<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[199355] releases/WebKitGTK/webkit-2.12/Source/WebCore</title>
</head>
<body>
<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; }
#msg dl a { font-weight: bold}
#msg dl a:link { color:#fc3; }
#msg dl a:active { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/199355">199355</a></dd>
<dt>Author</dt> <dd>carlosgc@webkit.org</dd>
<dt>Date</dt> <dd>2016-04-12 09:08:47 -0700 (Tue, 12 Apr 2016)</dd>
</dl>
<h3>Log Message</h3>
<pre>Merge <a href="http://trac.webkit.org/projects/webkit/changeset/197967">r197967</a> - REGRESSION: GuardMallloc crash in SVGListPropertyTearOff<SVGPointList>::processIncomingListItemWrapper
https://bugs.webkit.org/show_bug.cgi?id=154969
Patch by Said Abou-Hallawa <sabouhallawa@apple.com> on 2016-03-10
Reviewed by Darin Adler.
The life cycle of the SVGAnimatedPropertyTearOff::m_baseVal and m_animVal
was not correct. Like what was done in SVGAnimatedListPropertyTearOff,
m_baseVal and m_animVal have to be raw RefCounted pointers. When requested
through, SVGAnimatedPropertyTearOff::baseVal() and animVal() they are
encapsulated in a RefPtr to ensure they existence as long as they are
referenced. When the animated property object (which is stored in either
m_baseVal or m_animVal) is not referenced by anyone, it is going to be
deleted. In the destructor of their class, SVGAnimatedPropertyTearOff
will be notified of this deletion through propertyWillBeDeleted() to clean
its member m_baseVal or m_animVal.
* bindings/scripts/CodeGeneratorJS.pm:
(NativeToJSValue): Now all the SVG animated property return RefPtrs. In
addition to that, SVGViewSpec.transform also returns
RefPtr<SVGTransformListPropertyTearOff>.
* svg/properties/SVGAnimatedListPropertyTearOff.h:
(WebCore::SVGAnimatedListPropertyTearOff::animVal):
(WebCore::SVGAnimatedListPropertyTearOff::currentAnimatedValue):
(WebCore::SVGAnimatedListPropertyTearOff::animationStarted):
(WebCore::SVGAnimatedListPropertyTearOff::animationEnded):
(WebCore::SVGAnimatedListPropertyTearOff::synchronizeWrappersIfNeeded):
(WebCore::SVGAnimatedListPropertyTearOff::isAnimating):
(WebCore::SVGAnimatedListPropertyTearOff::propertyWillBeDeleted):
Change propertyWillBeDeleted() to be virtual and make it takes an SVGProperty*.
Rename m_animatingAnimVal to be m_animatedProperty. Add isAnimating() which
returns true if m_animatedProperty is not null. Use isAnimating() instead of
m_isAnimating because it's deleted from the base class.
* svg/properties/SVGAnimatedProperty.cpp:
(WebCore::SVGAnimatedProperty::SVGAnimatedProperty):
(WebCore::SVGAnimatedProperty::~SVGAnimatedProperty):
* svg/properties/SVGAnimatedProperty.h:
(WebCore::SVGAnimatedProperty::isAnimating):
(WebCore::SVGAnimatedProperty::propertyWillBeDeleted):
Delete m_isAnimating since its value can be deduced from the value of
m_animatedProperty in the derived class. Add propertyWillBeDeleted() and
isAnimating() as virtual functions with the default behavior.
* svg/properties/SVGAnimatedPropertyTearOff.h:
(WebCore::SVGAnimatedPropertyTearOff::baseVal):
(WebCore::SVGAnimatedPropertyTearOff::animVal):
Like SVGAnimatedListPropertyTearOff::baseVal() and animVal() create the
value if it does not exist. Keep a raw RefCounted pointer but return a
RefPtr.
(WebCore::SVGAnimatedPropertyTearOff::isAnimating):
(WebCore::SVGAnimatedPropertyTearOff::propertyWillBeDeleted):
Override virtual functions.
(WebCore::SVGAnimatedPropertyTearOff::currentAnimatedValue):
(WebCore::SVGAnimatedPropertyTearOff::animationStarted):
(WebCore::SVGAnimatedPropertyTearOff::animationEnded):
(WebCore::SVGAnimatedPropertyTearOff::animValWillChange):
(WebCore::SVGAnimatedPropertyTearOff::animValDidChange):
Replace m_isAnimating with isAnimating(). Ensure that we get a new animated
property through animVal() and store it in a RefPtr to ensure it will not
go away while animating.
* svg/properties/SVGAnimatedStaticPropertyTearOff.h:
(WebCore::SVGAnimatedStaticPropertyTearOff::isAnimating):
(WebCore::SVGAnimatedStaticPropertyTearOff::currentAnimatedValue):
(WebCore::SVGAnimatedStaticPropertyTearOff::animationStarted):
(WebCore::SVGAnimatedStaticPropertyTearOff::animationEnded):
(WebCore::SVGAnimatedStaticPropertyTearOff::animValWillChange):
(WebCore::SVGAnimatedStaticPropertyTearOff::animValDidChange):
Add isAnimating() and replace all the instances of m_isAnimating with calls
to isAnimating().
