[SCM] WebKit Debian packaging branch, debian/experimental, updated. upstream/1.3.3-9427-gc2be6fc
zimmermann at webkit.org
zimmermann at webkit.org
Wed Dec 22 15:26:20 UTC 2010
The following commit has been merged in the debian/experimental branch:
commit 0235bf1402cd3d68fb924f50d727ce17a2d94565
Author: zimmermann at webkit.org <zimmermann at webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Date: Wed Nov 3 14:12:54 2010 +0000
2010-11-03 Nikolas Zimmermann <nzimmermann at rim.com>
Reviewed by Dirk Schulze.
chrome.dll!WebCore::SVGListPropertyTearOff<...>::getItem ReadAV at NULL (578c0f7f21ca517ba29a4eafb7099c1b)
https://bugs.webkit.org/show_bug.cgi?id=48829
Share SVGPropertyTearOff wrapper cache between SVGAnimatedListPropertyTearOff::baseVal/animVal.
When modifying the list through baseVal, and then grabbing the animVal list an assertion was fired,
as the wrapper cache was out of sync with the underlying SVG*List vector.
Test: svg/dom/baseVal-animVal-list-crash.html
* svg/properties/SVGAnimatedListPropertyTearOff.h:
(WebCore::SVGAnimatedListPropertyTearOff::baseVal):
(WebCore::SVGAnimatedListPropertyTearOff::animVal):
(WebCore::SVGAnimatedListPropertyTearOff::removeItemFromList):
(WebCore::SVGAnimatedListPropertyTearOff::detachListWrappers):
(WebCore::SVGAnimatedListPropertyTearOff::values):
(WebCore::SVGAnimatedListPropertyTearOff::wrappers):
(WebCore::SVGAnimatedListPropertyTearOff::create):
(WebCore::SVGAnimatedListPropertyTearOff::SVGAnimatedListPropertyTearOff):
* svg/properties/SVGListPropertyTearOff.h:
(WebCore::SVGListPropertyTearOff::create):
(WebCore::SVGListPropertyTearOff::removeItemFromList):
(WebCore::SVGListPropertyTearOff::clear):
(WebCore::SVGListPropertyTearOff::numberOfItems):
(WebCore::SVGListPropertyTearOff::initialize):
(WebCore::SVGListPropertyTearOff::getItem):
(WebCore::SVGListPropertyTearOff::insertItemBefore):
(WebCore::SVGListPropertyTearOff::replaceItem):
(WebCore::SVGListPropertyTearOff::removeItem):
(WebCore::SVGListPropertyTearOff::appendItem):
(WebCore::SVGListPropertyTearOff::SVGListPropertyTearOff):
(WebCore::SVGListPropertyTearOff::commitChange):
2010-11-03 Nikolas Zimmermann <nzimmermann at rim.com>
Reviewed by Dirk Schulze.
chrome.dll!WebCore::SVGListPropertyTearOff<...>::getItem ReadAV at NULL (578c0f7f21ca517ba29a4eafb7099c1b)
https://bugs.webkit.org/show_bug.cgi?id=48829
* svg/dom/baseVal-animVal-list-crash-expected.txt: Added.
* svg/dom/baseVal-animVal-list-crash.html: Added.
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@71236 268f45cc-cd09-0410-ab3c-d52691b4dbfc
diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index 7f66e4f..881e623 100644
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,13 @@
+2010-11-03 Nikolas Zimmermann <nzimmermann at rim.com>
+
+ Reviewed by Dirk Schulze.
+
+ chrome.dll!WebCore::SVGListPropertyTearOff<...>::getItem ReadAV at NULL (578c0f7f21ca517ba29a4eafb7099c1b)
+ https://bugs.webkit.org/show_bug.cgi?id=48829
+
+ * svg/dom/baseVal-animVal-list-crash-expected.txt: Added.
+ * svg/dom/baseVal-animVal-list-crash.html: Added.
