<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[198246] branches/safari-601.1.46-branch</title>
</head>
<body>
<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; }
#msg dl a { font-weight: bold}
#msg dl a:link { color:#fc3; }
#msg dl a:active { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/198246">198246</a></dd>
<dt>Author</dt> <dd>matthew_hanson@apple.com</dd>
<dt>Date</dt> <dd>2016-03-15 17:22:02 -0700 (Tue, 15 Mar 2016)</dd>
</dl>
<h3>Log Message</h3>
<pre>Merge <a href="http://trac.webkit.org/projects/webkit/changeset/196268">r196268</a>. rdar://problem/24748259</pre>
<h3>Modified Paths</h3>
<ul>
<li><a href="#branchessafari601146branchLayoutTestsChangeLog">branches/safari-601.1.46-branch/LayoutTests/ChangeLog</a></li>
<li><a href="#branchessafari601146branchLayoutTestsTestExpectations">branches/safari-601.1.46-branch/LayoutTests/TestExpectations</a></li>
<li><a href="#branchessafari601146branchSourceWebCoreChangeLog">branches/safari-601.1.46-branch/Source/WebCore/ChangeLog</a></li>
<li><a href="#branchessafari601146branchSourceWebCorebindingsscriptsCodeGeneratorJSpm">branches/safari-601.1.46-branch/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm</a></li>
<li><a href="#branchessafari601146branchSourceWebCoresvgSVGMarkerElementcpp">branches/safari-601.1.46-branch/Source/WebCore/svg/SVGMarkerElement.cpp</a></li>
<li><a href="#branchessafari601146branchSourceWebCoresvgSVGPathElementcpp">branches/safari-601.1.46-branch/Source/WebCore/svg/SVGPathElement.cpp</a></li>
<li><a href="#branchessafari601146branchSourceWebCoresvgSVGPathElementh">branches/safari-601.1.46-branch/Source/WebCore/svg/SVGPathElement.h</a></li>
<li><a href="#branchessafari601146branchSourceWebCoresvgSVGPathSegWithContexth">branches/safari-601.1.46-branch/Source/WebCore/svg/SVGPathSegWithContext.h</a></li>
<li><a href="#branchessafari601146branchSourceWebCoresvgSVGPolyElementcpp">branches/safari-601.1.46-branch/Source/WebCore/svg/SVGPolyElement.cpp</a></li>
<li><a href="#branchessafari601146branchSourceWebCoresvgSVGPolyElementh">branches/safari-601.1.46-branch/Source/WebCore/svg/SVGPolyElement.h</a></li>
<li><a href="#branchessafari601146branchSourceWebCoresvgSVGViewSpeccpp">branches/safari-601.1.46-branch/Source/WebCore/svg/SVGViewSpec.cpp</a></li>
<li><a href="#branchessafari601146branchSourceWebCoresvgSVGViewSpech">branches/safari-601.1.46-branch/Source/WebCore/svg/SVGViewSpec.h</a></li>
<li><a href="#branchessafari601146branchSourceWebCoresvgpropertiesSVGAnimatedListPropertyTearOffh">branches/safari-601.1.46-branch/Source/WebCore/svg/properties/SVGAnimatedListPropertyTearOff.h</a></li>
<li><a href="#branchessafari601146branchSourceWebCoresvgpropertiesSVGAnimatedPathSegListPropertyTearOffh">branches/safari-601.1.46-branch/Source/WebCore/svg/properties/SVGAnimatedPathSegListPropertyTearOff.h</a></li>
<li><a href="#branchessafari601146branchSourceWebCoresvgpropertiesSVGAnimatedPropertyh">branches/safari-601.1.46-branch/Source/WebCore/svg/properties/SVGAnimatedProperty.h</a></li>
<li><a href="#branchessafari601146branchSourceWebCoresvgpropertiesSVGAnimatedPropertyMacrosh">branches/safari-601.1.46-branch/Source/WebCore/svg/properties/SVGAnimatedPropertyMacros.h</a></li>
<li><a href="#branchessafari601146branchSourceWebCoresvgpropertiesSVGAnimatedTransformListPropertyTearOffh">branches/safari-601.1.46-branch/Source/WebCore/svg/properties/SVGAnimatedTransformListPropertyTearOff.h</a></li>
<li><a href="#branchessafari601146branchSourceWebCoresvgpropertiesSVGListPropertyTearOffh">branches/safari-601.1.46-branch/Source/WebCore/svg/properties/SVGListPropertyTearOff.h</a></li>
<li><a href="#branchessafari601146branchSourceWebCoresvgpropertiesSVGPathSegListPropertyTearOffcpp">branches/safari-601.1.46-branch/Source/WebCore/svg/properties/SVGPathSegListPropertyTearOff.cpp</a></li>
</ul>
<h3>Added Paths</h3>
<ul>
<li><a href="#branchessafari601146branchLayoutTestssvganimationssmilleaklistpropertyinstancesexpectedtxt">branches/safari-601.1.46-branch/LayoutTests/svg/animations/smil-leak-list-property-instances-expected.txt</a></li>
<li><a href="#branchessafari601146branchLayoutTestssvganimationssmilleaklistpropertyinstancessvg">branches/safari-601.1.46-branch/LayoutTests/svg/animations/smil-leak-list-property-instances.svg</a></li>
</ul>
</div>
<div id="patch">
<h3>Diff</h3>
<a id="branchessafari601146branchLayoutTestsChangeLog"></a>
<div class="modfile"><h4>Modified: branches/safari-601.1.46-branch/LayoutTests/ChangeLog (198245 => 198246)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-601.1.46-branch/LayoutTests/ChangeLog 2016-03-16 00:02:05 UTC (rev 198245)
+++ branches/safari-601.1.46-branch/LayoutTests/ChangeLog 2016-03-16 00:22:02 UTC (rev 198246)
</span><span class="lines">@@ -1,3 +1,21 @@
</span><ins>+2016-03-14 Matthew Hanson <matthew_hanson@apple.com>
+
+ Merge r196268. rdar://problem/24748259
+
+ 2016-02-08 Said Abou-Hallawa <sabouhallawa@apple.com>
+
+ REGRESSION(r181345): SVG polyline and polygon leak page
+ https://bugs.webkit.org/show_bug.cgi?id=152759
+
+ Reviewed by Darin Adler.
+
+ * TestExpectations: Remove flaky tests from test expectation.
+
+ * svg/animations/smil-leak-list-property-instances-expected.txt: Added.
+ * svg/animations/smil-leak-list-property-instances.svg: Added.
+ Ensure if SVGPolylineElement.points is requested from JS, the document will
+ not leak.
+
</ins><span class="cx"> 2016-02-16 Babak Shafiei <bshafiei@apple.com>
</span><span class="cx">
</span><span class="cx"> Merge patch for r192036 and r196679.
</span></span></pre></div>
<a id="branchessafari601146branchLayoutTestsTestExpectations"></a>
<div class="modfile"><h4>Modified: branches/safari-601.1.46-branch/LayoutTests/TestExpectations (198245 => 198246)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-601.1.46-branch/LayoutTests/TestExpectations 2016-03-16 00:02:05 UTC (rev 198245)
+++ branches/safari-601.1.46-branch/LayoutTests/TestExpectations 2016-03-16 00:22:02 UTC (rev 198246)
</span><span class="lines">@@ -503,12 +503,6 @@
</span><span class="cx"> # Content extensions are Mac-WK2-only for now
</span><span class="cx"> http/tests/contentextensions [ Skip ]
</span><span class="cx">
</span><del>-# These tests were flaky on Mac only but they became flaky on all ports after r181345
-webkit.org/b/114280 svg/animations/smil-leak-dynamically-added-element-instances.svg [ Pass Failure ]
-webkit.org/b/114280 svg/animations/smil-leak-element-instances-noBaseValRef.svg [ Pass Failure ]
-webkit.org/b/114280 svg/animations/smil-leak-element-instances.svg [ Pass Failure ]
-webkit.org/b/114280 svg/animations/smil-leak-elements.svg [ Pass Failure ]
-
</del><span class="cx"> webkit.org/b/143085 media/track/track-mode.html [ Pass Timeout ]
</span><span class="cx">
</span><span class="cx"> # In ES6, Object type restrictions on a first parameter of several Object.* functions are relaxed.