* svg/properties/SVGPropertyTearOff.h:
(WebCore::SVGPropertyTearOff::animatedProperty):
(WebCore::SVGPropertyTearOff::setAnimatedProperty):
(WebCore::SVGPropertyTearOff::contextElement):
(WebCore::SVGPropertyTearOff::SVGPropertyTearOff):
(WebCore::SVGPropertyTearOff::~SVGPropertyTearOff):
SVGPropertyTearOff is what SVGAnimatedPropertyTearOff creates for its
baseVal() and animVal() values. These values can be null anytime once
they are not referenced. The SVGAnimatedPropertyTearOff holds only raw
RefCounted pointer for them. So (1) SVGPropertyTearOff needs to hold a
RefPtr for its SVGAnimatedProperty and (2) it needs to notify its
SVGAnimatedProperty when it's deleted by calling propertyWillBeDeleted()
from the destructor. Also there is no need to get the contextElement()
and save it in class member, m_contextElement since it can be always be
retrieved from SVGAnimatedProperty::contextElement().</pre>
<h3>Modified Paths</h3>
<ul>
<li><a href="#releasesWebKitGTKwebkit212SourceWebCoreChangeLog">releases/WebKitGTK/webkit-2.12/Source/WebCore/ChangeLog</a></li>
<li><a href="#releasesWebKitGTKwebkit212SourceWebCorebindingsscriptsCodeGeneratorJSpm">releases/WebKitGTK/webkit-2.12/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm</a></li>
<li><a href="#releasesWebKitGTKwebkit212SourceWebCoresvgpropertiesSVGAnimatedListPropertyTearOffh">releases/WebKitGTK/webkit-2.12/Source/WebCore/svg/properties/SVGAnimatedListPropertyTearOff.h</a></li>
<li><a href="#releasesWebKitGTKwebkit212SourceWebCoresvgpropertiesSVGAnimatedPropertycpp">releases/WebKitGTK/webkit-2.12/Source/WebCore/svg/properties/SVGAnimatedProperty.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit212SourceWebCoresvgpropertiesSVGAnimatedPropertyh">releases/WebKitGTK/webkit-2.12/Source/WebCore/svg/properties/SVGAnimatedProperty.h</a></li>
<li><a href="#releasesWebKitGTKwebkit212SourceWebCoresvgpropertiesSVGAnimatedPropertyTearOffh">releases/WebKitGTK/webkit-2.12/Source/WebCore/svg/properties/SVGAnimatedPropertyTearOff.h</a></li>
<li><a href="#releasesWebKitGTKwebkit212SourceWebCoresvgpropertiesSVGAnimatedStaticPropertyTearOffh">releases/WebKitGTK/webkit-2.12/Source/WebCore/svg/properties/SVGAnimatedStaticPropertyTearOff.h</a></li>
<li><a href="#releasesWebKitGTKwebkit212SourceWebCoresvgpropertiesSVGPropertyTearOffh">releases/WebKitGTK/webkit-2.12/Source/WebCore/svg/properties/SVGPropertyTearOff.h</a></li>
</ul>
</div>
<div id="patch">
<h3>Diff</h3>
<a id="releasesWebKitGTKwebkit212SourceWebCoreChangeLog"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.12/Source/WebCore/ChangeLog (199354 => 199355)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.12/Source/WebCore/ChangeLog 2016-04-12 15:46:05 UTC (rev 199354)
+++ releases/WebKitGTK/webkit-2.12/Source/WebCore/ChangeLog 2016-04-12 16:08:47 UTC (rev 199355)
</span><span class="lines">@@ -1,3 +1,95 @@
</span><ins>+2016-03-10 Said Abou-Hallawa <sabouhallawa@apple.com>
+
+ REGRESSION: GuardMallloc crash in SVGListPropertyTearOff<SVGPointList>::processIncomingListItemWrapper
+ https://bugs.webkit.org/show_bug.cgi?id=154969
+
+ Reviewed by Darin Adler.
+
+ The life cycle of the SVGAnimatedPropertyTearOff::m_baseVal and m_animVal
+ was not correct. Like what was done in SVGAnimatedListPropertyTearOff,
+ m_baseVal and m_animVal have to be raw RefCounted pointers. When requested
+ through, SVGAnimatedPropertyTearOff::baseVal() and animVal() they are
+ encapsulated in a RefPtr to ensure they existence as long as they are
+ referenced. When the animated property object (which is stored in either
+ m_baseVal or m_animVal) is not referenced by anyone, it is going to be
+ deleted. In the destructor of their class, SVGAnimatedPropertyTearOff
+ will be notified of this deletion through propertyWillBeDeleted() to clean
+ its member m_baseVal or m_animVal.
+
+ * bindings/scripts/CodeGeneratorJS.pm:
+ (NativeToJSValue): Now all the SVG animated property return RefPtrs. In
+ addition to that, SVGViewSpec.transform also returns
+ RefPtr<SVGTransformListPropertyTearOff>.
+
+ * svg/properties/SVGAnimatedListPropertyTearOff.h:
+ (WebCore::SVGAnimatedListPropertyTearOff::animVal):
+ (WebCore::SVGAnimatedListPropertyTearOff::currentAnimatedValue):
+ (WebCore::SVGAnimatedListPropertyTearOff::animationStarted):
+ (WebCore::SVGAnimatedListPropertyTearOff::animationEnded):
+ (WebCore::SVGAnimatedListPropertyTearOff::synchronizeWrappersIfNeeded):
+ (WebCore::SVGAnimatedListPropertyTearOff::isAnimating):
+ (WebCore::SVGAnimatedListPropertyTearOff::propertyWillBeDeleted):
+ Change propertyWillBeDeleted() to be virtual and make it takes an SVGProperty*.
