StyleChangeMask = 1 << nodeStyleChangeShift | 1 << (nodeStyleChangeShift + 1),
- SelfOrAncestorHasDirAutoFlag = 1 << 21,
+ SelfOrAncestorHasDirAutoFlag = 1 << 20,
- HasNameOrIsEditingTextFlag = 1 << 22,
+ HasNameOrIsEditingTextFlag = 1 << 21,
- InNamedFlowFlag = 1 << 23,
- HasSyntheticAttrChildNodesFlag = 1 << 24,
- HasCustomCallbacksFlag = 1 << 25,
- HasScopedHTMLStyleChildFlag = 1 << 26,
- HasEventTargetDataFlag = 1 << 27,
- V8CollectableDuringMinorGCFlag = 1 << 28,
- IsInsertionPointFlag = 1 << 29,
+ InNamedFlowFlag = 1 << 22,
+ HasSyntheticAttrChildNodesFlag = 1 << 23,
+ HasCustomCallbacksFlag = 1 << 24,
+ HasScopedHTMLStyleChildFlag = 1 << 25,
+ HasEventTargetDataFlag = 1 << 26,
+ V8CollectableDuringMinorGCFlag = 1 << 27,
+ IsInsertionPointFlag = 1 << 28,
#if ENABLE(SVG)
DefaultNodeFlags = IsParsingChildrenFinishedFlag | AreSVGAttributesValidFlag,
@@ -731,7 +730,7 @@
#endif
};
- // 2 bits remaining
+ // 3 bits remaining
bool getFlag(NodeFlags mask) const { return m_nodeFlags & mask; }
void setFlag(bool f, NodeFlags mask) const { m_nodeFlags = (m_nodeFlags & ~mask) | (-(int32_t)f & mask); }
@@ -843,9 +842,6 @@
bool areSVGAttributesValid() const { return getFlag(AreSVGAttributesValidFlag); }
void setAreSVGAttributesValid() const { setFlag(AreSVGAttributesValidFlag); }
void clearAreSVGAttributesValid() { clearFlag(AreSVGAttributesValidFlag); }
- bool isSynchronizingSVGAttributes() const { return getFlag(IsSynchronizingSVGAttributesFlag); }
- void setIsSynchronizingSVGAttributes() const { setFlag(IsSynchronizingSVGAttributesFlag); }
- void clearIsSynchronizingSVGAttributes() const { clearFlag(IsSynchronizingSVGAttributesFlag); }
bool hasSVGRareData() const { return getFlag(HasSVGRareDataFlag); }
void setHasSVGRareData() { setFlag(HasSVGRareDataFlag); }
void clearHasSVGRareData() { clearFlag(HasSVGRareDataFlag); }
Modified: trunk/Source/WebCore/svg/SVGElement.cpp (135792 => 135793)
--- trunk/Source/WebCore/svg/SVGElement.cpp 2012-11-27 01:50:21 UTC (rev 135792)
+++ trunk/Source/WebCore/svg/SVGElement.cpp 2012-11-27 01:52:14 UTC (rev 135793)
@@ -537,14 +537,6 @@
{
StyledElement::attributeChanged(name, newValue);
- // When an animated SVG property changes through SVG DOM, svgAttributeChanged() is called, not attributeChanged().
- // Next time someone tries to access the XML attributes, the synchronization code starts. During that synchronization
- // SVGAnimatedPropertySynchronizer may call ElementAttributeData::removeAttribute(), which in turn calls attributeChanged().
- // At this point we're not allowed to call svgAttributeChanged() again - it may lead to extra work being done, or crashes
- // see bug https://bugs.webkit.org/show_bug.cgi?id=40994.
- if (isSynchronizingSVGAttributes())
- return;
-
if (isIdAttributeName(name)) {
document()->accessSVGExtensions()->removeAllAnimationElementsFromTarget(this);
document()->accessSVGExtensions()->removeAllElementReferencesForTarget(this);
@@ -574,19 +566,15 @@
void SVGElement::updateAnimatedSVGAttribute(const QualifiedName& name) const
{
- if (isSynchronizingSVGAttributes() || areSVGAttributesValid())
+ if (areSVGAttributesValid())
return;
- setIsSynchronizingSVGAttributes();
-
SVGElement* nonConstThis = const_cast<SVGElement*>(this);
if (name == anyQName()) {
nonConstThis->localAttributeToPropertyMap().synchronizeProperties(nonConstThis);
setAreSVGAttributesValid();
} else
nonConstThis->localAttributeToPropertyMap().synchronizeProperty(nonConstThis, name);
-
- clearIsSynchronizingSVGAttributes();
}
SVGAttributeToPropertyMap& SVGElement::localAttributeToPropertyMap()