</span></span></pre></div>
<a id="branchessafari601146branchLayoutTestssvganimationssmilleaklistpropertyinstancesexpectedtxt"></a>
<div class="addfile"><h4>Added: branches/safari-601.1.46-branch/LayoutTests/svg/animations/smil-leak-list-property-instances-expected.txt (0 => 198246)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-601.1.46-branch/LayoutTests/svg/animations/smil-leak-list-property-instances-expected.txt (rev 0)
+++ branches/safari-601.1.46-branch/LayoutTests/svg/animations/smil-leak-list-property-instances-expected.txt 2016-03-16 00:22:02 UTC (rev 198246)
</span><span class="lines">@@ -0,0 +1 @@
</span><ins>+PASS
</ins></span></pre></div>
<a id="branchessafari601146branchLayoutTestssvganimationssmilleaklistpropertyinstancessvg"></a>
<div class="addfile"><h4>Added: branches/safari-601.1.46-branch/LayoutTests/svg/animations/smil-leak-list-property-instances.svg (0 => 198246)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-601.1.46-branch/LayoutTests/svg/animations/smil-leak-list-property-instances.svg (rev 0)
+++ branches/safari-601.1.46-branch/LayoutTests/svg/animations/smil-leak-list-property-instances.svg 2016-03-16 00:22:02 UTC (rev 198246)
</span><span class="lines">@@ -0,0 +1,87 @@
</span><ins>+<svg id="svg" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" onload="load()">
+<defs>
+ <polyline id="polyline" points="20,20 80,20 80,80 20,80" />
+</defs>
+<g id="g"/>
+<text x="50" y="50" id="log"/>
+<script id="script">
+<![CDATA[
+
+var g = document.getElementById("g");
+
+function log(message) {
+ var logDiv = document.getElementById('log');
+ logDiv.appendChild(document.createTextNode(message));
+}
+
+function createAnimatedPolylineInstance() {
+ var use = document.createElementNS("http://www.w3.org/2000/svg", "use");
+ use.setAttributeNS("http://www.w3.org/1999/xlink", "href", "#polyline");
+
+ var anim = document.createElementNS("http://www.w3.org/2000/svg", "animate");
+ anim.setAttribute("attributeType", "XML");
+ anim.setAttribute("attributeName", "points");
+ anim.setAttribute("from", "20,20 80,20 80,80 20,80");
+ anim.setAttribute("to", "10,10 90,10 90,90 10,90");
+ anim.setAttribute("begin", "0s");
+ anim.setAttribute("dur", "10.0s");
+ anim.setAttribute("repeatCount", 1);
+
+ use.appendChild(anim);
+
+ return use;
+}
+
+function startTest() {
+ // Collect garbage before recording starting live node count, in case there are live elements from previous tests.
+ GCController.collect();
+ originalLiveElements = window.internals.numberOfLiveNodes();
+
+ // Hold references to points and animatedPoints on the root instance.
+ points = document.getElementById("polyline").points;
+ animatedPoints = document.getElementById("polyline").animatedPoints;
+
+ for (var i = 0; i < 100; i++)
+ g.appendChild(createAnimatedPolylineInstance());
+
+ setTimeout(continueTest, 0);
+}
+
+function continueTest() {
+ while (g.hasChildNodes())
+ g.removeChild(g.lastChild);
+
+ setTimeout(finishTest, 0);
+}
+
+var attemptsToFinish = 5;
+
+function finishTest() {
+ GCController.collect();
+
+ var liveDelta = window.internals.numberOfLiveNodes() - originalLiveElements;
+ if (liveDelta == 0)
+ log("PASS");
+ else if (--attemptsToFinish) {
+ setTimeout(finishTest, 100);
+ return;
+ } else
+ log("FAIL: " + liveDelta + " extra live node(s)");
+
+ testRunner.notifyDone();
+}
+
+function load() {
+ if (window.testRunner && window.GCController && window.internals) {
+ testRunner.dumpAsText();
+ testRunner.waitUntilDone();
+ } else {
+ log("This test only works when run with the testRunner, GCController, and internals available.");
+ return;
+ }
+
+ setTimeout(startTest, 0);
+}
+]]>
+</script>
+</svg>
</ins></span></pre></div>
<a id="branchessafari601146branchSourceWebCoreChangeLog"></a>
<div class="modfile"><h4>Modified: branches/safari-601.1.46-branch/Source/WebCore/ChangeLog (198245 => 198246)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-601.1.46-branch/Source/WebCore/ChangeLog 2016-03-16 00:02:05 UTC (rev 198245)
+++ branches/safari-601.1.46-branch/Source/WebCore/ChangeLog 2016-03-16 00:22:02 UTC (rev 198246)
</span><span class="lines">@@ -1,3 +1,141 @@
</span><ins>+2016-03-14 Matthew Hanson <matthew_hanson@apple.com>
+
+ Merge r196268. rdar://problem/24748259
+
+ 2016-02-08 Said Abou-Hallawa <sabouhallawa@apple.com>
+
+ REGRESSION(r181345): SVG polyline and polygon leak page
+ https://bugs.webkit.org/show_bug.cgi?id=152759
+
+ Reviewed by Darin Adler.
+
+ The leak happens because of cyclic reference between SVGListPropertyTearOff
+ and SVGAnimatedListPropertyTearOff which is derived from SVGAnimatedProperty.
+ There is also cyclic reference between SVGAnimatedProperty and SVGElement
+ and this causes the whole document to be leaked. So if the JS requests, for
+ example, an instance of SVGPolylineElement.points, the whole document will be
+ leaked.
+
+ The fix depends on having the cyclic reference as is since the owning and the
+ owned classes have to live together if any of them is referenced. But the owning
+ class caches a raw 'ref-counted' pointer of the owned class. If it is requested
+ for an instance of the owned class it returned a RefPtr<> of it. Once the owned
+ class is not used, it can delete itself. The only thing needed here is to notify
+ the owner class of the deletion so it cleans its caches and be able to create a
+ new pointer if it is requested for an instance of the owned class later.
+
+ Revert the change of r181345 in SVGAnimatedProperty::lookupOrCreateWrapper()
+ to break the cyclic reference between SVGElement and SVGAnimatedProperty.
+
+ Also apply the same approach in SVGAnimatedListPropertyTearOff::baseVal() and
+ animVal() to break cyclic reference between SVGListPropertyTearOff and
+ SVGAnimatedListPropertyTearOff.
+
+ Test: svg/animations/smil-leak-list-property-instances.svg
+
+ * bindings/scripts/CodeGeneratorJS.pm:
+ (NativeToJSValue): The SVG non-string list tear-off properties became of
+ type RefPtr<>. So we need to use get() with the casting expressions.
+
+ * svg/SVGMarkerElement.cpp:
+ (WebCore::SVGMarkerElement::orientType):
+ Use 'auto' type for the return of SVGAnimatedProperty::lookupWrapper().
+
+ * svg/SVGPathElement.cpp:
+ (WebCore::SVGPathElement::pathByteStream):
+ (WebCore::SVGPathElement::lookupOrCreateDWrapper):
+ Since SVGAnimatedProperty::lookupWrappe() returns a RefPtr<> we need to
+ use get() for the casting expressions.
+
+ (WebCore::SVGPathElement::pathSegList):
+ (WebCore::SVGPathElement::normalizedPathSegList):
+ (WebCore::SVGPathElement::animatedPathSegList):
+ (WebCore::SVGPathElement::animatedNormalizedPathSegList):
+ * svg/SVGPathElement.h:
+ Change the return value from raw pointer to RefPtr<>.
+
+ * svg/SVGPathSegWithContext.h:
+ (WebCore::SVGPathSegWithContext::animatedProperty):
+ Change the return type to be RefPtr<> to preserve the value from being deleted.
+
+ * svg/SVGPolyElement.cpp:
+ (WebCore::SVGPolyElement::parseAttribute):
+ Since SVGAnimatedProperty::lookupWrapper() returns a RefPtr<> we need to
+ use get() for the casting expressions.
+
+ (WebCore::SVGPolyElement::points):
+ (WebCore::SVGPolyElement::animatedPoints):
+ * svg/SVGPolyElement.h:
+ Change the return value from raw pointer to RefPtr<>.
+
+ * svg/SVGViewSpec.cpp:
+ (WebCore::SVGViewSpec::setTransformString):
+ Since SVGAnimatedProperty::lookupWrapper() returns a RefPtr<> we need to
+ use get() for the casting expressions.
+
+ (WebCore::SVGViewSpec::transform):
+ * svg/SVGViewSpec.h:
+ Change the return value from raw pointer to RefPtr<>.