+ Rename m_animatingAnimVal to be m_animatedProperty. Add isAnimating() which
+ returns true if m_animatedProperty is not null. Use isAnimating() instead of
+ m_isAnimating because it's deleted from the base class.
+
+ * svg/properties/SVGAnimatedProperty.cpp:
+ (WebCore::SVGAnimatedProperty::SVGAnimatedProperty):
+ (WebCore::SVGAnimatedProperty::~SVGAnimatedProperty):
+ * svg/properties/SVGAnimatedProperty.h:
+ (WebCore::SVGAnimatedProperty::isAnimating):
+ (WebCore::SVGAnimatedProperty::propertyWillBeDeleted):
+ Delete m_isAnimating since its value can be deduced from the value of
+ m_animatedProperty in the derived class. Add propertyWillBeDeleted() and
+ isAnimating() as virtual functions with the default behavior.
+
+ * svg/properties/SVGAnimatedPropertyTearOff.h:
+ (WebCore::SVGAnimatedPropertyTearOff::baseVal):
+ (WebCore::SVGAnimatedPropertyTearOff::animVal):
+ Like SVGAnimatedListPropertyTearOff::baseVal() and animVal() create the
+ value if it does not exist. Keep a raw RefCounted pointer but return a
+ RefPtr.
+
+ (WebCore::SVGAnimatedPropertyTearOff::isAnimating):
+ (WebCore::SVGAnimatedPropertyTearOff::propertyWillBeDeleted):
+ Override virtual functions.
+
+ (WebCore::SVGAnimatedPropertyTearOff::currentAnimatedValue):
+ (WebCore::SVGAnimatedPropertyTearOff::animationStarted):
+ (WebCore::SVGAnimatedPropertyTearOff::animationEnded):
+ (WebCore::SVGAnimatedPropertyTearOff::animValWillChange):
+ (WebCore::SVGAnimatedPropertyTearOff::animValDidChange):
+ Replace m_isAnimating with isAnimating(). Ensure that we get a new animated
+ property through animVal() and store it in a RefPtr to ensure it will not
+ go away while animating.
+
+ * svg/properties/SVGAnimatedStaticPropertyTearOff.h:
+ (WebCore::SVGAnimatedStaticPropertyTearOff::isAnimating):
+ (WebCore::SVGAnimatedStaticPropertyTearOff::currentAnimatedValue):
+ (WebCore::SVGAnimatedStaticPropertyTearOff::animationStarted):
+ (WebCore::SVGAnimatedStaticPropertyTearOff::animationEnded):
+ (WebCore::SVGAnimatedStaticPropertyTearOff::animValWillChange):
+ (WebCore::SVGAnimatedStaticPropertyTearOff::animValDidChange):
+ Add isAnimating() and replace all the instances of m_isAnimating with calls
+ to isAnimating().
+
+ * svg/properties/SVGPropertyTearOff.h:
+ (WebCore::SVGPropertyTearOff::animatedProperty):
+ (WebCore::SVGPropertyTearOff::setAnimatedProperty):
+ (WebCore::SVGPropertyTearOff::contextElement):
+ (WebCore::SVGPropertyTearOff::SVGPropertyTearOff):
+ (WebCore::SVGPropertyTearOff::~SVGPropertyTearOff):
+ SVGPropertyTearOff is what SVGAnimatedPropertyTearOff creates for its
+ baseVal() and animVal() values. These values can be null anytime once
+ they are not referenced. The SVGAnimatedPropertyTearOff holds only raw
+ RefCounted pointer for them. So (1) SVGPropertyTearOff needs to hold a
+ RefPtr for its SVGAnimatedProperty and (2) it needs to notify its
+ SVGAnimatedProperty when it's deleted by calling propertyWillBeDeleted()
+ from the destructor. Also there is no need to get the contextElement()
+ and save it in class member, m_contextElement since it can be always be
+ retrieved from SVGAnimatedProperty::contextElement().
+
</ins><span class="cx"> 2016-03-09 Chris Dumez <cdumez@apple.com>
</span><span class="cx">
</span><span class="cx"> Unreviewed, rebaseline bindings tests after r197874.
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit212SourceWebCorebindingsscriptsCodeGeneratorJSpm"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.12/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm (199354 => 199355)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.12/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm 2016-04-12 15:46:05 UTC (rev 199354)
+++ releases/WebKitGTK/webkit-2.12/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm 2016-04-12 16:08:47 UTC (rev 199355)
</span><span class="lines">@@ -4247,11 +4247,10 @@
</span><span class="cx"> return "toJSNewlyCreated(state, $globalObject, WTF::getPtr($value))";
</span><span class="cx"> }
</span><span class="cx">
</span><del>- # $type has to be used here because SVGViewSpec.transform is of type SVGTransformList.
