<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[196268] trunk</title>
</head>
<body>
<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; }
#msg dl a { font-weight: bold}
#msg dl a:link { color:#fc3; }
#msg dl a:active { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/196268">196268</a></dd>
<dt>Author</dt> <dd>commit-queue@webkit.org</dd>
<dt>Date</dt> <dd>2016-02-08 12:54:05 -0800 (Mon, 08 Feb 2016)</dd>
</dl>
<h3>Log Message</h3>
<pre>REGRESSION(<a href="http://trac.webkit.org/projects/webkit/changeset/181345">r181345</a>): SVG polyline and polygon leak page
https://bugs.webkit.org/show_bug.cgi?id=152759
Patch by Said Abou-Hallawa <sabouhallawa@apple.com> on 2016-02-08
Reviewed by Darin Adler.
Source/WebCore:
The leak happens because of cyclic reference between SVGListPropertyTearOff
and SVGAnimatedListPropertyTearOff which is derived from SVGAnimatedProperty.
There is also cyclic reference between SVGAnimatedProperty and SVGElement
and this causes the whole document to be leaked. So if the JS requests, for
example, an instance of SVGPolylineElement.points, the whole document will be
leaked.
The fix depends on having the cyclic reference as is since the owning and the
owned classes have to live together if any of them is referenced. But the owning
class caches a raw 'ref-counted' pointer of the owned class. If it is requested
for an instance of the owned class it returned a RefPtr<> of it. Once the owned
class is not used, it can delete itself. The only thing needed here is to notify
the owner class of the deletion so it cleans its caches and be able to create a
new pointer if it is requested for an instance of the owned class later.
Revert the change of <a href="http://trac.webkit.org/projects/webkit/changeset/181345">r181345</a> in SVGAnimatedProperty::lookupOrCreateWrapper()
to break the cyclic reference between SVGElement and SVGAnimatedProperty.
Also apply the same approach in SVGAnimatedListPropertyTearOff::baseVal() and
animVal() to break cyclic reference between SVGListPropertyTearOff and
SVGAnimatedListPropertyTearOff.
Test: svg/animations/smil-leak-list-property-instances.svg
* bindings/scripts/CodeGeneratorJS.pm:
(NativeToJSValue): The SVG non-string list tear-off properties became of
type RefPtr<>. So we need to use get() with the casting expressions.
* svg/SVGMarkerElement.cpp:
(WebCore::SVGMarkerElement::orientType):
Use 'auto' type for the return of SVGAnimatedProperty::lookupWrapper().
* svg/SVGPathElement.cpp:
(WebCore::SVGPathElement::pathByteStream):
(WebCore::SVGPathElement::lookupOrCreateDWrapper):
Since SVGAnimatedProperty::lookupWrappe() returns a RefPtr<> we need to
use get() for the casting expressions.
(WebCore::SVGPathElement::pathSegList):
(WebCore::SVGPathElement::normalizedPathSegList):
(WebCore::SVGPathElement::animatedPathSegList):
(WebCore::SVGPathElement::animatedNormalizedPathSegList):
* svg/SVGPathElement.h:
Change the return value from raw pointer to RefPtr<>.
* svg/SVGPathSegWithContext.h:
(WebCore::SVGPathSegWithContext::animatedProperty):
Change the return type to be RefPtr<> to preserve the value from being deleted.
* svg/SVGPolyElement.cpp:
(WebCore::SVGPolyElement::parseAttribute):
Since SVGAnimatedProperty::lookupWrapper() returns a RefPtr<> we need to
use get() for the casting expressions.
(WebCore::SVGPolyElement::points):
(WebCore::SVGPolyElement::animatedPoints):
* svg/SVGPolyElement.h:
Change the return value from raw pointer to RefPtr<>.
* svg/SVGViewSpec.cpp:
(WebCore::SVGViewSpec::setTransformString):
Since SVGAnimatedProperty::lookupWrapper() returns a RefPtr<> we need to
use get() for the casting expressions.
(WebCore::SVGViewSpec::transform):
* svg/SVGViewSpec.h:
Change the return value from raw pointer to RefPtr<>.
* svg/properties/SVGAnimatedListPropertyTearOff.h:
(WebCore::SVGAnimatedListPropertyTearOff::baseVal):
(WebCore::SVGAnimatedListPropertyTearOff::animVal):
Change the return value from raw pointer to RefPtr<> and change the cached
value from RefPtr<> to raw pointer. If the property is null, it will be
created, its raw pointer will be cached and the only ref-counted RefPtr<>
will be returned. This will guarantee, the RefPtr<> will be deleted once
it is not used anymore.
(WebCore::SVGAnimatedListPropertyTearOff::propertyWillBeDeleted):
Clean the raw pointer caches m_baseVal and m_animVal upon deleting the
actual pointer. This function will be called from the destructor of
SVGListPropertyTearOff.
(WebCore::SVGAnimatedListPropertyTearOff::findItem):
(WebCore::SVGAnimatedListPropertyTearOff::removeItemFromList):
We have to ensure the baseVal() is created before using it.
(WebCore::SVGAnimatedListPropertyTearOff::detachListWrappers):
(WebCore::SVGAnimatedListPropertyTearOff::currentAnimatedValue):
(WebCore::SVGAnimatedListPropertyTearOff::animationStarted):
(WebCore::SVGAnimatedListPropertyTearOff::animationEnded):
(WebCore::SVGAnimatedListPropertyTearOff::synchronizeWrappersIfNeeded):
(WebCore::SVGAnimatedListPropertyTearOff::animValWillChange):
(WebCore::SVGAnimatedListPropertyTearOff::animValDidChange):
For animation, a separate RefPtr<> 'm_animatingAnimVal' will be assigned
to the animVal(). This will prevent deleting m_animVal while animation.
* svg/properties/SVGAnimatedPathSegListPropertyTearOff.h:
(WebCore::SVGAnimatedPathSegListPropertyTearOff::baseVal):
(WebCore::SVGAnimatedPathSegListPropertyTearOff::animVal):
Same as what is done in SVGAnimatedListPropertyTearOff.
(WebCore::SVGAnimatedPathSegListPropertyTearOff::findItem):
(WebCore::SVGAnimatedPathSegListPropertyTearOff::removeItemFromList):
Same as what is done in SVGAnimatedListPropertyTearOff.
* svg/properties/SVGAnimatedProperty.h:
(WebCore::SVGAnimatedProperty::lookupOrCreateWrapper):
Change the return value from raw reference to Ref<> and change the
cached value from Ref<> to raw pointer. This reverts the change of
<a href="http://trac.webkit.org/projects/webkit/changeset/181345">r181345</a> in this function.
(WebCore::SVGAnimatedProperty::lookupWrapper):
Change the return value from raw pointer to RefPtr<>.
* svg/properties/SVGAnimatedPropertyMacros.h:
Use 'auto' type for the return of SVGAnimatedProperty::lookupWrapper().
* svg/properties/SVGAnimatedTransformListPropertyTearOff.h:
(WebCore::SVGAnimatedTransformListPropertyTearOff::baseVal):
(WebCore::SVGAnimatedTransformListPropertyTearOff::animVal):
Same as what is done in SVGAnimatedListPropertyTearOff.
* svg/properties/SVGListPropertyTearOff.h:
(WebCore::SVGListPropertyTearOff::~SVGListPropertyTearOff):
Call the SVGAnimatedListPropertyTearOff::propertyWillBeDeleted() to clean
its raw pointers when the RefPtr<> deletes itself.
LayoutTests:
* TestExpectations: Remove flaky tests from test expectation.
* svg/animations/smil-leak-list-property-instances-expected.txt: Added.
* svg/animations/smil-leak-list-property-instances.svg: Added.