+
2010-11-03 Adam Roben <aroben at apple.com>
Add some more failing tests to the Windows Skipped file
diff --git a/LayoutTests/fast/frames/javascript-url-for-deleted-frame-expected.txt b/LayoutTests/svg/dom/baseVal-animVal-list-crash-expected.txt
similarity index 100%
copy from LayoutTests/fast/frames/javascript-url-for-deleted-frame-expected.txt
copy to LayoutTests/svg/dom/baseVal-animVal-list-crash-expected.txt
diff --git a/LayoutTests/svg/dom/baseVal-animVal-list-crash.html b/LayoutTests/svg/dom/baseVal-animVal-list-crash.html
new file mode 100644
index 0000000..63519c4
--- /dev/null
+++ b/LayoutTests/svg/dom/baseVal-animVal-list-crash.html
@@ -0,0 +1,19 @@
+<html>
+<head>
+<script>
+if (window.layoutTestController)
+ layoutTestController.dumpAsText();
+
+function go() {
+ var oSvgTextElement = document.createElementNS("http://www.w3.org/2000/svg", "text");
+ var oSvgRectElement = document.createElementNS("http://www.w3.org/2000/svg", "rect");
+ oSvgTextElement.y.animVal;
+ oSvgTextElement.y.baseVal.initialize(oSvgRectElement.x.baseVal);
+ oSvgTextElement.y.animVal.getItem(0);
+}
+</script>
+</head>
+<body onload="go()">
+This test passes if it doesn't crash.
+</body>
+</html>
diff --git a/WebCore/ChangeLog b/WebCore/ChangeLog
index e42a6ca..01f773f 100644
--- a/WebCore/ChangeLog
+++ b/WebCore/ChangeLog
@@ -1,3 +1,39 @@
+2010-11-03 Nikolas Zimmermann <nzimmermann at rim.com>
+
+ Reviewed by Dirk Schulze.
+
+ chrome.dll!WebCore::SVGListPropertyTearOff<...>::getItem ReadAV at NULL (578c0f7f21ca517ba29a4eafb7099c1b)
+ https://bugs.webkit.org/show_bug.cgi?id=48829
+
+ Share SVGPropertyTearOff wrapper cache between SVGAnimatedListPropertyTearOff::baseVal/animVal.
+ When modifying the list through baseVal, and then grabbing the animVal list an assertion was fired,
+ as the wrapper cache was out of sync with the underlying SVG*List vector.
+
+ Test: svg/dom/baseVal-animVal-list-crash.html
+
+ * svg/properties/SVGAnimatedListPropertyTearOff.h:
+ (WebCore::SVGAnimatedListPropertyTearOff::baseVal):
+ (WebCore::SVGAnimatedListPropertyTearOff::animVal):
+ (WebCore::SVGAnimatedListPropertyTearOff::removeItemFromList):
+ (WebCore::SVGAnimatedListPropertyTearOff::detachListWrappers):
+ (WebCore::SVGAnimatedListPropertyTearOff::values):
+ (WebCore::SVGAnimatedListPropertyTearOff::wrappers):
+ (WebCore::SVGAnimatedListPropertyTearOff::create):
+ (WebCore::SVGAnimatedListPropertyTearOff::SVGAnimatedListPropertyTearOff):
+ * svg/properties/SVGListPropertyTearOff.h:
+ (WebCore::SVGListPropertyTearOff::create):
+ (WebCore::SVGListPropertyTearOff::removeItemFromList):
+ (WebCore::SVGListPropertyTearOff::clear):
+ (WebCore::SVGListPropertyTearOff::numberOfItems):
+ (WebCore::SVGListPropertyTearOff::initialize):
+ (WebCore::SVGListPropertyTearOff::getItem):
+ (WebCore::SVGListPropertyTearOff::insertItemBefore):
+ (WebCore::SVGListPropertyTearOff::replaceItem):
+ (WebCore::SVGListPropertyTearOff::removeItem):
+ (WebCore::SVGListPropertyTearOff::appendItem):
+ (WebCore::SVGListPropertyTearOff::SVGListPropertyTearOff):
+ (WebCore::SVGListPropertyTearOff::commitChange):
+
2010-11-02 Ilya Tikhonovsky <loislo at chromium.org>
Reviewed by Pavel Feldman.