+
+ * svg/properties/SVGAnimatedListPropertyTearOff.h:
+ (WebCore::SVGAnimatedListPropertyTearOff::baseVal):
+ (WebCore::SVGAnimatedListPropertyTearOff::animVal):
+ Change the return value from raw pointer to RefPtr<> and change the cached
+ value from RefPtr<> to raw pointer. If the property is null, it will be
+ created, its raw pointer will be cached and the only ref-counted RefPtr<>
+ will be returned. This will guarantee, the RefPtr<> will be deleted once
+ it is not used anymore.
+
+ (WebCore::SVGAnimatedListPropertyTearOff::propertyWillBeDeleted):
+ Clean the raw pointer caches m_baseVal and m_animVal upon deleting the
+ actual pointer. This function will be called from the destructor of
+ SVGListPropertyTearOff.
+
+ (WebCore::SVGAnimatedListPropertyTearOff::findItem):
+ (WebCore::SVGAnimatedListPropertyTearOff::removeItemFromList):
+ We have to ensure the baseVal() is created before using it.
+
+ (WebCore::SVGAnimatedListPropertyTearOff::detachListWrappers):
+ (WebCore::SVGAnimatedListPropertyTearOff::currentAnimatedValue):
+ (WebCore::SVGAnimatedListPropertyTearOff::animationStarted):
+ (WebCore::SVGAnimatedListPropertyTearOff::animationEnded):
+ (WebCore::SVGAnimatedListPropertyTearOff::synchronizeWrappersIfNeeded):
+ (WebCore::SVGAnimatedListPropertyTearOff::animValWillChange):
+ (WebCore::SVGAnimatedListPropertyTearOff::animValDidChange):
+ For animation, a separate RefPtr<> 'm_animatingAnimVal' will be assigned
+ to the animVal(). This will prevent deleting m_animVal while animation.
+
+ * svg/properties/SVGAnimatedPathSegListPropertyTearOff.h:
+ (WebCore::SVGAnimatedPathSegListPropertyTearOff::baseVal):
+ (WebCore::SVGAnimatedPathSegListPropertyTearOff::animVal):
+ Same as what is done in SVGAnimatedListPropertyTearOff.
+
+ (WebCore::SVGAnimatedPathSegListPropertyTearOff::findItem):
+ (WebCore::SVGAnimatedPathSegListPropertyTearOff::removeItemFromList):
+ Same as what is done in SVGAnimatedListPropertyTearOff.
+
+ * svg/properties/SVGAnimatedProperty.h:
+ (WebCore::SVGAnimatedProperty::lookupOrCreateWrapper):
+ Change the return value from raw reference to Ref<> and change the
+ cached value from Ref<> to raw pointer. This reverts the change of
+ r181345 in this function.
+
+ (WebCore::SVGAnimatedProperty::lookupWrapper):
+ Change the return value from raw pointer to RefPtr<>.
+
+ * svg/properties/SVGAnimatedPropertyMacros.h:
+ Use 'auto' type for the return of SVGAnimatedProperty::lookupWrapper().
+
+ * svg/properties/SVGAnimatedTransformListPropertyTearOff.h:
+ (WebCore::SVGAnimatedTransformListPropertyTearOff::baseVal):
+ (WebCore::SVGAnimatedTransformListPropertyTearOff::animVal):
+ Same as what is done in SVGAnimatedListPropertyTearOff.
+
+ * svg/properties/SVGListPropertyTearOff.h:
+ (WebCore::SVGListPropertyTearOff::~SVGListPropertyTearOff):
+ Call the SVGAnimatedListPropertyTearOff::propertyWillBeDeleted() to clean
+ its raw pointers when the RefPtr<> deletes itself.
+
</ins><span class="cx"> 2016-02-12 Babak Shafiei <bshafiei@apple.com>
</span><span class="cx">
</span><span class="cx"> Merge r196401.
</span></span></pre></div>
<a id="branchessafari601146branchSourceWebCorebindingsscriptsCodeGeneratorJSpm"></a>
<div class="modfile"><h4>Modified: branches/safari-601.1.46-branch/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm (198245 => 198246)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-601.1.46-branch/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm 2016-03-16 00:02:05 UTC (rev 198245)
+++ branches/safari-601.1.46-branch/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm 2016-03-16 00:22:02 UTC (rev 198246)
</span><span class="lines">@@ -4050,7 +4050,11 @@
</span><span class="cx"> return "toJSNewlyCreated(exec, $globalObject, WTF::getPtr($value))";
</span><span class="cx"> }
</span><span class="cx">
</span><del>- if ($codeGenerator->IsSVGAnimatedType($interfaceName) or $interfaceName eq "SVGViewSpec") {
</del><ins>+ # $type has to be used here because SVGViewSpec.transform is of type SVGTransformList.
+ if ($codeGenerator->IsSVGTypeNeedingTearOff($type) and $type =~ /(?<!String)List$/) {
+ # Convert from abstract RefPtr<ListProperty> to real type, so the right toJS() method can be invoked.
+ $value = "static_cast<" . GetNativeType($type) . ">($value" . ".get())";
+ } elsif ($codeGenerator->IsSVGAnimatedType($interfaceName) or $interfaceName eq "SVGViewSpec") {
</ins><span class="cx"> # Convert from abstract SVGProperty to real type, so the right toJS() method can be invoked.
</span><span class="cx"> $value = "static_cast<" . GetNativeType($type) . ">($value)";
</span><span class="cx"> } elsif ($codeGenerator->IsSVGTypeNeedingTearOff($type) and not $interfaceName =~ /List$/) {
</span></span></pre></div>
<a id="branchessafari601146branchSourceWebCoresvgSVGMarkerElementcpp"></a>
<div class="modfile"><h4>Modified: branches/safari-601.1.46-branch/Source/WebCore/svg/SVGMarkerElement.cpp (198245 => 198246)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-601.1.46-branch/Source/WebCore/svg/SVGMarkerElement.cpp 2016-03-16 00:02:05 UTC (rev 198245)
+++ branches/safari-601.1.46-branch/Source/WebCore/svg/SVGMarkerElement.cpp 2016-03-16 00:22:02 UTC (rev 198246)
</span><span class="lines">@@ -251,7 +251,7 @@
</span><span class="cx">
</span><span class="cx"> SVGMarkerOrientType& SVGMarkerElement::orientType() const
</span><span class="cx"> {
</span><del>- if (SVGAnimatedEnumeration* wrapper = SVGAnimatedProperty::lookupWrapper<UseOwnerType, SVGAnimatedEnumeration>(this, orientTypePropertyInfo())) {
</del><ins>+ if (auto wrapper = SVGAnimatedProperty::lookupWrapper<UseOwnerType, SVGAnimatedEnumeration>(this, orientTypePropertyInfo())) {
</ins><span class="cx"> if (wrapper->isAnimating()) {
</span><span class="cx"> ASSERT(wrapper->currentAnimatedValue() < SVGMarkerOrientMax);
</span><span class="cx"> return reinterpret_cast<SVGMarkerOrientType&>(wrapper->currentAnimatedValue());
</span></span></pre></div>
<a id="branchessafari601146branchSourceWebCoresvgSVGPathElementcpp"></a>
<div class="modfile"><h4>Modified: branches/safari-601.1.46-branch/Source/WebCore/svg/SVGPathElement.cpp (198245 => 198246)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-601.1.46-branch/Source/WebCore/svg/SVGPathElement.cpp 2016-03-16 00:02:05 UTC (rev 198245)
+++ branches/safari-601.1.46-branch/Source/WebCore/svg/SVGPathElement.cpp 2016-03-16 00:22:02 UTC (rev 198246)
</span><span class="lines">@@ -295,10 +295,10 @@
</span><span class="cx">
</span><span class="cx"> SVGPathByteStream* SVGPathElement::pathByteStream() const
</span><span class="cx"> {
</span><del>- SVGAnimatedProperty* property = SVGAnimatedProperty::lookupWrapper<SVGPathElement, SVGAnimatedPathSegListPropertyTearOff>(this, dPropertyInfo());
</del><ins>+ auto property = SVGAnimatedProperty::lookupWrapper<SVGPathElement, SVGAnimatedPathSegListPropertyTearOff>(this, dPropertyInfo());
</ins><span class="cx"> if (!property || !property->isAnimating())
</span><span class="cx"> return m_pathByteStream.get();
</span><del>- return static_cast<SVGAnimatedPathSegListPropertyTearOff*>(property)->animatedPathByteStream();
</del><ins>+ static_cast<SVGAnimatedPathSegListPropertyTearOff*>(property.get())->animatedPathByteStream();
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> Ref<SVGAnimatedProperty> SVGPathElement::lookupOrCreateDWrapper(SVGElement* contextElement)
</span><span class="lines">@@ -306,7 +306,7 @@
</span><span class="cx"> ASSERT(contextElement);
</span><span class="cx"> SVGPathElement& ownerType = downcast<SVGPathElement>(*contextElement);
</span><span class="cx">
</span><del>- if (SVGAnimatedProperty* property = SVGAnimatedProperty::lookupWrapper<SVGPathElement, SVGAnimatedPathSegListPropertyTearOff>(&ownerType, dPropertyInfo()))
</del><ins>+ if (auto property = SVGAnimatedProperty::lookupWrapper<SVGPathElement, SVGAnimatedPathSegListPropertyTearOff>(&ownerType, dPropertyInfo()))
</ins><span class="cx"> return *property;
</span><span class="cx">
</span><span class="cx"> // Build initial SVGPathSegList.