Ensure if SVGPolylineElement.points is requested from JS, the document will
not leak.</pre>
<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkLayoutTestsChangeLog">trunk/LayoutTests/ChangeLog</a></li>
<li><a href="#trunkLayoutTestsTestExpectations">trunk/LayoutTests/TestExpectations</a></li>
<li><a href="#trunkSourceWebCoreChangeLog">trunk/Source/WebCore/ChangeLog</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptsCodeGeneratorJSpm">trunk/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm</a></li>
<li><a href="#trunkSourceWebCoresvgSVGMarkerElementcpp">trunk/Source/WebCore/svg/SVGMarkerElement.cpp</a></li>
<li><a href="#trunkSourceWebCoresvgSVGPathElementcpp">trunk/Source/WebCore/svg/SVGPathElement.cpp</a></li>
<li><a href="#trunkSourceWebCoresvgSVGPathElementh">trunk/Source/WebCore/svg/SVGPathElement.h</a></li>
<li><a href="#trunkSourceWebCoresvgSVGPathSegWithContexth">trunk/Source/WebCore/svg/SVGPathSegWithContext.h</a></li>
<li><a href="#trunkSourceWebCoresvgSVGPolyElementcpp">trunk/Source/WebCore/svg/SVGPolyElement.cpp</a></li>
<li><a href="#trunkSourceWebCoresvgSVGPolyElementh">trunk/Source/WebCore/svg/SVGPolyElement.h</a></li>
<li><a href="#trunkSourceWebCoresvgSVGViewSpeccpp">trunk/Source/WebCore/svg/SVGViewSpec.cpp</a></li>
<li><a href="#trunkSourceWebCoresvgSVGViewSpech">trunk/Source/WebCore/svg/SVGViewSpec.h</a></li>
<li><a href="#trunkSourceWebCoresvgpropertiesSVGAnimatedListPropertyTearOffh">trunk/Source/WebCore/svg/properties/SVGAnimatedListPropertyTearOff.h</a></li>
<li><a href="#trunkSourceWebCoresvgpropertiesSVGAnimatedPathSegListPropertyTearOffh">trunk/Source/WebCore/svg/properties/SVGAnimatedPathSegListPropertyTearOff.h</a></li>
<li><a href="#trunkSourceWebCoresvgpropertiesSVGAnimatedPropertyh">trunk/Source/WebCore/svg/properties/SVGAnimatedProperty.h</a></li>
<li><a href="#trunkSourceWebCoresvgpropertiesSVGAnimatedPropertyMacrosh">trunk/Source/WebCore/svg/properties/SVGAnimatedPropertyMacros.h</a></li>
<li><a href="#trunkSourceWebCoresvgpropertiesSVGAnimatedTransformListPropertyTearOffh">trunk/Source/WebCore/svg/properties/SVGAnimatedTransformListPropertyTearOff.h</a></li>
<li><a href="#trunkSourceWebCoresvgpropertiesSVGListPropertyTearOffh">trunk/Source/WebCore/svg/properties/SVGListPropertyTearOff.h</a></li>
<li><a href="#trunkSourceWebCoresvgpropertiesSVGPathSegListPropertyTearOffcpp">trunk/Source/WebCore/svg/properties/SVGPathSegListPropertyTearOff.cpp</a></li>
</ul>
<h3>Added Paths</h3>
<ul>
<li><a href="#trunkLayoutTestssvganimationssmilleaklistpropertyinstancesexpectedtxt">trunk/LayoutTests/svg/animations/smil-leak-list-property-instances-expected.txt</a></li>
<li><a href="#trunkLayoutTestssvganimationssmilleaklistpropertyinstancessvg">trunk/LayoutTests/svg/animations/smil-leak-list-property-instances.svg</a></li>
</ul>
</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkLayoutTestsChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/ChangeLog (196267 => 196268)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/ChangeLog 2016-02-08 20:53:21 UTC (rev 196267)
+++ trunk/LayoutTests/ChangeLog 2016-02-08 20:54:05 UTC (rev 196268)
</span><span class="lines">@@ -1,3 +1,17 @@
</span><ins>+2016-02-08 Said Abou-Hallawa <sabouhallawa@apple.com>
+
+ REGRESSION(r181345): SVG polyline and polygon leak page
+ https://bugs.webkit.org/show_bug.cgi?id=152759
+
+ Reviewed by Darin Adler.
+
+ * TestExpectations: Remove flaky tests from test expectation.
+
+ * svg/animations/smil-leak-list-property-instances-expected.txt: Added.
+ * svg/animations/smil-leak-list-property-instances.svg: Added.
+ Ensure if SVGPolylineElement.points is requested from JS, the document will
+ not leak.
+
</ins><span class="cx"> 2016-02-08 Brady Eidson <beidson@apple.com>
</span><span class="cx">
</span><span class="cx"> IndexedDB: No test covers cursor.delete() setting the source of the request to the cursor.
</span></span></pre></div>
<a id="trunkLayoutTestsTestExpectations"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/TestExpectations (196267 => 196268)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/TestExpectations 2016-02-08 20:53:21 UTC (rev 196267)
+++ trunk/LayoutTests/TestExpectations 2016-02-08 20:54:05 UTC (rev 196268)
</span><span class="lines">@@ -637,12 +637,6 @@
</span><span class="cx"> # Content extensions are Mac-WK2-only for now
</span><span class="cx"> http/tests/contentextensions [ Skip ]
</span><span class="cx">
</span><del>-# These tests were flaky on Mac only but they became flaky on all ports after r181345
-webkit.org/b/114280 svg/animations/smil-leak-dynamically-added-element-instances.svg [ Pass Failure ]
-webkit.org/b/114280 svg/animations/smil-leak-element-instances-noBaseValRef.svg [ Pass Failure ]
-webkit.org/b/114280 svg/animations/smil-leak-element-instances.svg [ Pass Failure ]
-webkit.org/b/114280 svg/animations/smil-leak-elements.svg [ Pass Failure ]
-
</del><span class="cx"> webkit.org/b/149072 svg/animations/svgboolean-animation-1.html [ Pass Failure ]
</span><span class="cx">
</span><span class="cx"> webkit.org/b/143085 media/track/track-mode.html [ Pass Timeout ]
</span></span></pre></div>
<a id="trunkLayoutTestssvganimationssmilleaklistpropertyinstancesexpectedtxt"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/svg/animations/smil-leak-list-property-instances-expected.txt (0 => 196268)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/svg/animations/smil-leak-list-property-instances-expected.txt (rev 0)
+++ trunk/LayoutTests/svg/animations/smil-leak-list-property-instances-expected.txt 2016-02-08 20:54:05 UTC (rev 196268)
</span><span class="lines">@@ -0,0 +1 @@
</span><ins>+PASS
</ins></span></pre></div>
<a id="trunkLayoutTestssvganimationssmilleaklistpropertyinstancessvg"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/svg/animations/smil-leak-list-property-instances.svg (0 => 196268)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/svg/animations/smil-leak-list-property-instances.svg (rev 0)
+++ trunk/LayoutTests/svg/animations/smil-leak-list-property-instances.svg 2016-02-08 20:54:05 UTC (rev 196268)
</span><span class="lines">@@ -0,0 +1,87 @@
</span><ins>+<svg id="svg" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" onload="load()">
+<defs>
+ <polyline id="polyline" points="20,20 80,20 80,80 20,80" />
+</defs>
+<g id="g"/>
+<text x="50" y="50" id="log"/>
+<script id="script">
+<![CDATA[
+
+var g = document.getElementById("g");
+
+function log(message) {
+ var logDiv = document.getElementById('log');
+ logDiv.appendChild(document.createTextNode(message));
+}
+
+function createAnimatedPolylineInstance() {
+ var use = document.createElementNS("http://www.w3.org/2000/svg", "use");
+ use.setAttributeNS("http://www.w3.org/1999/xlink", "href", "#polyline");
+
+ var anim = document.createElementNS("http://www.w3.org/2000/svg", "animate");
+ anim.setAttribute("attributeType", "XML");
+ anim.setAttribute("attributeName", "points");
+ anim.setAttribute("from", "20,20 80,20 80,80 20,80");
+ anim.setAttribute("to", "10,10 90,10 90,90 10,90");
+ anim.setAttribute("begin", "0s");
+ anim.setAttribute("dur", "10.0s");
+ anim.setAttribute("repeatCount", 1);
+
+ use.appendChild(anim);
+
+ return use;
+}
+
+function startTest() {
+ // Collect garbage before recording starting live node count, in case there are live elements from previous tests.
+ GCController.collect();
+ originalLiveElements = window.internals.numberOfLiveNodes();
+
+ // Hold references to points and animatedPoints on the root instance.
+ points = document.getElementById("polyline").points;
+ animatedPoints = document.getElementById("polyline").animatedPoints;
+
+ for (var i = 0; i < 100; i++)
+ g.appendChild(createAnimatedPolylineInstance());
+
+ setTimeout(continueTest, 0);
+}
+
+function continueTest() {
+ while (g.hasChildNodes())
+ g.removeChild(g.lastChild);
+
+ setTimeout(finishTest, 0);
+}
+
+var attemptsToFinish = 5;
+
+function finishTest() {
+ GCController.collect();
+
+ var liveDelta = window.internals.numberOfLiveNodes() - originalLiveElements;
+ if (liveDelta == 0)
+ log("PASS");
+ else if (--attemptsToFinish) {
+ setTimeout(finishTest, 100);
+ return;
+ } else
+ log("FAIL: " + liveDelta + " extra live node(s)");
+
+ testRunner.notifyDone();
+}
+
+function load() {
+ if (window.testRunner && window.GCController && window.internals) {
+ testRunner.dumpAsText();
+ testRunner.waitUntilDone();
+ } else {
+ log("This test only works when run with the testRunner, GCController, and internals available.");
+ return;
+ }
+
+ setTimeout(startTest, 0);
+}
+]]>
+</script>
+</svg>
</ins></span></pre></div>
<a id="trunkSourceWebCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/ChangeLog (196267 => 196268)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/ChangeLog 2016-02-08 20:53:21 UTC (rev 196267)
+++ trunk/Source/WebCore/ChangeLog 2016-02-08 20:54:05 UTC (rev 196268)
</span><span class="lines">@@ -1,3 +1,137 @@
</span><ins>+2016-02-08 Said Abou-Hallawa <sabouhallawa@apple.com>
+
+ REGRESSION(r181345): SVG polyline and polygon leak page
+ https://bugs.webkit.org/show_bug.cgi?id=152759
+
+ Reviewed by Darin Adler.