- if ($codeGenerator->IsSVGTypeNeedingTearOff($type) and $type =~ /(?<!String)List$/) {
</del><ins>+ if ($codeGenerator->IsSVGAnimatedType($interfaceName) or ($interfaceName eq "SVGViewSpec" and $type eq "SVGTransformList")) {
</ins><span class="cx"> # Convert from abstract RefPtr<ListProperty> to real type, so the right toJS() method can be invoked.
</span><span class="cx"> $value = "static_cast<" . GetNativeType($type) . ">($value" . ".get())";
</span><del>- } elsif ($codeGenerator->IsSVGAnimatedType($interfaceName) or $interfaceName eq "SVGViewSpec") {
</del><ins>+ } elsif ($interfaceName eq "SVGViewSpec") {
</ins><span class="cx"> # Convert from abstract SVGProperty to real type, so the right toJS() method can be invoked.
</span><span class="cx"> $value = "static_cast<" . GetNativeType($type) . ">($value)";
</span><span class="cx"> } elsif ($codeGenerator->IsSVGTypeNeedingTearOff($type) and not $interfaceName =~ /List$/) {
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit212SourceWebCoresvgpropertiesSVGAnimatedListPropertyTearOffh"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.12/Source/WebCore/svg/properties/SVGAnimatedListPropertyTearOff.h (199354 => 199355)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.12/Source/WebCore/svg/properties/SVGAnimatedListPropertyTearOff.h 2016-04-12 15:46:05 UTC (rev 199354)
+++ releases/WebKitGTK/webkit-2.12/Source/WebCore/svg/properties/SVGAnimatedListPropertyTearOff.h 2016-04-12 16:08:47 UTC (rev 199355)
</span><span class="lines">@@ -1,5 +1,6 @@
</span><span class="cx"> /*
</span><span class="cx"> * Copyright (C) Research In Motion Limited 2010. All rights reserved.
</span><ins>+ * Copyright (C) 2016 Apple Inc. All rights reserved.
</ins><span class="cx"> *
</span><span class="cx"> * This library is free software; you can redistribute it and/or
</span><span class="cx"> * modify it under the terms of the GNU Library General Public
</span><span class="lines">@@ -58,8 +59,10 @@
</span><span class="cx"> m_animVal = property.ptr();
</span><span class="cx"> return WTFMove(property);
</span><span class="cx"> }
</span><del>-
- void propertyWillBeDeleted(const ListProperty& property)
</del><ins>+
+ bool isAnimating() const override { return m_animatedProperty; }
+ bool isAnimatedListTearOff() const override { return true; }
+ void propertyWillBeDeleted(const SVGProperty& property) override
</ins><span class="cx"> {
</span><span class="cx"> if (&property == m_baseVal)
</span><span class="cx"> m_baseVal = nullptr;
</span><span class="lines">@@ -67,8 +70,6 @@
</span><span class="cx"> m_animVal = nullptr;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- virtual bool isAnimatedListTearOff() const override { return true; }
-
</del><span class="cx"> int findItem(SVGProperty* property)
</span><span class="cx"> {
</span><span class="cx"> // This should ever be called for our baseVal, as animVal can't modify the list.
</span><span class="lines">@@ -91,9 +92,8 @@
</span><span class="cx">
</span><span class="cx"> PropertyType& currentAnimatedValue()
</span><span class="cx"> {
</span><del>- ASSERT(m_isAnimating);
- ASSERT(m_animatingAnimVal);
- return static_pointer_cast<ListProperty>(m_animatingAnimVal)->values();
</del><ins>+ ASSERT(isAnimating());
+ return m_animatedProperty->values();
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> const PropertyType& currentBaseValue() const
</span><span class="lines">@@ -103,8 +103,7 @@
</span><span class="cx">
</span><span class="cx"> void animationStarted(PropertyType* newAnimVal, bool shouldOwnValues = false)
</span><span class="cx"> {
</span><del>- ASSERT(!m_isAnimating);
- ASSERT(!m_animatingAnimVal);
</del><ins>+ ASSERT(!isAnimating());
</ins><span class="cx"> ASSERT(newAnimVal);
</span><span class="cx"> ASSERT(m_values.size() == m_wrappers.size());
</span><span class="cx"> ASSERT(m_animatedWrappers.isEmpty());
</span><span class="lines">@@ -113,45 +112,41 @@
</span><span class="cx"> if (!newAnimVal->isEmpty())
</span><span class="cx"> m_animatedWrappers.fill(0, newAnimVal->size());
</span><span class="cx">
</span><del>- m_animatingAnimVal = animVal();
- m_animatingAnimVal->setValuesAndWrappers(newAnimVal, &m_animatedWrappers, shouldOwnValues);
- ASSERT(m_animatingAnimVal->values().size() == m_animatingAnimVal->wrappers().size());
- ASSERT(m_animatingAnimVal->wrappers().size() == m_animatedWrappers.size());
- m_isAnimating = true;
</del><ins>+ m_animatedProperty = animVal();
+ m_animatedProperty->setValuesAndWrappers(newAnimVal, &m_animatedWrappers, shouldOwnValues);
+ ASSERT(m_animatedProperty->values().size() == m_animatedProperty->wrappers().size());
+ ASSERT(m_animatedProperty->wrappers().size() == m_animatedWrappers.size());
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> void animationEnded()
</span><span class="cx"> {