</span><span class="lines">@@ -325,29 +325,29 @@
</span><span class="cx"> ownerType.m_pathSegList.synchronize(&ownerType, dPropertyInfo()->attributeName, ownerType.m_pathSegList.value.valueAsString());
</span><span class="cx"> }
</span><span class="cx">
</span><del>-SVGPathSegListPropertyTearOff* SVGPathElement::pathSegList()
</del><ins>+RefPtr<SVGPathSegListPropertyTearOff> SVGPathElement::pathSegList()
</ins><span class="cx"> {
</span><span class="cx"> m_pathSegList.shouldSynchronize = true;
</span><del>- return static_cast<SVGPathSegListPropertyTearOff*>(static_reference_cast<SVGAnimatedPathSegListPropertyTearOff>(lookupOrCreateDWrapper(this))->baseVal());
</del><ins>+ return static_cast<SVGPathSegListPropertyTearOff*>(static_reference_cast<SVGAnimatedPathSegListPropertyTearOff>(lookupOrCreateDWrapper(this))->baseVal().get());
</ins><span class="cx"> }
</span><span class="cx">
</span><del>-SVGPathSegListPropertyTearOff* SVGPathElement::normalizedPathSegList()
</del><ins>+RefPtr<SVGPathSegListPropertyTearOff> SVGPathElement::normalizedPathSegList()
</ins><span class="cx"> {
</span><span class="cx"> // FIXME: https://bugs.webkit.org/show_bug.cgi?id=15412 - Implement normalized path segment lists!
</span><del>- return 0;
</del><ins>+ return nullptr;
</ins><span class="cx"> }
</span><span class="cx">
</span><del>-SVGPathSegListPropertyTearOff* SVGPathElement::animatedPathSegList()
</del><ins>+RefPtr<SVGPathSegListPropertyTearOff> SVGPathElement::animatedPathSegList()
</ins><span class="cx"> {
</span><span class="cx"> m_pathSegList.shouldSynchronize = true;
</span><span class="cx"> m_isAnimValObserved = true;
</span><del>- return static_cast<SVGPathSegListPropertyTearOff*>(static_reference_cast<SVGAnimatedPathSegListPropertyTearOff>(lookupOrCreateDWrapper(this))->animVal());
</del><ins>+ return static_cast<SVGPathSegListPropertyTearOff*>(static_reference_cast<SVGAnimatedPathSegListPropertyTearOff>(lookupOrCreateDWrapper(this))->animVal().get());
</ins><span class="cx"> }
</span><span class="cx">
</span><del>-SVGPathSegListPropertyTearOff* SVGPathElement::animatedNormalizedPathSegList()
</del><ins>+RefPtr<SVGPathSegListPropertyTearOff> SVGPathElement::animatedNormalizedPathSegList()
</ins><span class="cx"> {
</span><span class="cx"> // FIXME: https://bugs.webkit.org/show_bug.cgi?id=15412 - Implement normalized path segment lists!
</span><del>- return 0;
</del><ins>+ return nullptr;
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> void SVGPathElement::pathSegListChanged(SVGPathSegRole role, ListModification listModification)
</span></span></pre></div>
<a id="branchessafari601146branchSourceWebCoresvgSVGPathElementh"></a>
<div class="modfile"><h4>Modified: branches/safari-601.1.46-branch/Source/WebCore/svg/SVGPathElement.h (198245 => 198246)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-601.1.46-branch/Source/WebCore/svg/SVGPathElement.h 2016-03-16 00:02:05 UTC (rev 198245)
+++ branches/safari-601.1.46-branch/Source/WebCore/svg/SVGPathElement.h 2016-03-16 00:22:02 UTC (rev 198246)
</span><span class="lines">@@ -82,10 +82,10 @@
</span><span class="cx"> Ref<SVGPathSegCurvetoQuadraticSmoothRel> createSVGPathSegCurvetoQuadraticSmoothRel(float x, float y, SVGPathSegRole = PathSegUndefinedRole);
</span><span class="cx">
</span><span class="cx"> // Used in the bindings only.
</span><del>- SVGPathSegListPropertyTearOff* pathSegList();
- SVGPathSegListPropertyTearOff* animatedPathSegList();
- SVGPathSegListPropertyTearOff* normalizedPathSegList();
- SVGPathSegListPropertyTearOff* animatedNormalizedPathSegList();
</del><ins>+ RefPtr<SVGPathSegListPropertyTearOff> pathSegList();
+ RefPtr<SVGPathSegListPropertyTearOff> animatedPathSegList();
+ RefPtr<SVGPathSegListPropertyTearOff> normalizedPathSegList();
+ RefPtr<SVGPathSegListPropertyTearOff> animatedNormalizedPathSegList();
</ins><span class="cx">
</span><span class="cx"> SVGPathByteStream* pathByteStream() const;
</span><span class="cx">
</span></span></pre></div>
<a id="branchessafari601146branchSourceWebCoresvgSVGPathSegWithContexth"></a>
<div class="modfile"><h4>Modified: branches/safari-601.1.46-branch/Source/WebCore/svg/SVGPathSegWithContext.h (198245 => 198246)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-601.1.46-branch/Source/WebCore/svg/SVGPathSegWithContext.h 2016-03-16 00:02:05 UTC (rev 198245)
+++ branches/safari-601.1.46-branch/Source/WebCore/svg/SVGPathSegWithContext.h 2016-03-16 00:22:02 UTC (rev 198246)
</span><span class="lines">@@ -32,7 +32,7 @@
</span><span class="cx"> {
</span><span class="cx"> }
</span><span class="cx">
</span><del>- SVGAnimatedProperty* animatedProperty() const
</del><ins>+ RefPtr<SVGAnimatedProperty> animatedProperty() const
</ins><span class="cx"> {
</span><span class="cx"> switch (m_role) {
</span><span class="cx"> case PathSegUndefinedRole:
</span></span></pre></div>
<a id="branchessafari601146branchSourceWebCoresvgSVGPolyElementcpp"></a>
<div class="modfile"><h4>Modified: branches/safari-601.1.46-branch/Source/WebCore/svg/SVGPolyElement.cpp (198245 => 198246)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-601.1.46-branch/Source/WebCore/svg/SVGPolyElement.cpp 2016-03-16 00:02:05 UTC (rev 198245)
+++ branches/safari-601.1.46-branch/Source/WebCore/svg/SVGPolyElement.cpp 2016-03-16 00:22:02 UTC (rev 198246)
</span><span class="lines">@@ -68,8 +68,8 @@
</span><span class="cx"> if (!pointsListFromSVGData(newList, value))
</span><span class="cx"> document().accessSVGExtensions().reportError("Problem parsing points=\"" + value + "\"");
</span><span class="cx">
</span><del>- if (SVGAnimatedProperty* wrapper = SVGAnimatedProperty::lookupWrapper<SVGPolyElement, SVGAnimatedPointList>(this, pointsPropertyInfo()))
- static_cast<SVGAnimatedPointList*>(wrapper)->detachListWrappers(newList.size());
</del><ins>+ if (auto wrapper = SVGAnimatedProperty::lookupWrapper<SVGPolyElement, SVGAnimatedPointList>(this, pointsPropertyInfo()))
+ static_pointer_cast<SVGAnimatedPointList>(wrapper)->detachListWrappers(newList.size());
</ins><span class="cx">
</span><span class="cx"> m_points.value = newList;
</span><span class="cx"> return;
</span><span class="lines">@@ -118,16 +118,16 @@
</span><span class="cx"> (&ownerType, pointsPropertyInfo(), ownerType.m_points.value);
</span><span class="cx"> }
</span><span class="cx">
</span><del>-SVGListPropertyTearOff<SVGPointList>* SVGPolyElement::points()
</del><ins>+RefPtr<SVGListPropertyTearOff<SVGPointList>> SVGPolyElement::points()
</ins><span class="cx"> {
</span><span class="cx"> m_points.shouldSynchronize = true;
</span><del>- return static_cast<SVGListPropertyTearOff<SVGPointList>*>(static_reference_cast<SVGAnimatedPointList>(lookupOrCreatePointsWrapper(this))->baseVal());
</del><ins>+ return static_cast<SVGListPropertyTearOff<SVGPointList>*>(static_reference_cast<SVGAnimatedPointList>(lookupOrCreatePointsWrapper(this))->baseVal().get());
</ins><span class="cx"> }
</span><span class="cx">
</span><del>-SVGListPropertyTearOff<SVGPointList>* SVGPolyElement::animatedPoints()
</del><ins>+RefPtr<SVGListPropertyTearOff<SVGPointList>> SVGPolyElement::animatedPoints()
</ins><span class="cx"> {