+
+ The leak happens because of cyclic reference between SVGListPropertyTearOff
+ and SVGAnimatedListPropertyTearOff which is derived from SVGAnimatedProperty.
+ There is also cyclic reference between SVGAnimatedProperty and SVGElement
+ and this causes the whole document to be leaked. So if the JS requests, for
+ example, an instance of SVGPolylineElement.points, the whole document will be
+ leaked.
+
+ The fix depends on having the cyclic reference as is since the owning and the
+ owned classes have to live together if any of them is referenced. But the owning
+ class caches a raw 'ref-counted' pointer of the owned class. If it is requested
+ for an instance of the owned class it returned a RefPtr<> of it. Once the owned
+ class is not used, it can delete itself. The only thing needed here is to notify
+ the owner class of the deletion so it cleans its caches and be able to create a
+ new pointer if it is requested for an instance of the owned class later.
+
+ Revert the change of r181345 in SVGAnimatedProperty::lookupOrCreateWrapper()
+ to break the cyclic reference between SVGElement and SVGAnimatedProperty.
+
+ Also apply the same approach in SVGAnimatedListPropertyTearOff::baseVal() and
+ animVal() to break cyclic reference between SVGListPropertyTearOff and
+ SVGAnimatedListPropertyTearOff.
+
+ Test: svg/animations/smil-leak-list-property-instances.svg
+
+ * bindings/scripts/CodeGeneratorJS.pm:
+ (NativeToJSValue): The SVG non-string list tear-off properties became of
+ type RefPtr<>. So we need to use get() with the casting expressions.
+
+ * svg/SVGMarkerElement.cpp:
+ (WebCore::SVGMarkerElement::orientType):
+ Use 'auto' type for the return of SVGAnimatedProperty::lookupWrapper().
+
+ * svg/SVGPathElement.cpp:
+ (WebCore::SVGPathElement::pathByteStream):
+ (WebCore::SVGPathElement::lookupOrCreateDWrapper):
+ Since SVGAnimatedProperty::lookupWrappe() returns a RefPtr<> we need to
+ use get() for the casting expressions.
+
+ (WebCore::SVGPathElement::pathSegList):
+ (WebCore::SVGPathElement::normalizedPathSegList):
+ (WebCore::SVGPathElement::animatedPathSegList):
+ (WebCore::SVGPathElement::animatedNormalizedPathSegList):
+ * svg/SVGPathElement.h:
+ Change the return value from raw pointer to RefPtr<>.
+
+ * svg/SVGPathSegWithContext.h:
+ (WebCore::SVGPathSegWithContext::animatedProperty):
+ Change the return type to be RefPtr<> to preserve the value from being deleted.
+
+ * svg/SVGPolyElement.cpp:
+ (WebCore::SVGPolyElement::parseAttribute):
+ Since SVGAnimatedProperty::lookupWrapper() returns a RefPtr<> we need to
+ use get() for the casting expressions.
+
+ (WebCore::SVGPolyElement::points):
+ (WebCore::SVGPolyElement::animatedPoints):
+ * svg/SVGPolyElement.h:
+ Change the return value from raw pointer to RefPtr<>.
+
+ * svg/SVGViewSpec.cpp:
+ (WebCore::SVGViewSpec::setTransformString):
+ Since SVGAnimatedProperty::lookupWrapper() returns a RefPtr<> we need to
+ use get() for the casting expressions.
+
+ (WebCore::SVGViewSpec::transform):
+ * svg/SVGViewSpec.h:
+ Change the return value from raw pointer to RefPtr<>.
+
+ * svg/properties/SVGAnimatedListPropertyTearOff.h:
+ (WebCore::SVGAnimatedListPropertyTearOff::baseVal):
+ (WebCore::SVGAnimatedListPropertyTearOff::animVal):
+ Change the return value from raw pointer to RefPtr<> and change the cached
+ value from RefPtr<> to raw pointer. If the property is null, it will be
+ created, its raw pointer will be cached and the only ref-counted RefPtr<>
+ will be returned. This will guarantee, the RefPtr<> will be deleted once
+ it is not used anymore.
+
+ (WebCore::SVGAnimatedListPropertyTearOff::propertyWillBeDeleted):
+ Clean the raw pointer caches m_baseVal and m_animVal upon deleting the
+ actual pointer. This function will be called from the destructor of
+ SVGListPropertyTearOff.
+
+ (WebCore::SVGAnimatedListPropertyTearOff::findItem):
+ (WebCore::SVGAnimatedListPropertyTearOff::removeItemFromList):
+ We have to ensure the baseVal() is created before using it.
+
+ (WebCore::SVGAnimatedListPropertyTearOff::detachListWrappers):
+ (WebCore::SVGAnimatedListPropertyTearOff::currentAnimatedValue):
+ (WebCore::SVGAnimatedListPropertyTearOff::animationStarted):
+ (WebCore::SVGAnimatedListPropertyTearOff::animationEnded):
+ (WebCore::SVGAnimatedListPropertyTearOff::synchronizeWrappersIfNeeded):
+ (WebCore::SVGAnimatedListPropertyTearOff::animValWillChange):
+ (WebCore::SVGAnimatedListPropertyTearOff::animValDidChange):
+ For animation, a separate RefPtr<> 'm_animatingAnimVal' will be assigned
+ to the animVal(). This will prevent deleting m_animVal while animation.
+
+ * svg/properties/SVGAnimatedPathSegListPropertyTearOff.h:
+ (WebCore::SVGAnimatedPathSegListPropertyTearOff::baseVal):
+ (WebCore::SVGAnimatedPathSegListPropertyTearOff::animVal):
+ Same as what is done in SVGAnimatedListPropertyTearOff.
+
+ (WebCore::SVGAnimatedPathSegListPropertyTearOff::findItem):
+ (WebCore::SVGAnimatedPathSegListPropertyTearOff::removeItemFromList):
+ Same as what is done in SVGAnimatedListPropertyTearOff.
+
+ * svg/properties/SVGAnimatedProperty.h:
+ (WebCore::SVGAnimatedProperty::lookupOrCreateWrapper):
+ Change the return value from raw reference to Ref<> and change the
+ cached value from Ref<> to raw pointer. This reverts the change of
+ r181345 in this function.
+
+ (WebCore::SVGAnimatedProperty::lookupWrapper):
+ Change the return value from raw pointer to RefPtr<>.
+
+ * svg/properties/SVGAnimatedPropertyMacros.h:
+ Use 'auto' type for the return of SVGAnimatedProperty::lookupWrapper().
+
+ * svg/properties/SVGAnimatedTransformListPropertyTearOff.h:
+ (WebCore::SVGAnimatedTransformListPropertyTearOff::baseVal):
+ (WebCore::SVGAnimatedTransformListPropertyTearOff::animVal):
+ Same as what is done in SVGAnimatedListPropertyTearOff.
+
+ * svg/properties/SVGListPropertyTearOff.h:
+ (WebCore::SVGListPropertyTearOff::~SVGListPropertyTearOff):
+ Call the SVGAnimatedListPropertyTearOff::propertyWillBeDeleted() to clean
+ its raw pointers when the RefPtr<> deletes itself.
+
</ins><span class="cx"> 2016-02-08 Carlos Garcia Campos <cgarcia@igalia.com>
</span><span class="cx">
</span><span class="cx"> [GTK] WebKitWebView should send crossing events to the WebProcess
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptsCodeGeneratorJSpm"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm (196267 => 196268)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm 2016-02-08 20:53:21 UTC (rev 196267)
+++ trunk/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm 2016-02-08 20:54:05 UTC (rev 196268)
</span><span class="lines">@@ -4252,7 +4252,11 @@
</span><span class="cx"> return "toJSNewlyCreated(state, $globalObject, WTF::getPtr($value))";
</span><span class="cx"> }
</span><span class="cx">
</span><del>- if ($codeGenerator->IsSVGAnimatedType($interfaceName) or $interfaceName eq "SVGViewSpec") {
</del><ins>+ # $type has to be used here because SVGViewSpec.transform is of type SVGTransformList.
