[SCM] WebKit Debian packaging branch, debian/experimental, updated. upstream/1.3.3-9427-gc2be6fc
inferno at chromium.org
inferno at chromium.org
Wed Dec 22 15:39:01 UTC 2010
The following commit has been merged in the debian/experimental branch:
commit 4289e26d43c15720c9fff442c01dac0b804d0bdd
Author: inferno at chromium.org <inferno at chromium.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Date: Tue Nov 9 23:21:27 2010 +0000
2010-11-09 Abhishek Arya <inferno at chromium.org>
Reviewed by Antti Koivisto.
Call to SVGSMILElement::applyResultsToTarget can blow away the SVGSMILElement.
Refptr the SVGSMILElement in the ResultElementMap to protect it.
https://bugs.webkit.org/show_bug.cgi?id=49274
Test: svg/animations/animate-update-crash.xhtml
* svg/animation/SMILTimeContainer.cpp:
(WebCore::SMILTimeContainer::updateAnimations):
2010-11-09 Abhishek Arya <inferno at chromium.org>
Reviewed by Antti Koivisto.
Tests that updating svg animations does not result in crash.
https://bugs.webkit.org/show_bug.cgi?id=49274
* svg/animations/animate-update-crash-expected.txt: Added.
* svg/animations/animate-update-crash.xhtml: Added.
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@71686 268f45cc-cd09-0410-ab3c-d52691b4dbfc
diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index e9b7f29..210a087 100644
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,13 @@
+2010-11-09 Abhishek Arya <inferno at chromium.org>
+
+ Reviewed by Antti Koivisto.
+
+ Tests that updating svg animations does not result in crash.
+ https://bugs.webkit.org/show_bug.cgi?id=49274
+
+ * svg/animations/animate-update-crash-expected.txt: Added.
+ * svg/animations/animate-update-crash.xhtml: Added.
+
2010-11-09 Mihai Parparita <mihaip at chromium.org>
Unreviewed Chromium test expectations update.
diff --git a/LayoutTests/fast/dom/beforeload/image-object-before-load-expected.txt b/LayoutTests/svg/animations/animate-update-crash-expected.txt
similarity index 100%
copy from LayoutTests/fast/dom/beforeload/image-object-before-load-expected.txt
copy to LayoutTests/svg/animations/animate-update-crash-expected.txt
diff --git a/LayoutTests/svg/animations/animate-update-crash.xhtml b/LayoutTests/svg/animations/animate-update-crash.xhtml
new file mode 100644
index 0000000..3729bf3
--- /dev/null
+++ b/LayoutTests/svg/animations/animate-update-crash.xhtml
@@ -0,0 +1,20 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+ <body>
+ <svg version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
+ <text>
+ PASS
+ <textPath>
+ <tref xlink:href="#foo">
+ <animateColor attributeName="keyPoints"></animateColor>
+ <animateColor attributeName="xlink:href"></animateColor>
+ </tref>
+ </textPath>
+ </text>
+ </svg>
+ <script>
+ if (window.layoutTestController)
+ layoutTestController.dumpAsText();
+ </script>
+ </body>
+</html>
+
diff --git a/WebCore/ChangeLog b/WebCore/ChangeLog
index 57f1808..7b189d7 100644
--- a/WebCore/ChangeLog
+++ b/WebCore/ChangeLog
@@ -1,3 +1,16 @@
+2010-11-09 Abhishek Arya <inferno at chromium.org>
+
+ Reviewed by Antti Koivisto.
+
+ Call to SVGSMILElement::applyResultsToTarget can blow away the SVGSMILElement.
+ Refptr the SVGSMILElement in the ResultElementMap to protect it.
+ https://bugs.webkit.org/show_bug.cgi?id=49274
+
+ Test: svg/animations/animate-update-crash.xhtml
+
+ * svg/animation/SMILTimeContainer.cpp:
+ (WebCore::SMILTimeContainer::updateAnimations):
+
2010-11-09 Alexey Proskuryakov <ap at apple.com>
Reviewed by Darin Adler.
diff --git a/WebCore/svg/animation/SMILTimeContainer.cpp b/WebCore/svg/animation/SMILTimeContainer.cpp
index b9f210e..b790859 100644
--- a/WebCore/svg/animation/SMILTimeContainer.cpp
+++ b/WebCore/svg/animation/SMILTimeContainer.cpp
@@ -255,7 +255,7 @@ void SMILTimeContainer::updateAnimations(SMILTime elapsed)
sortByPriority(toAnimate, elapsed);
// Calculate animation contributions.
- typedef HashMap<ElementAttributePair, SVGSMILElement*> ResultElementMap;
+ typedef HashMap<ElementAttributePair, RefPtr<SVGSMILElement> > ResultElementMap;
ResultElementMap resultsElements;
for (unsigned n = 0; n < toAnimate.size(); ++n) {
SVGSMILElement* animation = toAnimate[n];
@@ -274,7 +274,7 @@ void SMILTimeContainer::updateAnimations(SMILTime elapsed)
// Results are accumulated to the first animation that animates a particular element/attribute pair.
ElementAttributePair key(targetElement, attributeName);
- SVGSMILElement* resultElement = resultsElements.get(key);
+ SVGSMILElement* resultElement = resultsElements.get(key).get();
if (!resultElement) {
resultElement = animation;
resultElement->resetToBaseValue(baseValueFor(key));
@@ -297,7 +297,7 @@ void SMILTimeContainer::updateAnimations(SMILTime elapsed)
Vector<SVGSMILElement*> animationsToApply;
ResultElementMap::iterator end = resultsElements.end();
for (ResultElementMap::iterator it = resultsElements.begin(); it != end; ++it)
- animationsToApply.append(it->second);
+ animationsToApply.append(it->second.get());
// Sort <animateTranform> to be the last one to be applied. <animate> may change transform attribute as
// well (directly or indirectly by modifying <use> x/y) and this way transforms combine properly.
--
WebKit Debian packaging
More information about the Pkg-webkit-commits
mailing list