diff --git a/WebCore/svg/properties/SVGAnimatedListPropertyTearOff.h b/WebCore/svg/properties/SVGAnimatedListPropertyTearOff.h
index c002d09..c69e20a 100644
--- a/WebCore/svg/properties/SVGAnimatedListPropertyTearOff.h
+++ b/WebCore/svg/properties/SVGAnimatedListPropertyTearOff.h
@@ -32,17 +32,21 @@ class SVGPropertyTearOff;
template<typename PropertyType>
class SVGAnimatedListPropertyTearOff : public SVGAnimatedProperty {
public:
+ typedef typename SVGPropertyTraits<PropertyType>::ListItemType ListItemType;
+ typedef SVGPropertyTearOff<ListItemType> ListItemTearOff;
+ typedef Vector<RefPtr<ListItemTearOff> > ListWrapperCache;
+
SVGProperty* baseVal()
{
if (!m_baseVal)
- m_baseVal = SVGListPropertyTearOff<PropertyType>::create(this, BaseValRole, m_property);
+ m_baseVal = SVGListPropertyTearOff<PropertyType>::create(this, BaseValRole);
return m_baseVal.get();
}
SVGProperty* animVal()
{
if (!m_animVal)
- m_animVal = SVGListPropertyTearOff<PropertyType>::create(this, AnimValRole, m_property);
+ m_animVal = SVGListPropertyTearOff<PropertyType>::create(this, AnimValRole);
return m_animVal.get();
}
@@ -50,39 +54,56 @@ public:
int removeItemFromList(SVGProperty* property, bool shouldSynchronizeWrappers)
{
- // FIXME: No animVal support.
- if (!m_baseVal)
- return -1;
-
+ // This should ever be called for our baseVal, as animVal can't modify the list.
typedef SVGPropertyTearOff<typename SVGPropertyTraits<PropertyType>::ListItemType> ListItemTearOff;
return static_pointer_cast<SVGListPropertyTearOff<PropertyType> >(m_baseVal)->removeItemFromList(static_cast<ListItemTearOff*>(property), shouldSynchronizeWrappers);
}
void detachListWrappers(unsigned newListSize)
{
- if (m_baseVal)
- static_pointer_cast<SVGListPropertyTearOff<PropertyType> >(m_baseVal)->detachListWrappers(newListSize);
- if (m_animVal)
- static_pointer_cast<SVGListPropertyTearOff<PropertyType> >(m_animVal)->detachListWrappers(newListSize);
+ // See SVGPropertyTearOff::detachWrapper() for an explaination what's happening here.
+ unsigned size = m_wrappers.size();
+ ASSERT(size == m_values.size());
+ for (unsigned i = 0; i < size; ++i) {
+ RefPtr<ListItemTearOff>& item = m_wrappers.at(i);
+ if (!item)
+ continue;
+ item->detachWrapper();
+ }
+
+ // Reinitialize the wrapper cache to be equal to the new values size, after the XML DOM changed the list.
+ if (newListSize)
+ m_wrappers.fill(0, newListSize);
+ else
+ m_wrappers.clear();
}
+ PropertyType& values() { return m_values; }
+ ListWrapperCache& wrappers() { return m_wrappers; }
+
private:
friend class SVGAnimatedProperty;
- static PassRefPtr<SVGAnimatedListPropertyTearOff<PropertyType> > create(SVGElement* contextElement, const QualifiedName& attributeName, PropertyType& property)
+ static PassRefPtr<SVGAnimatedListPropertyTearOff<PropertyType> > create(SVGElement* contextElement, const QualifiedName& attributeName, PropertyType& values)
{
ASSERT(contextElement);
- return adoptRef(new SVGAnimatedListPropertyTearOff<PropertyType>(contextElement, attributeName, property));
+ return adoptRef(new SVGAnimatedListPropertyTearOff<PropertyType>(contextElement, attributeName, values));
}
- SVGAnimatedListPropertyTearOff(SVGElement* contextElement, const QualifiedName& attributeName, PropertyType& property)
+ SVGAnimatedListPropertyTearOff(SVGElement* contextElement, const QualifiedName& attributeName, PropertyType& values)
: SVGAnimatedProperty(contextElement, attributeName)
- , m_property(property)
+ , m_values(values)
{
+ if (!values.isEmpty())
+ m_wrappers.fill(0, values.size());
}
private:
- PropertyType& m_property;
+ PropertyType& m_values;
+
+ // FIXME: The list wrapper cache is shared between baseVal/animVal. If we implement animVal,
+ // we need two seperated wrapper caches if the attribute gets animated.