+ if ($codeGenerator->IsSVGTypeNeedingTearOff($type) and $type =~ /(?<!String)List$/) {
+ # Convert from abstract RefPtr<ListProperty> to real type, so the right toJS() method can be invoked.
+ $value = "static_cast<" . GetNativeType($type) . ">($value" . ".get())";
+ } elsif ($codeGenerator->IsSVGAnimatedType($interfaceName) or $interfaceName eq "SVGViewSpec") {
</ins><span class="cx"> # Convert from abstract SVGProperty to real type, so the right toJS() method can be invoked.
</span><span class="cx"> $value = "static_cast<" . GetNativeType($type) . ">($value)";
</span><span class="cx"> } elsif ($codeGenerator->IsSVGTypeNeedingTearOff($type) and not $interfaceName =~ /List$/) {
</span></span></pre></div>
<a id="trunkSourceWebCoresvgSVGMarkerElementcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/svg/SVGMarkerElement.cpp (196267 => 196268)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/svg/SVGMarkerElement.cpp 2016-02-08 20:53:21 UTC (rev 196267)
+++ trunk/Source/WebCore/svg/SVGMarkerElement.cpp 2016-02-08 20:54:05 UTC (rev 196268)
</span><span class="lines">@@ -251,7 +251,7 @@
</span><span class="cx">
</span><span class="cx"> SVGMarkerOrientType& SVGMarkerElement::orientType() const
</span><span class="cx"> {
</span><del>- if (SVGAnimatedEnumeration* wrapper = SVGAnimatedProperty::lookupWrapper<UseOwnerType, SVGAnimatedEnumeration>(this, orientTypePropertyInfo())) {
</del><ins>+ if (auto wrapper = SVGAnimatedProperty::lookupWrapper<UseOwnerType, SVGAnimatedEnumeration>(this, orientTypePropertyInfo())) {
</ins><span class="cx"> if (wrapper->isAnimating()) {
</span><span class="cx"> ASSERT(wrapper->currentAnimatedValue() < SVGMarkerOrientMax);
</span><span class="cx"> return reinterpret_cast<SVGMarkerOrientType&>(wrapper->currentAnimatedValue());
</span></span></pre></div>
<a id="trunkSourceWebCoresvgSVGPathElementcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/svg/SVGPathElement.cpp (196267 => 196268)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/svg/SVGPathElement.cpp 2016-02-08 20:53:21 UTC (rev 196267)
+++ trunk/Source/WebCore/svg/SVGPathElement.cpp 2016-02-08 20:54:05 UTC (rev 196268)
</span><span class="lines">@@ -294,11 +294,11 @@
</span><span class="cx">
</span><span class="cx"> const SVGPathByteStream& SVGPathElement::pathByteStream() const
</span><span class="cx"> {
</span><del>- SVGAnimatedProperty* property = SVGAnimatedProperty::lookupWrapper<SVGPathElement, SVGAnimatedPathSegListPropertyTearOff>(this, dPropertyInfo());
</del><ins>+ auto property = SVGAnimatedProperty::lookupWrapper<SVGPathElement, SVGAnimatedPathSegListPropertyTearOff>(this, dPropertyInfo());
</ins><span class="cx"> if (!property || !property->isAnimating())
</span><span class="cx"> return m_pathByteStream;
</span><span class="cx">
</span><del>- SVGPathByteStream* animatedPathByteStream = static_cast<SVGAnimatedPathSegListPropertyTearOff*>(property)->animatedPathByteStream();
</del><ins>+ SVGPathByteStream* animatedPathByteStream = static_cast<SVGAnimatedPathSegListPropertyTearOff*>(property.get())->animatedPathByteStream();
</ins><span class="cx"> if (!animatedPathByteStream)
</span><span class="cx"> return m_pathByteStream;
</span><span class="cx">
</span><span class="lines">@@ -310,7 +310,7 @@
</span><span class="cx"> ASSERT(contextElement);
</span><span class="cx"> SVGPathElement& ownerType = downcast<SVGPathElement>(*contextElement);
</span><span class="cx">
</span><del>- if (SVGAnimatedProperty* property = SVGAnimatedProperty::lookupWrapper<SVGPathElement, SVGAnimatedPathSegListPropertyTearOff>(&ownerType, dPropertyInfo()))
</del><ins>+ if (auto property = SVGAnimatedProperty::lookupWrapper<SVGPathElement, SVGAnimatedPathSegListPropertyTearOff>(&ownerType, dPropertyInfo()))
</ins><span class="cx"> return *property;
</span><span class="cx">
</span><span class="cx"> // Build initial SVGPathSegList.
</span><span class="lines">@@ -329,29 +329,29 @@
</span><span class="cx"> ownerType.m_pathSegList.synchronize(&ownerType, dPropertyInfo()->attributeName, ownerType.m_pathSegList.value.valueAsString());
</span><span class="cx"> }
</span><span class="cx">
</span><del>-SVGPathSegListPropertyTearOff* SVGPathElement::pathSegList()
</del><ins>+RefPtr<SVGPathSegListPropertyTearOff> SVGPathElement::pathSegList()
</ins><span class="cx"> {
</span><span class="cx"> m_pathSegList.shouldSynchronize = true;
</span><del>- return static_cast<SVGPathSegListPropertyTearOff*>(static_reference_cast<SVGAnimatedPathSegListPropertyTearOff>(lookupOrCreateDWrapper(this))->baseVal());
</del><ins>+ return static_cast<SVGPathSegListPropertyTearOff*>(static_reference_cast<SVGAnimatedPathSegListPropertyTearOff>(lookupOrCreateDWrapper(this))->baseVal().get());
</ins><span class="cx"> }
</span><span class="cx">
</span><del>-SVGPathSegListPropertyTearOff* SVGPathElement::normalizedPathSegList()
</del><ins>+RefPtr<SVGPathSegListPropertyTearOff> SVGPathElement::normalizedPathSegList()
</ins><span class="cx"> {
</span><span class="cx"> // FIXME: https://bugs.webkit.org/show_bug.cgi?id=15412 - Implement normalized path segment lists!
</span><del>- return 0;
</del><ins>+ return nullptr;
</ins><span class="cx"> }
</span><span class="cx">
</span><del>-SVGPathSegListPropertyTearOff* SVGPathElement::animatedPathSegList()
</del><ins>+RefPtr<SVGPathSegListPropertyTearOff> SVGPathElement::animatedPathSegList()
</ins><span class="cx"> {
</span><span class="cx"> m_pathSegList.shouldSynchronize = true;
</span><span class="cx"> m_isAnimValObserved = true;
</span><del>- return static_cast<SVGPathSegListPropertyTearOff*>(static_reference_cast<SVGAnimatedPathSegListPropertyTearOff>(lookupOrCreateDWrapper(this))->animVal());
</del><ins>+ return static_cast<SVGPathSegListPropertyTearOff*>(static_reference_cast<SVGAnimatedPathSegListPropertyTearOff>(lookupOrCreateDWrapper(this))->animVal().get());
</ins><span class="cx"> }
</span><span class="cx">
</span><del>-SVGPathSegListPropertyTearOff* SVGPathElement::animatedNormalizedPathSegList()
</del><ins>+RefPtr<SVGPathSegListPropertyTearOff> SVGPathElement::animatedNormalizedPathSegList()
</ins><span class="cx"> {
</span><span class="cx"> // FIXME: https://bugs.webkit.org/show_bug.cgi?id=15412 - Implement normalized path segment lists!
</span><del>- return 0;
</del><ins>+ return nullptr;
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> void SVGPathElement::pathSegListChanged(SVGPathSegRole role, ListModification listModification)
</span></span></pre></div>
<a id="trunkSourceWebCoresvgSVGPathElementh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/svg/SVGPathElement.h (196267 => 196268)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/svg/SVGPathElement.h 2016-02-08 20:53:21 UTC (rev 196267)
+++ trunk/Source/WebCore/svg/SVGPathElement.h 2016-02-08 20:54:05 UTC (rev 196268)
</span><span class="lines">@@ -82,10 +82,10 @@
</span><span class="cx"> Ref<SVGPathSegCurvetoQuadraticSmoothRel> createSVGPathSegCurvetoQuadraticSmoothRel(float x, float y, SVGPathSegRole = PathSegUndefinedRole);
</span><span class="cx">
</span><span class="cx"> // Used in the bindings only.