</span><span class="cx"> m_points.shouldSynchronize = true;
</span><del>- return static_cast<SVGListPropertyTearOff<SVGPointList>*>(static_reference_cast<SVGAnimatedPointList>(lookupOrCreatePointsWrapper(this))->animVal());
</del><ins>+ return static_cast<SVGListPropertyTearOff<SVGPointList>*>(static_reference_cast<SVGAnimatedPointList>(lookupOrCreatePointsWrapper(this))->animVal().get());
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> }
</span></span></pre></div>
<a id="branchessafari601146branchSourceWebCoresvgSVGPolyElementh"></a>
<div class="modfile"><h4>Modified: branches/safari-601.1.46-branch/Source/WebCore/svg/SVGPolyElement.h (198245 => 198246)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-601.1.46-branch/Source/WebCore/svg/SVGPolyElement.h 2016-03-16 00:02:05 UTC (rev 198245)
+++ branches/safari-601.1.46-branch/Source/WebCore/svg/SVGPolyElement.h 2016-03-16 00:22:02 UTC (rev 198246)
</span><span class="lines">@@ -31,8 +31,8 @@
</span><span class="cx">
</span><span class="cx"> class SVGPolyElement : public SVGGraphicsElement, public SVGExternalResourcesRequired {
</span><span class="cx"> public:
</span><del>- SVGListPropertyTearOff<SVGPointList>* points();
- SVGListPropertyTearOff<SVGPointList>* animatedPoints();
</del><ins>+ RefPtr<SVGListPropertyTearOff<SVGPointList>> points();
+ RefPtr<SVGListPropertyTearOff<SVGPointList>> animatedPoints();
</ins><span class="cx">
</span><span class="cx"> SVGPointList& pointList() const { return m_points.value; }
</span><span class="cx">
</span></span></pre></div>
<a id="branchessafari601146branchSourceWebCoresvgSVGViewSpeccpp"></a>
<div class="modfile"><h4>Modified: branches/safari-601.1.46-branch/Source/WebCore/svg/SVGViewSpec.cpp (198245 => 198246)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-601.1.46-branch/Source/WebCore/svg/SVGViewSpec.cpp 2016-03-16 00:02:05 UTC (rev 198245)
+++ branches/safari-601.1.46-branch/Source/WebCore/svg/SVGViewSpec.cpp 2016-03-16 00:22:02 UTC (rev 198246)
</span><span class="lines">@@ -114,8 +114,8 @@
</span><span class="cx"> SVGTransformList newList;
</span><span class="cx"> newList.parse(transform);
</span><span class="cx">
</span><del>- if (SVGAnimatedProperty* wrapper = SVGAnimatedProperty::lookupWrapper<SVGElement, SVGAnimatedTransformList>(m_contextElement, transformPropertyInfo()))
- static_cast<SVGAnimatedTransformList*>(wrapper)->detachListWrappers(newList.size());
</del><ins>+ if (auto wrapper = SVGAnimatedProperty::lookupWrapper<SVGElement, SVGAnimatedTransformList>(m_contextElement, transformPropertyInfo()))
+ static_pointer_cast<SVGAnimatedTransformList>(wrapper)->detachListWrappers(newList.size());
</ins><span class="cx">
</span><span class="cx"> m_transform = newList;
</span><span class="cx"> }
</span><span class="lines">@@ -145,12 +145,12 @@
</span><span class="cx"> return downcast<SVGElement>(element);
</span><span class="cx"> }
</span><span class="cx">
</span><del>-SVGTransformListPropertyTearOff* SVGViewSpec::transform()
</del><ins>+RefPtr<SVGTransformListPropertyTearOff> SVGViewSpec::transform()
</ins><span class="cx"> {
</span><span class="cx"> if (!m_contextElement)
</span><span class="cx"> return nullptr;
</span><span class="cx"> // Return the animVal here, as its readonly by default - which is exactly what we want here.
</span><del>- return static_cast<SVGTransformListPropertyTearOff*>(static_reference_cast<SVGAnimatedTransformList>(lookupOrCreateTransformWrapper(this))->animVal());
</del><ins>+ return static_pointer_cast<SVGTransformListPropertyTearOff>(static_reference_cast<SVGAnimatedTransformList>(lookupOrCreateTransformWrapper(this))->animVal());
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> RefPtr<SVGAnimatedRect> SVGViewSpec::viewBoxAnimated()
</span></span></pre></div>
<a id="branchessafari601146branchSourceWebCoresvgSVGViewSpech"></a>
<div class="modfile"><h4>Modified: branches/safari-601.1.46-branch/Source/WebCore/svg/SVGViewSpec.h (198245 => 198246)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-601.1.46-branch/Source/WebCore/svg/SVGViewSpec.h 2016-03-16 00:02:05 UTC (rev 198245)
+++ branches/safari-601.1.46-branch/Source/WebCore/svg/SVGViewSpec.h 2016-03-16 00:22:02 UTC (rev 198246)
</span><span class="lines">@@ -68,7 +68,7 @@
</span><span class="cx"> void resetContextElement() { m_contextElement = nullptr; }
</span><span class="cx">
</span><span class="cx"> // Custom non-animated 'transform' property.
</span><del>- SVGTransformListPropertyTearOff* transform();
</del><ins>+ RefPtr<SVGTransformListPropertyTearOff> transform();
</ins><span class="cx"> SVGTransformList transformBaseValue() const { return m_transform; }
</span><span class="cx">
</span><span class="cx"> // Custom animated 'viewBox' property.
</span></span></pre></div>
<a id="branchessafari601146branchSourceWebCoresvgpropertiesSVGAnimatedListPropertyTearOffh"></a>
<div class="modfile"><h4>Modified: branches/safari-601.1.46-branch/Source/WebCore/svg/properties/SVGAnimatedListPropertyTearOff.h (198245 => 198246)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-601.1.46-branch/Source/WebCore/svg/properties/SVGAnimatedListPropertyTearOff.h 2016-03-16 00:02:05 UTC (rev 198245)
+++ branches/safari-601.1.46-branch/Source/WebCore/svg/properties/SVGAnimatedListPropertyTearOff.h 2016-03-16 00:22:02 UTC (rev 198246)
</span><span class="lines">@@ -39,35 +39,49 @@
</span><span class="cx"> typedef SVGListPropertyTearOff<PropertyType> ListPropertyTearOff;
</span><span class="cx"> typedef PropertyType ContentType;
</span><span class="cx">
</span><del>- virtual ListProperty* baseVal()
</del><ins>+ virtual RefPtr<ListProperty> baseVal()
</ins><span class="cx"> {
</span><del>- if (!m_baseVal)
- m_baseVal = ListPropertyTearOff::create(this, BaseValRole, m_values, m_wrappers);
- return static_cast<ListProperty*>(m_baseVal.get());
</del><ins>+ if (m_baseVal)
+ return m_baseVal;
+
+ auto property = ListPropertyTearOff::create(this, BaseValRole, m_values, m_wrappers);
+ m_baseVal = property.ptr();
+ return WTF::move(property);
</ins><span class="cx"> }
</span><span class="cx">
</span><del>- virtual ListProperty* animVal()
</del><ins>+ virtual RefPtr<ListProperty> animVal()
</ins><span class="cx"> {
</span><del>- if (!m_animVal)
- m_animVal = ListPropertyTearOff::create(this, AnimValRole, m_values, m_wrappers);
- return static_cast<ListProperty*>(m_animVal.get());
</del><ins>+ if (m_animVal)
+ return m_animVal;
+
+ auto property = ListPropertyTearOff::create(this, AnimValRole, m_values, m_wrappers);
+ m_animVal = property.ptr();
+ return WTF::move(property);
</ins><span class="cx"> }
</span><span class="cx">
</span><ins>+ void propertyWillBeDeleted(const ListProperty& property)
+ {
+ if (&property == m_baseVal)
+ m_baseVal = nullptr;
+ else if (&property == m_animVal)
+ m_animVal = nullptr;
+ }
+
</ins><span class="cx"> virtual bool isAnimatedListTearOff() const override { return true; }
</span><span class="cx">
</span><del>- int findItem(SVGProperty* property) const
</del><ins>+ int findItem(SVGProperty* property)
</ins><span class="cx"> {
</span><span class="cx"> // This should ever be called for our baseVal, as animVal can't modify the list.