+ ListWrapperCache m_wrappers;
RefPtr<SVGProperty> m_baseVal;
RefPtr<SVGProperty> m_animVal;
diff --git a/WebCore/svg/properties/SVGListPropertyTearOff.h b/WebCore/svg/properties/SVGListPropertyTearOff.h
index 2801168..1710b16 100644
--- a/WebCore/svg/properties/SVGListPropertyTearOff.h
+++ b/WebCore/svg/properties/SVGListPropertyTearOff.h
@@ -39,34 +39,31 @@ public:
typedef typename SVGPropertyTraits<PropertyType>::ListItemType ListItemType;
typedef SVGPropertyTearOff<ListItemType> ListItemTearOff;
typedef PassRefPtr<ListItemTearOff> PassListItemTearOff;
- typedef Vector<RefPtr<ListItemTearOff> > ListWrapperCache;
+ typedef SVGAnimatedListPropertyTearOff<PropertyType> AnimatedListPropertyTearOff;
+ typedef typename SVGAnimatedListPropertyTearOff<PropertyType>::ListWrapperCache ListWrapperCache;
- // Used for [SVGAnimatedProperty] types (for example: SVGAnimatedLengthList::baseVal())
- static PassRefPtr<Self> create(SVGAnimatedProperty* animatedProperty, SVGPropertyRole role, PropertyType& values)
+ static PassRefPtr<Self> create(AnimatedListPropertyTearOff* animatedProperty, SVGPropertyRole role)
{
ASSERT(animatedProperty);
- return adoptRef(new Self(animatedProperty, role, values));
- }
-
- // Used for non-animated POD types (for example: SVGStringList).
- static PassRefPtr<Self> create(const PropertyType& initialValue)
- {
- return adoptRef(new Self(initialValue));
+ return adoptRef(new Self(animatedProperty, role));
}
int removeItemFromList(ListItemTearOff* removeItem, bool shouldSynchronizeWrappers)
{
+ PropertyType& values = m_animatedProperty->values();
+ ListWrapperCache& wrappers = m_animatedProperty->wrappers();
+
// Lookup item in cache and remove its corresponding wrapper.
- unsigned size = m_wrappers.size();
- ASSERT(size == m_values->size());
+ unsigned size = wrappers.size();
+ ASSERT(size == values.size());
for (unsigned i = 0; i < size; ++i) {
- RefPtr<ListItemTearOff>& item = m_wrappers.at(i);
+ RefPtr<ListItemTearOff>& item = wrappers.at(i);
if (item != removeItem)
continue;
item->detachWrapper();
- m_wrappers.remove(i);
- m_values->remove(i);
+ wrappers.remove(i);
+ values.remove(i);
if (shouldSynchronizeWrappers)
commitChange();
@@ -77,25 +74,6 @@ public:
return -1;
}
- void detachListWrappers(unsigned newListSize)
- {
- // See SVGPropertyTearOff::detachWrapper() for an explaination what's happening here.
- unsigned size = m_wrappers.size();
- ASSERT(size == m_values->size());
- for (unsigned i = 0; i < size; ++i) {
- RefPtr<ListItemTearOff>& item = m_wrappers.at(i);
- if (!item)
- continue;
- item->detachWrapper();
- }
-
- // Reinitialize the wrapper cache to be equal to the new values size, after the XML DOM changed the list.
- if (newListSize)
- m_wrappers.fill(0, newListSize);
- else
- m_wrappers.clear();
- }
-
// SVGList API
void clear(ExceptionCode& ec)
{
@@ -104,13 +82,13 @@ public:
return;
}
- detachListWrappers(0);
- m_values->clear();
+ m_animatedProperty->detachListWrappers(0);
+ m_animatedProperty->values().clear();
}
unsigned numberOfItems() const
{
- return m_values->size();
+ return m_animatedProperty->values().size();
}
PassListItemTearOff initialize(PassListItemTearOff passNewItem, ExceptionCode& ec)
@@ -126,18 +104,21 @@ public:
return 0;
}
+ PropertyType& values = m_animatedProperty->values();
+ ListWrapperCache& wrappers = m_animatedProperty->wrappers();
+
RefPtr<ListItemTearOff> newItem = passNewItem;
- ASSERT(m_values->size() == m_wrappers.size());
+ ASSERT(values.size() == wrappers.size());
// Spec: If the inserted item is already in a list, it is removed from its previous list before it is inserted into this list.
removeItemFromListIfNeeded(newItem.get(), 0);
// Spec: Clears all existing current items from the list and re-initializes the list to hold the single item specified by the parameter.