</span><del>- SVGPathSegListPropertyTearOff* pathSegList();
- SVGPathSegListPropertyTearOff* animatedPathSegList();
- SVGPathSegListPropertyTearOff* normalizedPathSegList();
- SVGPathSegListPropertyTearOff* animatedNormalizedPathSegList();
</del><ins>+ RefPtr<SVGPathSegListPropertyTearOff> pathSegList();
+ RefPtr<SVGPathSegListPropertyTearOff> animatedPathSegList();
+ RefPtr<SVGPathSegListPropertyTearOff> normalizedPathSegList();
+ RefPtr<SVGPathSegListPropertyTearOff> animatedNormalizedPathSegList();
</ins><span class="cx">
</span><span class="cx"> const SVGPathByteStream& pathByteStream() const;
</span><span class="cx">
</span></span></pre></div>
<a id="trunkSourceWebCoresvgSVGPathSegWithContexth"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/svg/SVGPathSegWithContext.h (196267 => 196268)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/svg/SVGPathSegWithContext.h 2016-02-08 20:53:21 UTC (rev 196267)
+++ trunk/Source/WebCore/svg/SVGPathSegWithContext.h 2016-02-08 20:54:05 UTC (rev 196268)
</span><span class="lines">@@ -32,7 +32,7 @@
</span><span class="cx"> {
</span><span class="cx"> }
</span><span class="cx">
</span><del>- SVGAnimatedProperty* animatedProperty() const
</del><ins>+ RefPtr<SVGAnimatedProperty> animatedProperty() const
</ins><span class="cx"> {
</span><span class="cx"> if (!m_element)
</span><span class="cx"> return nullptr;
</span></span></pre></div>
<a id="trunkSourceWebCoresvgSVGPolyElementcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/svg/SVGPolyElement.cpp (196267 => 196268)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/svg/SVGPolyElement.cpp 2016-02-08 20:53:21 UTC (rev 196267)
+++ trunk/Source/WebCore/svg/SVGPolyElement.cpp 2016-02-08 20:54:05 UTC (rev 196268)
</span><span class="lines">@@ -68,8 +68,8 @@
</span><span class="cx"> if (!pointsListFromSVGData(newList, value))
</span><span class="cx"> document().accessSVGExtensions().reportError("Problem parsing points=\"" + value + "\"");
</span><span class="cx">
</span><del>- if (SVGAnimatedProperty* wrapper = SVGAnimatedProperty::lookupWrapper<SVGPolyElement, SVGAnimatedPointList>(this, pointsPropertyInfo()))
- static_cast<SVGAnimatedPointList*>(wrapper)->detachListWrappers(newList.size());
</del><ins>+ if (auto wrapper = SVGAnimatedProperty::lookupWrapper<SVGPolyElement, SVGAnimatedPointList>(this, pointsPropertyInfo()))
+ static_pointer_cast<SVGAnimatedPointList>(wrapper)->detachListWrappers(newList.size());
</ins><span class="cx">
</span><span class="cx"> m_points.value = newList;
</span><span class="cx"> return;
</span><span class="lines">@@ -118,16 +118,16 @@
</span><span class="cx"> (&ownerType, pointsPropertyInfo(), ownerType.m_points.value);
</span><span class="cx"> }
</span><span class="cx">
</span><del>-SVGListPropertyTearOff<SVGPointList>* SVGPolyElement::points()
</del><ins>+RefPtr<SVGListPropertyTearOff<SVGPointList>> SVGPolyElement::points()
</ins><span class="cx"> {
</span><span class="cx"> m_points.shouldSynchronize = true;
</span><del>- return static_cast<SVGListPropertyTearOff<SVGPointList>*>(static_reference_cast<SVGAnimatedPointList>(lookupOrCreatePointsWrapper(this))->baseVal());
</del><ins>+ return static_cast<SVGListPropertyTearOff<SVGPointList>*>(static_reference_cast<SVGAnimatedPointList>(lookupOrCreatePointsWrapper(this))->baseVal().get());
</ins><span class="cx"> }
</span><span class="cx">
</span><del>-SVGListPropertyTearOff<SVGPointList>* SVGPolyElement::animatedPoints()
</del><ins>+RefPtr<SVGListPropertyTearOff<SVGPointList>> SVGPolyElement::animatedPoints()
</ins><span class="cx"> {
</span><span class="cx"> m_points.shouldSynchronize = true;
</span><del>- return static_cast<SVGListPropertyTearOff<SVGPointList>*>(static_reference_cast<SVGAnimatedPointList>(lookupOrCreatePointsWrapper(this))->animVal());
</del><ins>+ return static_cast<SVGListPropertyTearOff<SVGPointList>*>(static_reference_cast<SVGAnimatedPointList>(lookupOrCreatePointsWrapper(this))->animVal().get());
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceWebCoresvgSVGPolyElementh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/svg/SVGPolyElement.h (196267 => 196268)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/svg/SVGPolyElement.h 2016-02-08 20:53:21 UTC (rev 196267)
+++ trunk/Source/WebCore/svg/SVGPolyElement.h 2016-02-08 20:54:05 UTC (rev 196268)
</span><span class="lines">@@ -31,8 +31,8 @@
</span><span class="cx">
</span><span class="cx"> class SVGPolyElement : public SVGGraphicsElement, public SVGExternalResourcesRequired {
</span><span class="cx"> public:
</span><del>- SVGListPropertyTearOff<SVGPointList>* points();
- SVGListPropertyTearOff<SVGPointList>* animatedPoints();
</del><ins>+ RefPtr<SVGListPropertyTearOff<SVGPointList>> points();
+ RefPtr<SVGListPropertyTearOff<SVGPointList>> animatedPoints();
</ins><span class="cx">
</span><span class="cx"> SVGPointList& pointList() const { return m_points.value; }
</span><span class="cx">
</span></span></pre></div>
<a id="trunkSourceWebCoresvgSVGViewSpeccpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/svg/SVGViewSpec.cpp (196267 => 196268)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/svg/SVGViewSpec.cpp 2016-02-08 20:53:21 UTC (rev 196267)
+++ trunk/Source/WebCore/svg/SVGViewSpec.cpp 2016-02-08 20:54:05 UTC (rev 196268)
</span><span class="lines">@@ -114,8 +114,8 @@
</span><span class="cx"> SVGTransformList newList;
</span><span class="cx"> newList.parse(transform);
</span><span class="cx">
</span><del>- if (SVGAnimatedProperty* wrapper = SVGAnimatedProperty::lookupWrapper<SVGElement, SVGAnimatedTransformList>(m_contextElement, transformPropertyInfo()))
- static_cast<SVGAnimatedTransformList*>(wrapper)->detachListWrappers(newList.size());
</del><ins>+ if (auto wrapper = SVGAnimatedProperty::lookupWrapper<SVGElement, SVGAnimatedTransformList>(m_contextElement, transformPropertyInfo()))
+ static_pointer_cast<SVGAnimatedTransformList>(wrapper)->detachListWrappers(newList.size());
</ins><span class="cx">
</span><span class="cx"> m_transform = newList;
</span><span class="cx"> }
</span><span class="lines">@@ -145,12 +145,12 @@
</span><span class="cx"> return downcast<SVGElement>(element);
</span><span class="cx"> }
</span><span class="cx">
</span><del>-SVGTransformListPropertyTearOff* SVGViewSpec::transform()
</del><ins>+RefPtr<SVGTransformListPropertyTearOff> SVGViewSpec::transform()
</ins><span class="cx"> {
</span><span class="cx"> if (!m_contextElement)
</span><span class="cx"> return nullptr;
</span><span class="cx"> // Return the animVal here, as its readonly by default - which is exactly what we want here.
</span><del>- return static_cast<SVGTransformListPropertyTearOff*>(static_reference_cast<SVGAnimatedTransformList>(lookupOrCreateTransformWrapper(this))->animVal());
</del><ins>+ return static_pointer_cast<SVGTransformListPropertyTearOff>(static_reference_cast<SVGAnimatedTransformList>(lookupOrCreateTransformWrapper(this))->animVal());
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> RefPtr<SVGAnimatedRect> SVGViewSpec::viewBoxAnimated()
</span></span></pre></div>
<a id="trunkSourceWebCoresvgSVGViewSpech"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/svg/SVGViewSpec.h (196267 => 196268)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/svg/SVGViewSpec.h 2016-02-08 20:53:21 UTC (rev 196267)
+++ trunk/Source/WebCore/svg/SVGViewSpec.h 2016-02-08 20:54:05 UTC (rev 196268)
</span><span class="lines">@@ -68,7 +68,7 @@
</span><span class="cx"> void resetContextElement() { m_contextElement = nullptr; }
</span><span class="cx">
</span><span class="cx"> // Custom non-animated 'transform' property.