</span><span class="cx"> // It's safe to cast to ListPropertyTearOff here as all classes inheriting from us supply their own removeItemFromList() method.
</span><span class="cx"> typedef SVGPropertyTearOff<typename SVGPropertyTraits<PropertyType>::ListItemType> ListItemTearOff;
</span><del>- return static_cast<ListPropertyTearOff*>(m_baseVal.get())->findItem(static_cast<ListItemTearOff*>(property));
</del><ins>+ return static_pointer_cast<ListPropertyTearOff>(baseVal())->findItem(static_cast<ListItemTearOff*>(property));
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> void removeItemFromList(size_t itemIndex, bool shouldSynchronizeWrappers)
</span><span class="cx"> {
</span><span class="cx"> // This should ever be called for our baseVal, as animVal can't modify the list.
</span><span class="cx"> // It's safe to cast to ListPropertyTearOff here as all classes inheriting from us supply their own removeItemFromList() method.
</span><del>- static_cast<ListPropertyTearOff*>(m_baseVal.get())->removeItemFromList(itemIndex, shouldSynchronizeWrappers);
</del><ins>+ static_pointer_cast<ListPropertyTearOff>(baseVal())->removeItemFromList(itemIndex, shouldSynchronizeWrappers);
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> void detachListWrappers(unsigned newListSize)
</span><span class="lines">@@ -78,8 +92,8 @@
</span><span class="cx"> PropertyType& currentAnimatedValue()
</span><span class="cx"> {
</span><span class="cx"> ASSERT(m_isAnimating);
</span><del>- ASSERT(m_animVal);
- return static_cast<ListProperty*>(m_animVal.get())->values();
</del><ins>+ ASSERT(m_animatingAnimVal);
+ return static_pointer_cast<ListProperty>(m_animatingAnimVal)->values();
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> const PropertyType& currentBaseValue() const
</span><span class="lines">@@ -90,6 +104,7 @@
</span><span class="cx"> void animationStarted(PropertyType* newAnimVal, bool shouldOwnValues = false)
</span><span class="cx"> {
</span><span class="cx"> ASSERT(!m_isAnimating);
</span><ins>+ ASSERT(!m_animatingAnimVal);
</ins><span class="cx"> ASSERT(newAnimVal);
</span><span class="cx"> ASSERT(m_values.size() == m_wrappers.size());
</span><span class="cx"> ASSERT(m_animatedWrappers.isEmpty());
</span><span class="lines">@@ -98,57 +113,55 @@
</span><span class="cx"> if (!newAnimVal->isEmpty())
</span><span class="cx"> m_animatedWrappers.fill(0, newAnimVal->size());
</span><span class="cx">
</span><del>- ListProperty* animVal = static_cast<ListProperty*>(this->animVal());
- animVal->setValuesAndWrappers(newAnimVal, &m_animatedWrappers, shouldOwnValues);
- ASSERT(animVal->values().size() == animVal->wrappers().size());
- ASSERT(animVal->wrappers().size() == m_animatedWrappers.size());
</del><ins>+ m_animatingAnimVal = animVal();
+ m_animatingAnimVal->setValuesAndWrappers(newAnimVal, &m_animatedWrappers, shouldOwnValues);
+ ASSERT(m_animatingAnimVal->values().size() == m_animatingAnimVal->wrappers().size());
+ ASSERT(m_animatingAnimVal->wrappers().size() == m_animatedWrappers.size());
</ins><span class="cx"> m_isAnimating = true;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> void animationEnded()
</span><span class="cx"> {
</span><span class="cx"> ASSERT(m_isAnimating);
</span><del>- ASSERT(m_animVal);
</del><ins>+ ASSERT(m_animatingAnimVal);
</ins><span class="cx"> ASSERT(m_values.size() == m_wrappers.size());
</span><span class="cx">
</span><del>- ListProperty* animVal = static_cast<ListProperty*>(m_animVal.get());
- ASSERT(animVal->values().size() == animVal->wrappers().size());
- ASSERT(animVal->wrappers().size() == m_animatedWrappers.size());
</del><ins>+ ASSERT(m_animatingAnimVal->values().size() == m_animatingAnimVal->wrappers().size());
+ ASSERT(m_animatingAnimVal->wrappers().size() == m_animatedWrappers.size());
</ins><span class="cx">
</span><del>- animVal->setValuesAndWrappers(&m_values, &m_wrappers, false);
- ASSERT(animVal->values().size() == animVal->wrappers().size());
- ASSERT(animVal->wrappers().size() == m_wrappers.size());
</del><ins>+ m_animatingAnimVal->setValuesAndWrappers(&m_values, &m_wrappers, false);
+ ASSERT(m_animatingAnimVal->values().size() == m_animatingAnimVal->wrappers().size());
+ ASSERT(m_animatingAnimVal->wrappers().size() == m_wrappers.size());
</ins><span class="cx">
</span><span class="cx"> m_animatedWrappers.clear();
</span><ins>+ m_animatingAnimVal = nullptr;
</ins><span class="cx"> m_isAnimating = false;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> void synchronizeWrappersIfNeeded()
</span><span class="cx"> {
</span><ins>+ ASSERT(m_isAnimating);
+ ASSERT(m_animatingAnimVal);
+
</ins><span class="cx"> // Eventually the wrapper list needs synchronization because any SVGAnimateLengthList::calculateAnimatedValue() call may
</span><span class="cx"> // mutate the length of our values() list, and thus the wrapper() cache needs synchronization, to have the same size.
</span><span class="cx"> // Also existing wrappers which point directly at elements in the existing SVGLengthList have to be detached (so a copy
</span><span class="cx"> // of them is created, so existing animVal variables in JS are kept-alive). If we'd detach them later the underlying
</span><span class="cx"> // SVGLengthList was already mutated, and our list item wrapper tear offs would point nowhere. Assertions would fire.
</span><del>- ListProperty* animVal = static_cast<ListProperty*>(m_animVal.get());
- animVal->detachListWrappers(animVal->values().size());
</del><ins>+ m_animatingAnimVal->detachListWrappers(m_animatingAnimVal->values().size());
</ins><span class="cx">
</span><del>- ASSERT(animVal->values().size() == animVal->wrappers().size());
- ASSERT(animVal->wrappers().size() == m_animatedWrappers.size());
</del><ins>+ ASSERT(m_animatingAnimVal->values().size() == m_animatingAnimVal->wrappers().size());
+ ASSERT(m_animatingAnimVal->wrappers().size() == m_animatedWrappers.size());
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> void animValWillChange()
</span><span class="cx"> {
</span><del>- ASSERT(m_isAnimating);
- ASSERT(m_animVal);
</del><span class="cx"> ASSERT(m_values.size() == m_wrappers.size());
</span><span class="cx"> synchronizeWrappersIfNeeded();
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> void animValDidChange()
</span><span class="cx"> {
</span><del>- ASSERT(m_isAnimating);
- ASSERT(m_animVal);
</del><span class="cx"> ASSERT(m_values.size() == m_wrappers.size());
</span><span class="cx"> synchronizeWrappersIfNeeded();
</span><span class="cx"> }
</span><span class="lines">@@ -173,8 +186,13 @@
</span><span class="cx"> ListWrapperCache m_wrappers;
</span><span class="cx"> ListWrapperCache m_animatedWrappers;
</span><span class="cx">
</span><del>- RefPtr<SVGProperty> m_baseVal;
- RefPtr<SVGProperty> m_animVal;
</del><ins>+ // Cache the raw pointer but return a RefPtr<>. This will break the cyclic reference
+ // between SVGListPropertyTearOff and SVGAnimatedListPropertyTearOff once the property
+ // pointer is not needed.