- detachListWrappers(0);
- m_values->clear();
-
- m_values->append(newItem->propertyReference());
- m_wrappers.append(newItem);
+ m_animatedProperty->detachListWrappers(0);
+ values.clear();
+
+ values.append(newItem->propertyReference());
+ wrappers.append(newItem);
commitChange();
return newItem.release();
@@ -145,21 +126,24 @@ public:
PassListItemTearOff getItem(unsigned index, ExceptionCode& ec)
{
- if (index >= m_values->size()) {
+ PropertyType& values = m_animatedProperty->values();
+ if (index >= values.size()) {
ec = INDEX_SIZE_ERR;
return 0;
}
+ ListWrapperCache& wrappers = m_animatedProperty->wrappers();
+
// Spec: Returns the specified item from the list. The returned item is the item itself and not a copy.
// Any changes made to the item are immediately reflected in the list.
- ASSERT(m_values->size() == m_wrappers.size());
- RefPtr<ListItemTearOff> wrapper = m_wrappers.at(index);
+ ASSERT(values.size() == wrappers.size());
+ RefPtr<ListItemTearOff> wrapper = wrappers.at(index);
if (!wrapper) {
// Create new wrapper, which is allowed to directly modify the item in the list, w/o copying and cache the wrapper in our map.
// It is also associated with our animated property, so it can notify the SVG Element which holds the SVGAnimated*List
// that it has been modified (and thus can call svgAttributeChanged(associatedAttributeName)).
- wrapper = ListItemTearOff::create(m_animatedProperty.get(), UndefinedRole, m_values->at(index));
- m_wrappers.at(index) = wrapper;
+ wrapper = ListItemTearOff::create(m_animatedProperty.get(), UndefinedRole, values.at(index));
+ wrappers.at(index) = wrapper;
}
return wrapper.release();
@@ -178,22 +162,25 @@ public:
return 0;
}
+ PropertyType& values = m_animatedProperty->values();
+ ListWrapperCache& wrappers = m_animatedProperty->wrappers();
+
// Spec: If the index is greater than or equal to numberOfItems, then the new item is appended to the end of the list.
- if (index > m_values->size())
- index = m_values->size();
+ if (index > values.size())
+ index = values.size();
RefPtr<ListItemTearOff> newItem = passNewItem;
- ASSERT(m_values->size() == m_wrappers.size());
+ ASSERT(values.size() == wrappers.size());
// Spec: If newItem is already in a list, it is removed from its previous list before it is inserted into this list.
removeItemFromListIfNeeded(newItem.get(), &index);
// Spec: Inserts a new item into the list at the specified position. The index of the item before which the new item is to be
// inserted. The first item is number 0. If the index is equal to 0, then the new item is inserted at the front of the list.
- m_values->insert(index, newItem->propertyReference());
+ values.insert(index, newItem->propertyReference());
// Store new wrapper at position 'index', change its underlying value, so mutations of newItem, directly affect the item in the list.
- m_wrappers.insert(index, newItem);
+ wrappers.insert(index, newItem);
commitChange();
return newItem.release();
@@ -206,7 +193,8 @@ public:
return 0;
}
- if (index >= m_values->size()) {
+ PropertyType& values = m_animatedProperty->values();
+ if (index >= values.size()) {
ec = INDEX_SIZE_ERR;
return 0;
}
@@ -217,21 +205,22 @@ public:
return 0;
}
+ ListWrapperCache& wrappers = m_animatedProperty->wrappers();
+ ASSERT(values.size() == wrappers.size());
RefPtr<ListItemTearOff> newItem = passNewItem;
- ASSERT(m_values->size() == m_wrappers.size());
// Spec: If newItem is already in a list, it is removed from its previous list before it is inserted into this list.
// Spec: If the item is already in this list, note that the index of the item to replace is before the removal of the item.
removeItemFromListIfNeeded(newItem.get(), &index);
// Detach the existing wrapper.
- RefPtr<ListItemTearOff>& oldItem = m_wrappers.at(index);
+ RefPtr<ListItemTearOff>& oldItem = wrappers.at(index);
if (oldItem)
oldItem->detachWrapper();
// Update the value and the wrapper at the desired position 'index'.
- m_values->at(index) = newItem->propertyReference();
- m_wrappers.at(index) = newItem;
+ values.at(index) = newItem->propertyReference();
+ wrappers.at(index) = newItem;
commitChange();
return newItem.release();
@@ -244,21 +233,23 @@ public:
return 0;
}
- if (index >= m_values->size()) {
+ PropertyType& values = m_animatedProperty->values();
+ if (index >= values.size()) {
ec = INDEX_SIZE_ERR;
return 0;
}
- ASSERT(m_values->size() == m_wrappers.size());
+ ListWrapperCache& wrappers = m_animatedProperty->wrappers();
+ ASSERT(values.size() == wrappers.size());
// Detach the existing wrapper.