</span><del>- SVGTransformListPropertyTearOff* transform();
</del><ins>+ RefPtr<SVGTransformListPropertyTearOff> transform();
</ins><span class="cx"> SVGTransformList transformBaseValue() const { return m_transform; }
</span><span class="cx">
</span><span class="cx"> // Custom animated 'viewBox' property.
</span></span></pre></div>
<a id="trunkSourceWebCoresvgpropertiesSVGAnimatedListPropertyTearOffh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/svg/properties/SVGAnimatedListPropertyTearOff.h (196267 => 196268)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/svg/properties/SVGAnimatedListPropertyTearOff.h 2016-02-08 20:53:21 UTC (rev 196267)
+++ trunk/Source/WebCore/svg/properties/SVGAnimatedListPropertyTearOff.h 2016-02-08 20:54:05 UTC (rev 196268)
</span><span class="lines">@@ -39,35 +39,49 @@
</span><span class="cx"> typedef SVGListPropertyTearOff<PropertyType> ListPropertyTearOff;
</span><span class="cx"> typedef PropertyType ContentType;
</span><span class="cx">
</span><del>- virtual ListProperty* baseVal()
</del><ins>+ virtual RefPtr<ListProperty> baseVal()
</ins><span class="cx"> {
</span><del>- if (!m_baseVal)
- m_baseVal = ListPropertyTearOff::create(this, BaseValRole, m_values, m_wrappers);
- return static_cast<ListProperty*>(m_baseVal.get());
</del><ins>+ if (m_baseVal)
+ return m_baseVal;
+
+ auto property = ListPropertyTearOff::create(this, BaseValRole, m_values, m_wrappers);
+ m_baseVal = property.ptr();
+ return WTFMove(property);
</ins><span class="cx"> }
</span><span class="cx">
</span><del>- virtual ListProperty* animVal()
</del><ins>+ virtual RefPtr<ListProperty> animVal()
</ins><span class="cx"> {
</span><del>- if (!m_animVal)
- m_animVal = ListPropertyTearOff::create(this, AnimValRole, m_values, m_wrappers);
- return static_cast<ListProperty*>(m_animVal.get());
</del><ins>+ if (m_animVal)
+ return m_animVal;
+
+ auto property = ListPropertyTearOff::create(this, AnimValRole, m_values, m_wrappers);
+ m_animVal = property.ptr();
+ return WTFMove(property);
</ins><span class="cx"> }
</span><span class="cx">
</span><ins>+ void propertyWillBeDeleted(const ListProperty& property)
+ {
+ if (&property == m_baseVal)
+ m_baseVal = nullptr;
+ else if (&property == m_animVal)
+ m_animVal = nullptr;
+ }
+
</ins><span class="cx"> virtual bool isAnimatedListTearOff() const override { return true; }
</span><span class="cx">
</span><del>- int findItem(SVGProperty* property) const
</del><ins>+ int findItem(SVGProperty* property)
</ins><span class="cx"> {
</span><span class="cx"> // This should ever be called for our baseVal, as animVal can't modify the list.
</span><span class="cx"> // It's safe to cast to ListPropertyTearOff here as all classes inheriting from us supply their own removeItemFromList() method.
</span><span class="cx"> typedef SVGPropertyTearOff<typename SVGPropertyTraits<PropertyType>::ListItemType> ListItemTearOff;
</span><del>- return static_cast<ListPropertyTearOff*>(m_baseVal.get())->findItem(static_cast<ListItemTearOff*>(property));
</del><ins>+ return static_pointer_cast<ListPropertyTearOff>(baseVal())->findItem(static_cast<ListItemTearOff*>(property));
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> void removeItemFromList(size_t itemIndex, bool shouldSynchronizeWrappers)
</span><span class="cx"> {
</span><span class="cx"> // This should ever be called for our baseVal, as animVal can't modify the list.
</span><span class="cx"> // It's safe to cast to ListPropertyTearOff here as all classes inheriting from us supply their own removeItemFromList() method.
</span><del>- static_cast<ListPropertyTearOff*>(m_baseVal.get())->removeItemFromList(itemIndex, shouldSynchronizeWrappers);
</del><ins>+ static_pointer_cast<ListPropertyTearOff>(baseVal())->removeItemFromList(itemIndex, shouldSynchronizeWrappers);
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> void detachListWrappers(unsigned newListSize)
</span><span class="lines">@@ -78,8 +92,8 @@
</span><span class="cx"> PropertyType& currentAnimatedValue()
</span><span class="cx"> {
</span><span class="cx"> ASSERT(m_isAnimating);
</span><del>- ASSERT(m_animVal);
- return static_cast<ListProperty*>(m_animVal.get())->values();
</del><ins>+ ASSERT(m_animatingAnimVal);
+ return static_pointer_cast<ListProperty>(m_animatingAnimVal)->values();
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> const PropertyType& currentBaseValue() const
</span><span class="lines">@@ -90,6 +104,7 @@
</span><span class="cx"> void animationStarted(PropertyType* newAnimVal, bool shouldOwnValues = false)
</span><span class="cx"> {
</span><span class="cx"> ASSERT(!m_isAnimating);
</span><ins>+ ASSERT(!m_animatingAnimVal);
</ins><span class="cx"> ASSERT(newAnimVal);
</span><span class="cx"> ASSERT(m_values.size() == m_wrappers.size());
</span><span class="cx"> ASSERT(m_animatedWrappers.isEmpty());
</span><span class="lines">@@ -98,57 +113,55 @@
</span><span class="cx"> if (!newAnimVal->isEmpty())
</span><span class="cx"> m_animatedWrappers.fill(0, newAnimVal->size());
</span><span class="cx">
</span><del>- ListProperty* animVal = static_cast<ListProperty*>(this->animVal());
- animVal->setValuesAndWrappers(newAnimVal, &m_animatedWrappers, shouldOwnValues);
- ASSERT(animVal->values().size() == animVal->wrappers().size());
- ASSERT(animVal->wrappers().size() == m_animatedWrappers.size());
</del><ins>+ m_animatingAnimVal = animVal();
+ m_animatingAnimVal->setValuesAndWrappers(newAnimVal, &m_animatedWrappers, shouldOwnValues);
+ ASSERT(m_animatingAnimVal->values().size() == m_animatingAnimVal->wrappers().size());
+ ASSERT(m_animatingAnimVal->wrappers().size() == m_animatedWrappers.size());
</ins><span class="cx"> m_isAnimating = true;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> void animationEnded()
</span><span class="cx"> {
</span><span class="cx"> ASSERT(m_isAnimating);
</span><del>- ASSERT(m_animVal);
</del><ins>+ ASSERT(m_animatingAnimVal);
</ins><span class="cx"> ASSERT(m_values.size() == m_wrappers.size());
</span><span class="cx">
</span><del>- ListProperty* animVal = static_cast<ListProperty*>(m_animVal.get());
- ASSERT(animVal->values().size() == animVal->wrappers().size());
- ASSERT(animVal->wrappers().size() == m_animatedWrappers.size());
</del><ins>+ ASSERT(m_animatingAnimVal->values().size() == m_animatingAnimVal->wrappers().size());
+ ASSERT(m_animatingAnimVal->wrappers().size() == m_animatedWrappers.size());
</ins><span class="cx">
</span><del>- animVal->setValuesAndWrappers(&m_values, &m_wrappers, false);
- ASSERT(animVal->values().size() == animVal->wrappers().size());
- ASSERT(animVal->wrappers().size() == m_wrappers.size());
</del><ins>+ m_animatingAnimVal->setValuesAndWrappers(&m_values, &m_wrappers, false);
+ ASSERT(m_animatingAnimVal->values().size() == m_animatingAnimVal->wrappers().size());
+ ASSERT(m_animatingAnimVal->wrappers().size() == m_wrappers.size());
</ins><span class="cx">
</span><span class="cx"> m_animatedWrappers.clear();
</span><ins>+ m_animatingAnimVal = nullptr;
</ins><span class="cx"> m_isAnimating = false;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> void synchronizeWrappersIfNeeded()
</span><span class="cx"> {
</span><ins>+ ASSERT(m_isAnimating);
+ ASSERT(m_animatingAnimVal);
+
</ins><span class="cx"> // Eventually the wrapper list needs synchronization because any SVGAnimateLengthList::calculateAnimatedValue() call may
</span><span class="cx"> // mutate the length of our values() list, and thus the wrapper() cache needs synchronization, to have the same size.