+ ListProperty* m_baseVal { nullptr };
+ ListProperty* m_animVal { nullptr };
+
+ RefPtr<ListProperty> m_animatingAnimVal;
</ins><span class="cx"> };
</span><span class="cx">
</span><span class="cx"> }
</span></span></pre></div>
<a id="branchessafari601146branchSourceWebCoresvgpropertiesSVGAnimatedPathSegListPropertyTearOffh"></a>
<div class="modfile"><h4>Modified: branches/safari-601.1.46-branch/Source/WebCore/svg/properties/SVGAnimatedPathSegListPropertyTearOff.h (198245 => 198246)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-601.1.46-branch/Source/WebCore/svg/properties/SVGAnimatedPathSegListPropertyTearOff.h 2016-03-16 00:02:05 UTC (rev 198245)
+++ branches/safari-601.1.46-branch/Source/WebCore/svg/properties/SVGAnimatedPathSegListPropertyTearOff.h 2016-03-16 00:22:02 UTC (rev 198246)
</span><span class="lines">@@ -31,32 +31,36 @@
</span><span class="cx">
</span><span class="cx"> class SVGAnimatedPathSegListPropertyTearOff : public SVGAnimatedListPropertyTearOff<SVGPathSegList> {
</span><span class="cx"> public:
</span><del>- virtual SVGListProperty<SVGPathSegList>* baseVal() override
</del><ins>+ virtual RefPtr<ListProperty> baseVal() override
</ins><span class="cx"> {
</span><del>- if (!m_baseVal)
- m_baseVal = SVGPathSegListPropertyTearOff::create(this, BaseValRole, PathSegUnalteredRole, m_values, m_wrappers);
- return static_cast<SVGListProperty<SVGPathSegList>*>(m_baseVal.get());
</del><ins>+ if (m_baseVal)
+ return m_baseVal;
+
+ auto property = SVGPathSegListPropertyTearOff::create(this, BaseValRole, PathSegUnalteredRole, m_values, m_wrappers);
+ m_baseVal = property.ptr();
+ return WTFMove(property);
</ins><span class="cx"> }
</span><span class="cx">
</span><del>- virtual SVGListProperty<SVGPathSegList>* animVal() override
</del><ins>+ virtual RefPtr<ListProperty> animVal() override
</ins><span class="cx"> {
</span><del>- if (!m_animVal)
- m_animVal = SVGPathSegListPropertyTearOff::create(this, AnimValRole, PathSegUnalteredRole, m_values, m_wrappers);
- return static_cast<SVGListProperty<SVGPathSegList>*>(m_animVal.get());
</del><ins>+ if (m_animVal)
+ return m_animVal;
+
+ auto property = SVGPathSegListPropertyTearOff::create(this, AnimValRole, PathSegUnalteredRole, m_values, m_wrappers);
+ m_animVal = property.ptr();
+ return WTFMove(property);
</ins><span class="cx"> }
</span><span class="cx">
</span><del>- int findItem(const RefPtr<SVGPathSeg>& segment) const
</del><ins>+ int findItem(const RefPtr<SVGPathSeg>& segment)
</ins><span class="cx"> {
</span><span class="cx"> // This should ever be called for our baseVal, as animVal can't modify the list.
</span><del>- ASSERT(m_baseVal);
- return static_cast<SVGPathSegListPropertyTearOff*>(m_baseVal.get())->findItem(segment);
</del><ins>+ return static_cast<SVGPathSegListPropertyTearOff*>(baseVal().get())->findItem(segment);
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> void removeItemFromList(size_t itemIndex, bool shouldSynchronizeWrappers)
</span><span class="cx"> {
</span><span class="cx"> // This should ever be called for our baseVal, as animVal can't modify the list.
</span><del>- ASSERT(m_baseVal);
- static_cast<SVGPathSegListPropertyTearOff*>(m_baseVal.get())->removeItemFromList(itemIndex, shouldSynchronizeWrappers);
</del><ins>+ static_cast<SVGPathSegListPropertyTearOff*>(baseVal().get())->removeItemFromList(itemIndex, shouldSynchronizeWrappers);
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> static Ref<SVGAnimatedPathSegListPropertyTearOff> create(SVGElement* contextElement, const QualifiedName& attributeName, AnimatedPropertyType animatedPropertyType, SVGPathSegList& values)
</span></span></pre></div>
<a id="branchessafari601146branchSourceWebCoresvgpropertiesSVGAnimatedPropertyh"></a>
<div class="modfile"><h4>Modified: branches/safari-601.1.46-branch/Source/WebCore/svg/properties/SVGAnimatedProperty.h (198245 => 198246)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-601.1.46-branch/Source/WebCore/svg/properties/SVGAnimatedProperty.h 2016-03-16 00:02:05 UTC (rev 198245)
+++ branches/safari-601.1.46-branch/Source/WebCore/svg/properties/SVGAnimatedProperty.h 2016-03-16 00:22:02 UTC (rev 198246)
</span><span class="lines">@@ -48,22 +48,27 @@
</span><span class="cx"> virtual ~SVGAnimatedProperty();
</span><span class="cx">
</span><span class="cx"> template<typename OwnerType, typename TearOffType, typename PropertyType>
</span><del>- static TearOffType& lookupOrCreateWrapper(OwnerType* element, const SVGPropertyInfo* info, PropertyType& property)
</del><ins>+ static Ref<TearOffType> lookupOrCreateWrapper(OwnerType* element, const SVGPropertyInfo* info, PropertyType& property)
</ins><span class="cx"> {
</span><span class="cx"> ASSERT(info);
</span><span class="cx"> SVGAnimatedPropertyDescription key(element, info->propertyIdentifier);
</span><del>- auto& slot = animatedPropertyCache()->add(key, nullptr).iterator->value;
- if (!slot) {
- Ref<SVGAnimatedProperty> wrapper = TearOffType::create(element, info->attributeName, info->animatedPropertyType, property);
- if (info->animatedPropertyState == PropertyIsReadOnly)
- wrapper->setIsReadOnly();
- slot = &wrapper.leakRef();
- }
- return static_cast<TearOffType&>(*slot);
</del><ins>+
+ auto result = animatedPropertyCache()->add(key, nullptr);
+ if (!result.isNewEntry)
+ return static_cast<TearOffType&>(*result.iterator->value);
+
+ Ref<SVGAnimatedProperty> wrapper = TearOffType::create(element, info->attributeName, info->animatedPropertyType, property);
+ if (info->animatedPropertyState == PropertyIsReadOnly)
+ wrapper->setIsReadOnly();
+
+ // Cache the raw pointer but return a Ref<>. This will break the cyclic reference
+ // between SVGAnimatedProperty and SVGElement once the property pointer is not needed.