- RefPtr<ListItemTearOff>& oldItem = m_wrappers.at(index);
+ RefPtr<ListItemTearOff>& oldItem = wrappers.at(index);
if (oldItem) {
oldItem->detachWrapper();
- m_wrappers.remove(index);
+ wrappers.remove(index);
}
- m_values->remove(index);
+ values.remove(index);
commitChange();
return oldItem.release();
@@ -277,62 +268,48 @@ public:
return 0;
}
+ PropertyType& values = m_animatedProperty->values();
+ ListWrapperCache& wrappers = m_animatedProperty->wrappers();
+
RefPtr<ListItemTearOff> newItem = passNewItem;
- ASSERT(m_values->size() == m_wrappers.size());
+ ASSERT(values.size() == wrappers.size());
// Spec: If newItem is already in a list, it is removed from its previous list before it is inserted into this list.
removeItemFromListIfNeeded(newItem.get(), 0);
// Append the value and wrapper at the end of the list.
- m_values->append(newItem->propertyReference());
- m_wrappers.append(newItem);
+ values.append(newItem->propertyReference());
+ wrappers.append(newItem);
commitChange();
return newItem.release();
}
private:
- SVGListPropertyTearOff(SVGAnimatedProperty* animatedProperty, SVGPropertyRole role, PropertyType& values)
+ SVGListPropertyTearOff(AnimatedListPropertyTearOff* animatedProperty, SVGPropertyRole role)
: m_animatedProperty(animatedProperty)
, m_role(role)
- , m_values(&values)
- , m_valuesIsCopy(false)
- {
- // Using operator & is completly fine, as SVGAnimatedProperty owns this reference,
- // and we're guaranteed to live as long as SVGAnimatedProperty does.
- if (!values.isEmpty())
- m_wrappers.fill(0, values.size());
- }
-
- SVGListPropertyTearOff(const PropertyType& initialValue)
- : m_animatedProperty(0)
- , m_role(UndefinedRole)
- , m_values(new PropertyType(initialValue))
- , m_valuesIsCopy(true)
{
- }
-
- virtual ~SVGListPropertyTearOff()
- {
- if (m_valuesIsCopy)
- delete m_values;
+ ASSERT(animatedProperty);
+ ASSERT(role != UndefinedRole);
}
void commitChange()
{
- // Update existing wrappers, as the index in the m_values list has changed.
- unsigned size = m_wrappers.size();
- ASSERT(size == m_values->size());
+ PropertyType& values = m_animatedProperty->values();
+ ListWrapperCache& wrappers = m_animatedProperty->wrappers();
+
+ // Update existing wrappers, as the index in the values list has changed.
+ unsigned size = wrappers.size();
+ ASSERT(size == values.size());
for (unsigned i = 0; i < size; ++i) {
- RefPtr<ListItemTearOff>& item = m_wrappers.at(i);
+ RefPtr<ListItemTearOff>& item = wrappers.at(i);
if (!item)
continue;
item->setAnimatedProperty(m_animatedProperty.get());
- item->setValue(m_values->at(i));
+ item->setValue(values.at(i));
}
- ASSERT(!m_valuesIsCopy);
- ASSERT(m_animatedProperty);
m_animatedProperty->commitChange();
}
@@ -363,17 +340,10 @@ private:
private:
// Back pointer to the animated property that created us
// For example (text.x.baseVal): m_animatedProperty points to the 'x' SVGAnimatedLengthList object
- RefPtr<SVGAnimatedProperty> m_animatedProperty;
+ RefPtr<AnimatedListPropertyTearOff> m_animatedProperty;
// The role of this property (baseVal or animVal)
SVGPropertyRole m_role;
-
- // For the example above (text.x.baseVal): A reference to the SVGLengthList& stored in the SVGTextElement, which we can directly modify
- PropertyType* m_values;
- bool m_valuesIsCopy : 1;
-
- // A list of wrappers, which is always in sync between m_values.
- ListWrapperCache m_wrappers;
};
}
--
WebKit Debian packaging
More information about the Pkg-webkit-commits
mailing list