</span><span class="cx"> // Also existing wrappers which point directly at elements in the existing SVGLengthList have to be detached (so a copy
</span><span class="cx"> // of them is created, so existing animVal variables in JS are kept-alive). If we'd detach them later the underlying
</span><span class="cx"> // SVGLengthList was already mutated, and our list item wrapper tear offs would point nowhere. Assertions would fire.
</span><del>- ListProperty* animVal = static_cast<ListProperty*>(m_animVal.get());
- animVal->detachListWrappers(animVal->values().size());
</del><ins>+ m_animatingAnimVal->detachListWrappers(m_animatingAnimVal->values().size());
</ins><span class="cx">
</span><del>- ASSERT(animVal->values().size() == animVal->wrappers().size());
- ASSERT(animVal->wrappers().size() == m_animatedWrappers.size());
</del><ins>+ ASSERT(m_animatingAnimVal->values().size() == m_animatingAnimVal->wrappers().size());
+ ASSERT(m_animatingAnimVal->wrappers().size() == m_animatedWrappers.size());
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> void animValWillChange()
</span><span class="cx"> {
</span><del>- ASSERT(m_isAnimating);
- ASSERT(m_animVal);
</del><span class="cx"> ASSERT(m_values.size() == m_wrappers.size());
</span><span class="cx"> synchronizeWrappersIfNeeded();
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> void animValDidChange()
</span><span class="cx"> {
</span><del>- ASSERT(m_isAnimating);
- ASSERT(m_animVal);
</del><span class="cx"> ASSERT(m_values.size() == m_wrappers.size());
</span><span class="cx"> synchronizeWrappersIfNeeded();
</span><span class="cx"> }
</span><span class="lines">@@ -173,8 +186,13 @@
</span><span class="cx"> ListWrapperCache m_wrappers;
</span><span class="cx"> ListWrapperCache m_animatedWrappers;
</span><span class="cx">
</span><del>- RefPtr<SVGProperty> m_baseVal;
- RefPtr<SVGProperty> m_animVal;
</del><ins>+ // Cache the raw pointer but return a RefPtr<>. This will break the cyclic reference
+ // between SVGListPropertyTearOff and SVGAnimatedListPropertyTearOff once the property
+ // pointer is not needed.
+ ListProperty* m_baseVal { nullptr };
+ ListProperty* m_animVal { nullptr };
+
+ RefPtr<ListProperty> m_animatingAnimVal;
</ins><span class="cx"> };
</span><span class="cx">
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceWebCoresvgpropertiesSVGAnimatedPathSegListPropertyTearOffh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/svg/properties/SVGAnimatedPathSegListPropertyTearOff.h (196267 => 196268)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/svg/properties/SVGAnimatedPathSegListPropertyTearOff.h 2016-02-08 20:53:21 UTC (rev 196267)
+++ trunk/Source/WebCore/svg/properties/SVGAnimatedPathSegListPropertyTearOff.h 2016-02-08 20:54:05 UTC (rev 196268)
</span><span class="lines">@@ -31,32 +31,36 @@
</span><span class="cx">
</span><span class="cx"> class SVGAnimatedPathSegListPropertyTearOff : public SVGAnimatedListPropertyTearOff<SVGPathSegList> {
</span><span class="cx"> public:
</span><del>- virtual SVGListProperty<SVGPathSegList>* baseVal() override
</del><ins>+ virtual RefPtr<ListProperty> baseVal() override
</ins><span class="cx"> {
</span><del>- if (!m_baseVal)
- m_baseVal = SVGPathSegListPropertyTearOff::create(this, BaseValRole, PathSegUnalteredRole, m_values, m_wrappers);
- return static_cast<SVGListProperty<SVGPathSegList>*>(m_baseVal.get());
</del><ins>+ if (m_baseVal)
+ return m_baseVal;
+
+ auto property = SVGPathSegListPropertyTearOff::create(this, BaseValRole, PathSegUnalteredRole, m_values, m_wrappers);
+ m_baseVal = property.ptr();
+ return WTFMove(property);
</ins><span class="cx"> }
</span><span class="cx">
</span><del>- virtual SVGListProperty<SVGPathSegList>* animVal() override
</del><ins>+ virtual RefPtr<ListProperty> animVal() override
</ins><span class="cx"> {
</span><del>- if (!m_animVal)
- m_animVal = SVGPathSegListPropertyTearOff::create(this, AnimValRole, PathSegUnalteredRole, m_values, m_wrappers);
- return static_cast<SVGListProperty<SVGPathSegList>*>(m_animVal.get());
</del><ins>+ if (m_animVal)
+ return m_animVal;
+
+ auto property = SVGPathSegListPropertyTearOff::create(this, AnimValRole, PathSegUnalteredRole, m_values, m_wrappers);
+ m_animVal = property.ptr();
+ return WTFMove(property);
</ins><span class="cx"> }
</span><span class="cx">
</span><del>- int findItem(const RefPtr<SVGPathSeg>& segment) const
</del><ins>+ int findItem(const RefPtr<SVGPathSeg>& segment)
</ins><span class="cx"> {
</span><span class="cx"> // This should ever be called for our baseVal, as animVal can't modify the list.
</span><del>- ASSERT(m_baseVal);
- return static_cast<SVGPathSegListPropertyTearOff*>(m_baseVal.get())->findItem(segment);
</del><ins>+ return static_cast<SVGPathSegListPropertyTearOff*>(baseVal().get())->findItem(segment);
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> void removeItemFromList(size_t itemIndex, bool shouldSynchronizeWrappers)
</span><span class="cx"> {
</span><span class="cx"> // This should ever be called for our baseVal, as animVal can't modify the list.
</span><del>- ASSERT(m_baseVal);
- static_cast<SVGPathSegListPropertyTearOff*>(m_baseVal.get())->removeItemFromList(itemIndex, shouldSynchronizeWrappers);
</del><ins>+ static_cast<SVGPathSegListPropertyTearOff*>(baseVal().get())->removeItemFromList(itemIndex, shouldSynchronizeWrappers);
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> static Ref<SVGAnimatedPathSegListPropertyTearOff> create(SVGElement* contextElement, const QualifiedName& attributeName, AnimatedPropertyType animatedPropertyType, SVGPathSegList& values)
</span></span></pre></div>
<a id="trunkSourceWebCoresvgpropertiesSVGAnimatedPropertyh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/svg/properties/SVGAnimatedProperty.h (196267 => 196268)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/svg/properties/SVGAnimatedProperty.h 2016-02-08 20:53:21 UTC (rev 196267)
+++ trunk/Source/WebCore/svg/properties/SVGAnimatedProperty.h 2016-02-08 20:54:05 UTC (rev 196268)
</span><span class="lines">@@ -48,22 +48,27 @@
</span><span class="cx"> virtual ~SVGAnimatedProperty();
</span><span class="cx">
</span><span class="cx"> template<typename OwnerType, typename TearOffType, typename PropertyType>
</span><del>- static TearOffType& lookupOrCreateWrapper(OwnerType* element, const SVGPropertyInfo* info, PropertyType& property)
</del><ins>+ static Ref<TearOffType> lookupOrCreateWrapper(OwnerType* element, const SVGPropertyInfo* info, PropertyType& property)
</ins><span class="cx"> {
</span><span class="cx"> ASSERT(info);
</span><span class="cx"> SVGAnimatedPropertyDescription key(element, info->propertyIdentifier);
</span><del>- auto& slot = animatedPropertyCache()->add(key, nullptr).iterator->value;
- if (!slot) {
- Ref<SVGAnimatedProperty> wrapper = TearOffType::create(element, info->attributeName, info->animatedPropertyType, property);
- if (info->animatedPropertyState == PropertyIsReadOnly)
- wrapper->setIsReadOnly();
- slot = &wrapper.leakRef();
- }
- return static_cast<TearOffType&>(*slot);
</del><ins>+
+ auto result = animatedPropertyCache()->add(key, nullptr);
+ if (!result.isNewEntry)
+ return static_cast<TearOffType&>(*result.iterator->value);
+
+ Ref<SVGAnimatedProperty> wrapper = TearOffType::create(element, info->attributeName, info->animatedPropertyType, property);
+ if (info->animatedPropertyState == PropertyIsReadOnly)
+ wrapper->setIsReadOnly();
+
+ // Cache the raw pointer but return a Ref<>. This will break the cyclic reference
+ // between SVGAnimatedProperty and SVGElement once the property pointer is not needed.