</span><del>- ASSERT(m_isAnimating);
- ASSERT(m_animatingAnimVal);
</del><ins>+ ASSERT(isAnimating());
</ins><span class="cx"> ASSERT(m_values.size() == m_wrappers.size());
</span><span class="cx">
</span><del>- ASSERT(m_animatingAnimVal->values().size() == m_animatingAnimVal->wrappers().size());
- ASSERT(m_animatingAnimVal->wrappers().size() == m_animatedWrappers.size());
</del><ins>+ ASSERT(m_animatedProperty->values().size() == m_animatedProperty->wrappers().size());
+ ASSERT(m_animatedProperty->wrappers().size() == m_animatedWrappers.size());
</ins><span class="cx">
</span><del>- m_animatingAnimVal->setValuesAndWrappers(&m_values, &m_wrappers, false);
- ASSERT(m_animatingAnimVal->values().size() == m_animatingAnimVal->wrappers().size());
- ASSERT(m_animatingAnimVal->wrappers().size() == m_wrappers.size());
</del><ins>+ m_animatedProperty->setValuesAndWrappers(&m_values, &m_wrappers, false);
+ ASSERT(m_animatedProperty->values().size() == m_animatedProperty->wrappers().size());
+ ASSERT(m_animatedProperty->wrappers().size() == m_wrappers.size());
</ins><span class="cx">
</span><span class="cx"> m_animatedWrappers.clear();
</span><del>- m_animatingAnimVal = nullptr;
- m_isAnimating = false;
</del><ins>+ m_animatedProperty = nullptr;
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> void synchronizeWrappersIfNeeded()
</span><span class="cx"> {
</span><del>- ASSERT(m_isAnimating);
- ASSERT(m_animatingAnimVal);
</del><ins>+ ASSERT(isAnimating());
</ins><span class="cx">
</span><span class="cx"> // Eventually the wrapper list needs synchronization because any SVGAnimateLengthList::calculateAnimatedValue() call may
</span><span class="cx"> // mutate the length of our values() list, and thus the wrapper() cache needs synchronization, to have the same size.
</span><span class="cx"> // Also existing wrappers which point directly at elements in the existing SVGLengthList have to be detached (so a copy
</span><span class="cx"> // of them is created, so existing animVal variables in JS are kept-alive). If we'd detach them later the underlying
</span><span class="cx"> // SVGLengthList was already mutated, and our list item wrapper tear offs would point nowhere. Assertions would fire.
</span><del>- m_animatingAnimVal->detachListWrappers(m_animatingAnimVal->values().size());
</del><ins>+ m_animatedProperty->detachListWrappers(m_animatedProperty->values().size());
</ins><span class="cx">
</span><del>- ASSERT(m_animatingAnimVal->values().size() == m_animatingAnimVal->wrappers().size());
- ASSERT(m_animatingAnimVal->wrappers().size() == m_animatedWrappers.size());
</del><ins>+ ASSERT(m_animatedProperty->values().size() == m_animatedProperty->wrappers().size());
+ ASSERT(m_animatedProperty->wrappers().size() == m_animatedWrappers.size());
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> void animValWillChange()
</span><span class="lines">@@ -192,7 +187,7 @@
</span><span class="cx"> ListProperty* m_baseVal { nullptr };
</span><span class="cx"> ListProperty* m_animVal { nullptr };
</span><span class="cx">
</span><del>- RefPtr<ListProperty> m_animatingAnimVal;
</del><ins>+ RefPtr<ListProperty> m_animatedProperty;
</ins><span class="cx"> };
</span><span class="cx">
</span><span class="cx"> }
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit212SourceWebCoresvgpropertiesSVGAnimatedPropertycpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.12/Source/WebCore/svg/properties/SVGAnimatedProperty.cpp (199354 => 199355)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.12/Source/WebCore/svg/properties/SVGAnimatedProperty.cpp 2016-04-12 15:46:05 UTC (rev 199354)
+++ releases/WebKitGTK/webkit-2.12/Source/WebCore/svg/properties/SVGAnimatedProperty.cpp 2016-04-12 16:08:47 UTC (rev 199355)
</span><span class="lines">@@ -1,6 +1,7 @@
</span><span class="cx"> /*
</span><span class="cx"> * Copyright (C) Research In Motion Limited 2010. All rights reserved.
</span><span class="cx"> * Copyright (C) 2013 Samsung Electronics. All rights reserved.
</span><ins>+ * Copyright (C) 2016 Apple Inc. All rights reserved.
</ins><span class="cx"> *
</span><span class="cx"> * This library is free software; you can redistribute it and/or
</span><span class="cx"> * modify it under the terms of the GNU Library General Public
</span><span class="lines">@@ -29,7 +30,6 @@
</span><span class="cx"> : m_contextElement(contextElement)
</span><span class="cx"> , m_attributeName(attributeName)
</span><span class="cx"> , m_animatedPropertyType(animatedPropertyType)
</span><del>- , m_isAnimating(false)
</del><span class="cx"> , m_isReadOnly(false)
</span><span class="cx"> {
</span><span class="cx"> }
</span><span class="lines">@@ -45,7 +45,7 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> // Assure that animationEnded() was called, if animationStarted() was called before.