+ result.iterator->value = wrapper.ptr();
+ return static_reference_cast<TearOffType>(wrapper);
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> template<typename OwnerType, typename TearOffType>
</span><del>- static TearOffType* lookupWrapper(OwnerType* element, const SVGPropertyInfo* info)
</del><ins>+ static RefPtr<TearOffType> lookupWrapper(OwnerType* element, const SVGPropertyInfo* info)
</ins><span class="cx"> {
</span><span class="cx"> ASSERT(info);
</span><span class="cx"> SVGAnimatedPropertyDescription key(element, info->propertyIdentifier);
</span><span class="lines">@@ -71,7 +76,7 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> template<typename OwnerType, typename TearOffType>
</span><del>- static TearOffType* lookupWrapper(const OwnerType* element, const SVGPropertyInfo* info)
</del><ins>+ static RefPtr<TearOffType> lookupWrapper(const OwnerType* element, const SVGPropertyInfo* info)
</ins><span class="cx"> {
</span><span class="cx"> return lookupWrapper<OwnerType, TearOffType>(const_cast<OwnerType*>(element), info);
</span><span class="cx"> }
</span></span></pre></div>
<a id="branchessafari601146branchSourceWebCoresvgpropertiesSVGAnimatedPropertyMacrosh"></a>
<div class="modfile"><h4>Modified: branches/safari-601.1.46-branch/Source/WebCore/svg/properties/SVGAnimatedPropertyMacros.h (198245 => 198246)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-601.1.46-branch/Source/WebCore/svg/properties/SVGAnimatedPropertyMacros.h 2016-03-16 00:02:05 UTC (rev 198245)
+++ branches/safari-601.1.46-branch/Source/WebCore/svg/properties/SVGAnimatedPropertyMacros.h 2016-03-16 00:22:02 UTC (rev 198246)
</span><span class="lines">@@ -123,7 +123,7 @@
</span><span class="cx"> static const SVGPropertyInfo* LowerProperty##PropertyInfo(); \
</span><span class="cx"> PropertyType& LowerProperty() const \
</span><span class="cx"> { \
</span><del>- if (TearOffType* wrapper = SVGAnimatedProperty::lookupWrapper<UseOwnerType, TearOffType>(this, LowerProperty##PropertyInfo())) { \
</del><ins>+ if (auto wrapper = SVGAnimatedProperty::lookupWrapper<UseOwnerType, TearOffType>(this, LowerProperty##PropertyInfo())) { \
</ins><span class="cx"> if (wrapper->isAnimating()) \
</span><span class="cx"> return wrapper->currentAnimatedValue(); \
</span><span class="cx"> } \
</span><span class="lines">@@ -184,7 +184,7 @@
</span><span class="cx"> DECLARE_ANIMATED_PROPERTY(TearOffType, PropertyType, UpperProperty, LowerProperty, ) \
</span><span class="cx"> void detachAnimated##UpperProperty##ListWrappers(unsigned newListSize) \
</span><span class="cx"> { \
</span><del>- if (TearOffType* wrapper = SVGAnimatedProperty::lookupWrapper<UseOwnerType, TearOffType>(this, LowerProperty##PropertyInfo())) \
</del><ins>+ if (auto wrapper = SVGAnimatedProperty::lookupWrapper<UseOwnerType, TearOffType>(this, LowerProperty##PropertyInfo())) \
</ins><span class="cx"> wrapper->detachListWrappers(newListSize); \
</span><span class="cx"> }
</span><span class="cx">
</span></span></pre></div>
<a id="branchessafari601146branchSourceWebCoresvgpropertiesSVGAnimatedTransformListPropertyTearOffh"></a>
<div class="modfile"><h4>Modified: branches/safari-601.1.46-branch/Source/WebCore/svg/properties/SVGAnimatedTransformListPropertyTearOff.h (198245 => 198246)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-601.1.46-branch/Source/WebCore/svg/properties/SVGAnimatedTransformListPropertyTearOff.h 2016-03-16 00:02:05 UTC (rev 198245)
+++ branches/safari-601.1.46-branch/Source/WebCore/svg/properties/SVGAnimatedTransformListPropertyTearOff.h 2016-03-16 00:22:02 UTC (rev 198246)
</span><span class="lines">@@ -28,18 +28,24 @@
</span><span class="cx">
</span><span class="cx"> class SVGAnimatedTransformListPropertyTearOff : public SVGAnimatedListPropertyTearOff<SVGTransformList> {
</span><span class="cx"> public:
</span><del>- virtual SVGListPropertyTearOff<SVGTransformList>* baseVal() override
</del><ins>+ virtual RefPtr<ListProperty> baseVal() override
</ins><span class="cx"> {
</span><del>- if (!m_baseVal)
- m_baseVal = SVGTransformListPropertyTearOff::create(this, BaseValRole, m_values, m_wrappers);
- return static_cast<SVGListPropertyTearOff<SVGTransformList>*>(m_baseVal.get());
</del><ins>+ if (m_baseVal)
+ return m_baseVal;
+
+ auto property = SVGTransformListPropertyTearOff::create(this, BaseValRole, m_values, m_wrappers);
+ m_baseVal = property.ptr();
+ return WTF::move(property);
</ins><span class="cx"> }
</span><span class="cx">
</span><del>- virtual SVGListPropertyTearOff<SVGTransformList>* animVal() override
</del><ins>+ virtual RefPtr<ListProperty> animVal() override
</ins><span class="cx"> {
</span><del>- if (!m_animVal)
- m_animVal = SVGTransformListPropertyTearOff::create(this, AnimValRole, m_values, m_wrappers);
- return static_cast<SVGListPropertyTearOff<SVGTransformList>*>(m_animVal.get());
</del><ins>+ if (m_animVal)
+ return m_animVal;
+
+ auto property = SVGTransformListPropertyTearOff::create(this, AnimValRole, m_values, m_wrappers);
+ m_animVal = property.ptr();
+ return WTF::move(property);
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> static Ref<SVGAnimatedTransformListPropertyTearOff> create(SVGElement* contextElement, const QualifiedName& attributeName, AnimatedPropertyType animatedPropertyType, SVGTransformList& values)
</span></span></pre></div>
<a id="branchessafari601146branchSourceWebCoresvgpropertiesSVGListPropertyTearOffh"></a>
<div class="modfile"><h4>Modified: branches/safari-601.1.46-branch/Source/WebCore/svg/properties/SVGListPropertyTearOff.h (198245 => 198246)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-601.1.46-branch/Source/WebCore/svg/properties/SVGListPropertyTearOff.h 2016-03-16 00:02:05 UTC (rev 198245)
+++ branches/safari-601.1.46-branch/Source/WebCore/svg/properties/SVGListPropertyTearOff.h 2016-03-16 00:22:02 UTC (rev 198246)
</span><span class="lines">@@ -120,6 +120,12 @@
</span><span class="cx"> {
</span><span class="cx"> }
</span><span class="cx">
</span><ins>+ virtual ~SVGListPropertyTearOff()
+ {
+ if (m_animatedProperty)
+ m_animatedProperty->propertyWillBeDeleted(*this);
+ }
+
</ins><span class="cx"> virtual bool isReadOnly() const override
</span><span class="cx"> {
</span><span class="cx"> if (m_role == AnimValRole)
</span></span></pre></div>
<a id="branchessafari601146branchSourceWebCoresvgpropertiesSVGPathSegListPropertyTearOffcpp"></a>
<div class="modfile"><h4>Modified: branches/safari-601.1.46-branch/Source/WebCore/svg/properties/SVGPathSegListPropertyTearOff.cpp (198245 => 198246)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-601.1.46-branch/Source/WebCore/svg/properties/SVGPathSegListPropertyTearOff.cpp 2016-03-16 00:02:05 UTC (rev 198245)
+++ branches/safari-601.1.46-branch/Source/WebCore/svg/properties/SVGPathSegListPropertyTearOff.cpp 2016-03-16 00:22:02 UTC (rev 198246)
</span><span class="lines">@@ -90,7 +90,7 @@
</span><span class="cx"> bool SVGPathSegListPropertyTearOff::processIncomingListItemValue(const ListItemType& newItem, unsigned* indexToModify)
</span><span class="cx"> {
</span><span class="cx"> SVGPathSegWithContext* newItemWithContext = static_cast<SVGPathSegWithContext*>(newItem.get());
</span><del>- SVGAnimatedProperty* animatedPropertyOfItem = newItemWithContext->animatedProperty();
</del><ins>+ RefPtr<SVGAnimatedProperty> animatedPropertyOfItem = newItemWithContext->animatedProperty();
</ins><span class="cx">
</span><span class="cx"> // Alter the role, after calling animatedProperty(), as that may influence the returned animated property.
</span><span class="cx"> newItemWithContext->setContextAndRole(contextElement(), m_pathSegRole);
</span><span class="lines">@@ -106,7 +106,7 @@
</span><span class="cx"> // Spec: If newItem is already in a list, it is removed from its previous list before it is inserted into this list.
</span><span class="cx"> // 'newItem' is already living in another list. If it's not our list, synchronize the other lists wrappers after the removal.
</span><span class="cx"> bool livesInOtherList = animatedPropertyOfItem != m_animatedProperty;
</span><del>- SVGAnimatedPathSegListPropertyTearOff* propertyTearOff = static_cast<SVGAnimatedPathSegListPropertyTearOff*>(animatedPropertyOfItem);
</del><ins>+ RefPtr<SVGAnimatedPathSegListPropertyTearOff> propertyTearOff = static_pointer_cast<SVGAnimatedPathSegListPropertyTearOff>(animatedPropertyOfItem);
</ins><span class="cx"> int indexToRemove = propertyTearOff->findItem(newItem.get());
</span><span class="cx"> ASSERT(indexToRemove != -1);
</span><span class="cx">
</span></span></pre>
</div>
</div>
</body>
</html>