+ result.iterator->value = wrapper.ptr();
+ return static_reference_cast<TearOffType>(wrapper);
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> template<typename OwnerType, typename TearOffType>
</span><del>- static TearOffType* lookupWrapper(OwnerType* element, const SVGPropertyInfo* info)
</del><ins>+ static RefPtr<TearOffType> lookupWrapper(OwnerType* element, const SVGPropertyInfo* info)
</ins><span class="cx"> {
</span><span class="cx"> ASSERT(info);
</span><span class="cx"> SVGAnimatedPropertyDescription key(element, info->propertyIdentifier);
</span><span class="lines">@@ -71,7 +76,7 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> template<typename OwnerType, typename TearOffType>
</span><del>- static TearOffType* lookupWrapper(const OwnerType* element, const SVGPropertyInfo* info)
</del><ins>+ static RefPtr<TearOffType> lookupWrapper(const OwnerType* element, const SVGPropertyInfo* info)
</ins><span class="cx"> {
</span><span class="cx"> return lookupWrapper<OwnerType, TearOffType>(const_cast<OwnerType*>(element), info);
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceWebCoresvgpropertiesSVGAnimatedPropertyMacrosh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/svg/properties/SVGAnimatedPropertyMacros.h (196267 => 196268)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/svg/properties/SVGAnimatedPropertyMacros.h 2016-02-08 20:53:21 UTC (rev 196267)
+++ trunk/Source/WebCore/svg/properties/SVGAnimatedPropertyMacros.h 2016-02-08 20:54:05 UTC (rev 196268)
</span><span class="lines">@@ -123,7 +123,7 @@
</span><span class="cx"> static const SVGPropertyInfo* LowerProperty##PropertyInfo(); \
</span><span class="cx"> PropertyType& LowerProperty() const \
</span><span class="cx"> { \
</span><del>- if (TearOffType* wrapper = SVGAnimatedProperty::lookupWrapper<UseOwnerType, TearOffType>(this, LowerProperty##PropertyInfo())) { \
</del><ins>+ if (auto wrapper = SVGAnimatedProperty::lookupWrapper<UseOwnerType, TearOffType>(this, LowerProperty##PropertyInfo())) { \
</ins><span class="cx"> if (wrapper->isAnimating()) \
</span><span class="cx"> return wrapper->currentAnimatedValue(); \
</span><span class="cx"> } \
</span><span class="lines">@@ -184,7 +184,7 @@
</span><span class="cx"> DECLARE_ANIMATED_PROPERTY(TearOffType, PropertyType, UpperProperty, LowerProperty, ) \
</span><span class="cx"> void detachAnimated##UpperProperty##ListWrappers(unsigned newListSize) \
</span><span class="cx"> { \
</span><del>- if (TearOffType* wrapper = SVGAnimatedProperty::lookupWrapper<UseOwnerType, TearOffType>(this, LowerProperty##PropertyInfo())) \
</del><ins>+ if (auto wrapper = SVGAnimatedProperty::lookupWrapper<UseOwnerType, TearOffType>(this, LowerProperty##PropertyInfo())) \
</ins><span class="cx"> wrapper->detachListWrappers(newListSize); \
</span><span class="cx"> }
</span><span class="cx">
</span></span></pre></div>
<a id="trunkSourceWebCoresvgpropertiesSVGAnimatedTransformListPropertyTearOffh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/svg/properties/SVGAnimatedTransformListPropertyTearOff.h (196267 => 196268)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/svg/properties/SVGAnimatedTransformListPropertyTearOff.h 2016-02-08 20:53:21 UTC (rev 196267)
+++ trunk/Source/WebCore/svg/properties/SVGAnimatedTransformListPropertyTearOff.h 2016-02-08 20:54:05 UTC (rev 196268)
</span><span class="lines">@@ -28,18 +28,24 @@
</span><span class="cx">
</span><span class="cx"> class SVGAnimatedTransformListPropertyTearOff : public SVGAnimatedListPropertyTearOff<SVGTransformList> {
</span><span class="cx"> public:
</span><del>- virtual SVGListPropertyTearOff<SVGTransformList>* baseVal() override
</del><ins>+ virtual RefPtr<ListProperty> baseVal() override
</ins><span class="cx"> {
</span><del>- if (!m_baseVal)
- m_baseVal = SVGTransformListPropertyTearOff::create(this, BaseValRole, m_values, m_wrappers);
- return static_cast<SVGListPropertyTearOff<SVGTransformList>*>(m_baseVal.get());
</del><ins>+ if (m_baseVal)
+ return m_baseVal;
+
+ auto property = SVGTransformListPropertyTearOff::create(this, BaseValRole, m_values, m_wrappers);
+ m_baseVal = property.ptr();
+ return WTFMove(property);
</ins><span class="cx"> }
</span><span class="cx">
</span><del>- virtual SVGListPropertyTearOff<SVGTransformList>* animVal() override
</del><ins>+ virtual RefPtr<ListProperty> animVal() override
</ins><span class="cx"> {
</span><del>- if (!m_animVal)
- m_animVal = SVGTransformListPropertyTearOff::create(this, AnimValRole, m_values, m_wrappers);
- return static_cast<SVGListPropertyTearOff<SVGTransformList>*>(m_animVal.get());
</del><ins>+ if (m_animVal)
+ return m_animVal;
+
+ auto property = SVGTransformListPropertyTearOff::create(this, AnimValRole, m_values, m_wrappers);
+ m_animVal = property.ptr();
+ return WTFMove(property);
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> static Ref<SVGAnimatedTransformListPropertyTearOff> create(SVGElement* contextElement, const QualifiedName& attributeName, AnimatedPropertyType animatedPropertyType, SVGTransformList& values)
</span></span></pre></div>
<a id="trunkSourceWebCoresvgpropertiesSVGListPropertyTearOffh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/svg/properties/SVGListPropertyTearOff.h (196267 => 196268)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/svg/properties/SVGListPropertyTearOff.h 2016-02-08 20:53:21 UTC (rev 196267)
+++ trunk/Source/WebCore/svg/properties/SVGListPropertyTearOff.h 2016-02-08 20:54:05 UTC (rev 196268)
</span><span class="lines">@@ -120,6 +120,12 @@
</span><span class="cx"> {
</span><span class="cx"> }
</span><span class="cx">
</span><ins>+ virtual ~SVGListPropertyTearOff()
+ {
+ if (m_animatedProperty)
+ m_animatedProperty->propertyWillBeDeleted(*this);
+ }
+
</ins><span class="cx"> virtual bool isReadOnly() const override
</span><span class="cx"> {
</span><span class="cx"> if (m_role == AnimValRole)
</span></span></pre></div>
<a id="trunkSourceWebCoresvgpropertiesSVGPathSegListPropertyTearOffcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/svg/properties/SVGPathSegListPropertyTearOff.cpp (196267 => 196268)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/svg/properties/SVGPathSegListPropertyTearOff.cpp 2016-02-08 20:53:21 UTC (rev 196267)
+++ trunk/Source/WebCore/svg/properties/SVGPathSegListPropertyTearOff.cpp 2016-02-08 20:54:05 UTC (rev 196268)
</span><span class="lines">@@ -90,7 +90,7 @@
</span><span class="cx"> bool SVGPathSegListPropertyTearOff::processIncomingListItemValue(const ListItemType& newItem, unsigned* indexToModify)
</span><span class="cx"> {
</span><span class="cx"> SVGPathSegWithContext* newItemWithContext = static_cast<SVGPathSegWithContext*>(newItem.get());
</span><del>- SVGAnimatedProperty* animatedPropertyOfItem = newItemWithContext->animatedProperty();
</del><ins>+ RefPtr<SVGAnimatedProperty> animatedPropertyOfItem = newItemWithContext->animatedProperty();
</ins><span class="cx">
</span><span class="cx"> // Alter the role, after calling animatedProperty(), as that may influence the returned animated property.
</span><span class="cx"> newItemWithContext->setContextAndRole(contextElement(), m_pathSegRole);
</span><span class="lines">@@ -106,7 +106,7 @@
</span><span class="cx"> // Spec: If newItem is already in a list, it is removed from its previous list before it is inserted into this list.
</span><span class="cx"> // 'newItem' is already living in another list. If it's not our list, synchronize the other lists wrappers after the removal.
</span><span class="cx"> bool livesInOtherList = animatedPropertyOfItem != m_animatedProperty;
</span><del>- SVGAnimatedPathSegListPropertyTearOff* propertyTearOff = static_cast<SVGAnimatedPathSegListPropertyTearOff*>(animatedPropertyOfItem);
</del><ins>+ RefPtr<SVGAnimatedPathSegListPropertyTearOff> propertyTearOff = static_pointer_cast<SVGAnimatedPathSegListPropertyTearOff>(animatedPropertyOfItem);
</ins><span class="cx"> int indexToRemove = propertyTearOff->findItem(newItem.get());
</span><span class="cx"> ASSERT(indexToRemove != -1);
</span><span class="cx">
</span></span></pre>
</div>
</div>
</body>
</html>