</span><del>- ASSERT(!m_isAnimating);
</del><ins>+ ASSERT(!isAnimating());
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> void SVGAnimatedProperty::commitChange()
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit212SourceWebCoresvgpropertiesSVGAnimatedPropertyh"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.12/Source/WebCore/svg/properties/SVGAnimatedProperty.h (199354 => 199355)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.12/Source/WebCore/svg/properties/SVGAnimatedProperty.h 2016-04-12 15:46:05 UTC (rev 199354)
+++ releases/WebKitGTK/webkit-2.12/Source/WebCore/svg/properties/SVGAnimatedProperty.h 2016-04-12 16:08:47 UTC (rev 199355)
</span><span class="lines">@@ -1,6 +1,7 @@
</span><span class="cx"> /*
</span><span class="cx"> * Copyright (C) Research In Motion Limited 2010. All rights reserved.
</span><span class="cx"> * Copyright (C) 2013 Samsung Electronics. All rights reserved.
</span><ins>+ * Copyright (C) 2016 Apple Inc. All rights reserved.
</ins><span class="cx"> *
</span><span class="cx"> * This library is free software; you can redistribute it and/or
</span><span class="cx"> * modify it under the terms of the GNU Library General Public
</span><span class="lines">@@ -28,19 +29,21 @@
</span><span class="cx"> namespace WebCore {
</span><span class="cx">
</span><span class="cx"> class SVGElement;
</span><ins>+class SVGProperty;
</ins><span class="cx">
</span><span class="cx"> class SVGAnimatedProperty : public RefCounted<SVGAnimatedProperty> {
</span><span class="cx"> public:
</span><span class="cx"> SVGElement* contextElement() const { return m_contextElement.get(); }
</span><span class="cx"> const QualifiedName& attributeName() const { return m_attributeName; }
</span><span class="cx"> AnimatedPropertyType animatedPropertyType() const { return m_animatedPropertyType; }
</span><del>- bool isAnimating() const { return m_isAnimating; }
</del><span class="cx"> bool isReadOnly() const { return m_isReadOnly; }
</span><span class="cx"> void setIsReadOnly() { m_isReadOnly = true; }
</span><span class="cx">
</span><span class="cx"> void commitChange();
</span><span class="cx">
</span><ins>+ virtual bool isAnimating() const { return false; }
</ins><span class="cx"> virtual bool isAnimatedListTearOff() const { return false; }
</span><ins>+ virtual void propertyWillBeDeleted(const SVGProperty&) { }
</ins><span class="cx">
</span><span class="cx"> // Caching facilities.
</span><span class="cx"> typedef HashMap<SVGAnimatedPropertyDescription, SVGAnimatedProperty*, SVGAnimatedPropertyDescriptionHash, SVGAnimatedPropertyDescriptionHashTraits> Cache;
</span><span class="lines">@@ -92,7 +95,6 @@
</span><span class="cx"> AnimatedPropertyType m_animatedPropertyType;
</span><span class="cx">
</span><span class="cx"> protected:
</span><del>- bool m_isAnimating;
</del><span class="cx"> bool m_isReadOnly;
</span><span class="cx"> };
</span><span class="cx">
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit212SourceWebCoresvgpropertiesSVGAnimatedPropertyTearOffh"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.12/Source/WebCore/svg/properties/SVGAnimatedPropertyTearOff.h (199354 => 199355)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.12/Source/WebCore/svg/properties/SVGAnimatedPropertyTearOff.h 2016-04-12 15:46:05 UTC (rev 199354)
+++ releases/WebKitGTK/webkit-2.12/Source/WebCore/svg/properties/SVGAnimatedPropertyTearOff.h 2016-04-12 16:08:47 UTC (rev 199355)
</span><span class="lines">@@ -1,5 +1,6 @@
</span><span class="cx"> /*
</span><span class="cx"> * Copyright (C) Research In Motion Limited 2010. All rights reserved.
</span><ins>+ * Copyright (C) 2016 Apple Inc. All rights reserved.
</ins><span class="cx"> *
</span><span class="cx"> * This library is free software; you can redistribute it and/or
</span><span class="cx"> * modify it under the terms of the GNU Library General Public
</span><span class="lines">@@ -31,30 +32,34 @@
</span><span class="cx"> typedef SVGPropertyTearOff<PropertyType> PropertyTearOff;
</span><span class="cx"> typedef PropertyType ContentType;
</span><span class="cx">
</span><del>- virtual ~SVGAnimatedPropertyTearOff()
</del><ins>+ RefPtr<PropertyTearOff> baseVal()
</ins><span class="cx"> {
</span><del>- if (m_baseVal) {
- ASSERT(m_baseVal->animatedProperty() == this);
- m_baseVal->setAnimatedProperty(nullptr);
- }
- if (m_animVal) {
- ASSERT(m_animVal->animatedProperty() == this);
- m_animVal->setAnimatedProperty(nullptr);
- }
</del><ins>+ if (m_baseVal)
+ return m_baseVal;
+
+ auto property = PropertyTearOff::create(this, BaseValRole, m_property);
+ m_baseVal = property.ptr();
+ return WTFMove(property);
</ins><span class="cx"> }
</span><span class="cx">
</span><del>- PropertyTearOff* baseVal()
</del><ins>+ RefPtr<PropertyTearOff> animVal()
</ins><span class="cx"> {
</span><del>- if (!m_baseVal)
- m_baseVal = PropertyTearOff::create(this, BaseValRole, m_property);
- return m_baseVal.get();
</del><ins>+ if (m_animVal)
+ return m_animVal;
+
+ auto property = PropertyTearOff::create(this, AnimValRole, m_property);
+ m_animVal = property.ptr();
+ return WTFMove(property);
</ins><span class="cx"> }
</span><span class="cx">
</span><del>- PropertyTearOff* animVal()
</del><ins>+ bool isAnimating() const override { return m_animatedProperty; }
+
+ void propertyWillBeDeleted(const SVGProperty& property) override
</ins><span class="cx"> {
</span><del>- if (!m_animVal)
- m_animVal = PropertyTearOff::create(this, AnimValRole, m_property);
- return m_animVal.get();
</del><ins>+ if (&property == m_baseVal)
+ m_baseVal = nullptr;
+ else if (&property == m_animVal)
+ m_animVal = nullptr;
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> static Ref<SVGAnimatedPropertyTearOff<PropertyType>> create(SVGElement* contextElement, const QualifiedName& attributeName, AnimatedPropertyType animatedPropertyType, PropertyType& property)
</span><span class="lines">@@ -65,9 +70,8 @@
</span><span class="cx">
</span><span class="cx"> PropertyType& currentAnimatedValue()
</span><span class="cx"> {
</span><del>- ASSERT(m_isAnimating);
- ASSERT(m_animVal);
- return m_animVal->propertyReference();
</del><ins>+ ASSERT(isAnimating());
+ return m_animatedProperty->propertyReference();
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> const PropertyType& currentBaseValue() const
</span><span class="lines">@@ -77,32 +81,29 @@
</span><span class="cx">
</span><span class="cx"> void animationStarted(PropertyType* newAnimVal)
</span><span class="cx"> {
</span><del>- ASSERT(!m_isAnimating);
</del><ins>+ ASSERT(!isAnimating());
</ins><span class="cx"> ASSERT(newAnimVal);
</span><del>- animVal()->setValue(*newAnimVal);
- m_isAnimating = true;
</del><ins>+ m_animatedProperty = animVal();
+ m_animatedProperty->setValue(*newAnimVal);
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> void animationEnded()
</span><span class="cx"> {
</span><del>- ASSERT(m_isAnimating);
- ASSERT(m_animVal);
- m_animVal->setValue(m_property);
- m_isAnimating = false;
</del><ins>+ ASSERT(isAnimating());
+ m_animatedProperty->setValue(m_property);
+ m_animatedProperty = nullptr;
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> void animValWillChange()
</span><span class="cx"> {
</span><span class="cx"> // no-op for non list types.
</span><del>- ASSERT(m_isAnimating);
- ASSERT(m_animVal);
</del><ins>+ ASSERT(isAnimating());
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> void animValDidChange()
</span><span class="cx"> {
</span><span class="cx"> // no-op for non list types.
</span><del>- ASSERT(m_isAnimating);
- ASSERT(m_animVal);
</del><ins>+ ASSERT(isAnimating());
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> private:
</span><span class="lines">@@ -113,8 +114,10 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> PropertyType& m_property;
</span><del>- RefPtr<PropertyTearOff> m_baseVal;
- RefPtr<PropertyTearOff> m_animVal;
</del><ins>+ PropertyTearOff* m_baseVal { nullptr };
+ PropertyTearOff* m_animVal { nullptr };
+
+ RefPtr<PropertyTearOff> m_animatedProperty;
</ins><span class="cx"> };
</span><span class="cx">
</span><span class="cx"> }
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit212SourceWebCoresvgpropertiesSVGAnimatedStaticPropertyTearOffh"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.12/Source/WebCore/svg/properties/SVGAnimatedStaticPropertyTearOff.h (199354 => 199355)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.12/Source/WebCore/svg/properties/SVGAnimatedStaticPropertyTearOff.h 2016-04-12 15:46:05 UTC (rev 199354)
+++ releases/WebKitGTK/webkit-2.12/Source/WebCore/svg/properties/SVGAnimatedStaticPropertyTearOff.h 2016-04-12 16:08:47 UTC (rev 199355)
</span><span class="lines">@@ -1,5 +1,6 @@
</span><span class="cx"> /*
</span><span class="cx"> * Copyright (C) Research In Motion Limited 2010-2012. All rights reserved.
</span><ins>+ * Copyright (C) 2016 Apple Inc. All rights reserved.
</ins><span class="cx"> *
</span><span class="cx"> * This library is free software; you can redistribute it and/or
</span><span class="cx"> * modify it under the terms of the GNU Library General Public
</span><span class="lines">@@ -48,6 +49,8 @@
</span><span class="cx"> commitChange();
</span><span class="cx"> }
</span><span class="cx">
</span><ins>+ bool isAnimating() const override { return m_animatedProperty; }
+
</ins><span class="cx"> static Ref<SVGAnimatedStaticPropertyTearOff<PropertyType>> create(SVGElement* contextElement, const QualifiedName& attributeName, AnimatedPropertyType animatedPropertyType, PropertyType& property)
</span><span class="cx"> {
</span><span class="cx"> ASSERT(contextElement);
</span><span class="lines">@@ -56,8 +59,7 @@
</span><span class="cx">
</span><span class="cx"> PropertyType& currentAnimatedValue()
</span><span class="cx"> {
</span><del>- ASSERT(m_isAnimating);
- ASSERT(m_animatedProperty);
</del><ins>+ ASSERT(isAnimating());
</ins><span class="cx"> return *m_animatedProperty;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -68,33 +70,27 @@
</span><span class="cx">
</span><span class="cx"> void animationStarted(PropertyType* newAnimVal)
</span><span class="cx"> {
</span><del>- ASSERT(!m_isAnimating);
- ASSERT(!m_animatedProperty);
</del><ins>+ ASSERT(!isAnimating());
</ins><span class="cx"> ASSERT(newAnimVal);
</span><span class="cx"> m_animatedProperty = newAnimVal;
</span><del>- m_isAnimating = true;
</del><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> void animationEnded()
</span><span class="cx"> {
</span><del>- ASSERT(m_isAnimating);
- ASSERT(m_animatedProperty);
</del><ins>+ ASSERT(isAnimating());
</ins><span class="cx"> m_animatedProperty = nullptr;
</span><del>- m_isAnimating = false;
</del><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> void animValWillChange()
</span><span class="cx"> {
</span><span class="cx"> // no-op for non list types.
</span><del>- ASSERT(m_isAnimating);
- ASSERT(m_animatedProperty);
</del><ins>+ ASSERT(isAnimating());
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> void animValDidChange()
</span><span class="cx"> {
</span><span class="cx"> // no-op for non list types.
</span><del>- ASSERT(m_isAnimating);
- ASSERT(m_animatedProperty);
</del><ins>+ ASSERT(isAnimating());
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> protected:
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit212SourceWebCoresvgpropertiesSVGPropertyTearOffh"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.12/Source/WebCore/svg/properties/SVGPropertyTearOff.h (199354 => 199355)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.12/Source/WebCore/svg/properties/SVGPropertyTearOff.h 2016-04-12 15:46:05 UTC (rev 199354)
+++ releases/WebKitGTK/webkit-2.12/Source/WebCore/svg/properties/SVGPropertyTearOff.h 2016-04-12 16:08:47 UTC (rev 199355)
</span><span class="lines">@@ -1,5 +1,6 @@
</span><span class="cx"> /*
</span><span class="cx"> * Copyright (C) Research In Motion Limited 2010. All rights reserved.
</span><ins>+ * Copyright (C) 2016 Apple Inc. All rights reserved.
</ins><span class="cx"> *
</span><span class="cx"> * This library is free software; you can redistribute it and/or
</span><span class="cx"> * modify it under the terms of the GNU Library General Public
</span><span class="lines">@@ -57,7 +58,7 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> virtual PropertyType& propertyReference() { return *m_value; }
</span><del>- SVGAnimatedProperty* animatedProperty() const { return m_animatedProperty; }
</del><ins>+ SVGAnimatedProperty* animatedProperty() const { return m_animatedProperty.get(); }
</ins><span class="cx">
</span><span class="cx"> virtual void setValue(PropertyType& value)
</span><span class="cx"> {
</span><span class="lines">@@ -72,16 +73,13 @@
</span><span class="cx"> void setAnimatedProperty(SVGAnimatedProperty* animatedProperty)
</span><span class="cx"> {
</span><span class="cx"> m_animatedProperty = animatedProperty;
</span><del>-
- if (m_animatedProperty)
- m_contextElement = m_animatedProperty->contextElement();
</del><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> SVGElement* contextElement() const
</span><span class="cx"> {
</span><span class="cx"> if (!m_animatedProperty || m_valueIsCopy)
</span><del>- return 0;
- return m_contextElement.get();
</del><ins>+ return nullptr;
+ return m_animatedProperty->contextElement();
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> void addChild(WeakPtr<SVGPropertyTearOffBase> child)
</span><span class="lines">@@ -131,11 +129,6 @@
</span><span class="cx"> , m_value(&value)
</span><span class="cx"> , m_valueIsCopy(false)
</span><span class="cx"> {
</span><del>- // Using operator & is completely fine, as SVGAnimatedProperty owns this reference,
- // and we're guaranteed to live as long as SVGAnimatedProperty does.
-
- if (m_animatedProperty)
- m_contextElement = m_animatedProperty->contextElement();
</del><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> SVGPropertyTearOff(const PropertyType& initialValue)
</span><span class="lines">@@ -157,6 +150,9 @@
</span><span class="cx"> detachChildren();
</span><span class="cx"> delete m_value;
</span><span class="cx"> }
</span><ins>+
+ if (m_animatedProperty)
+ m_animatedProperty->propertyWillBeDeleted(*this);
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> void detachChildren()
</span><span class="lines">@@ -168,8 +164,7 @@
</span><span class="cx"> m_childTearOffs.clear();
</span><span class="cx"> }
</span><span class="cx">
</span><del>- RefPtr<SVGElement> m_contextElement;
- SVGAnimatedProperty* m_animatedProperty;
</del><ins>+ RefPtr<SVGAnimatedProperty> m_animatedProperty;
</ins><span class="cx"> SVGPropertyRole m_role;
</span><span class="cx"> PropertyType* m_value;
</span><span class="cx"> Vector<WeakPtr<SVGPropertyTearOffBase>> m_childTearOffs;
</span></span></pre>
</div>
</div>
</body>
</html>