Title: [137694] branches/chromium/1312
- Revision
- 137694
- Author
- [email protected]
- Date
- 2012-12-13 18:12:05 -0800 (Thu, 13 Dec 2012)
Log Message
Merge 136541
BUG=163994
Review URL: https://codereview.chromium.org/11564028
Modified Paths
Added Paths
Diff
Copied: branches/chromium/1312/LayoutTests/svg/custom/use-href-update-crash-expected.txt (from rev 136541, trunk/LayoutTests/svg/custom/use-href-update-crash-expected.txt) (0 => 137694)
--- branches/chromium/1312/LayoutTests/svg/custom/use-href-update-crash-expected.txt (rev 0)
+++ branches/chromium/1312/LayoutTests/svg/custom/use-href-update-crash-expected.txt 2012-12-14 02:12:05 UTC (rev 137694)
@@ -0,0 +1 @@
+PASS: did not crash.
Copied: branches/chromium/1312/LayoutTests/svg/custom/use-href-update-crash.svg (from rev 136541, trunk/LayoutTests/svg/custom/use-href-update-crash.svg) (0 => 137694)
--- branches/chromium/1312/LayoutTests/svg/custom/use-href-update-crash.svg (rev 0)
+++ branches/chromium/1312/LayoutTests/svg/custom/use-href-update-crash.svg 2012-12-14 02:12:05 UTC (rev 137694)
@@ -0,0 +1,17 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<svg xmlns:xlink="http://www.w3.org/1999/xlink" xmlns="http://www.w3.org/2000/svg">
+ <!-- Test for https://bugs.webkit.org/show_bug.cgi?id=104004 -->
+ <use id="use" xlink:href=""
+ <text>PASS: did not crash.</text>
+
+ <script>
+ var use = document.getElementById('use');
+ use.setAttribute('xlink:href', 'bar.svg#bar');
+ use.parentNode.removeChild(use);
+ use = null;
+ gc();
+
+ if (window.testRunner)
+ testRunner.dumpAsText();
+ </script>
+</svg>
Modified: branches/chromium/1312/Source/WebCore/svg/SVGUseElement.cpp (137693 => 137694)
--- branches/chromium/1312/Source/WebCore/svg/SVGUseElement.cpp 2012-12-14 02:02:51 UTC (rev 137693)
+++ branches/chromium/1312/Source/WebCore/svg/SVGUseElement.cpp 2012-12-14 02:12:05 UTC (rev 137694)
@@ -107,8 +107,7 @@
SVGUseElement::~SVGUseElement()
{
- if (m_cachedDocument)
- m_cachedDocument->removeClient(this);
+ setCachedDocument(0);
clearResourceReferences();
}
@@ -256,18 +255,14 @@
KURL url = ""
if (url.hasFragmentIdentifier()) {
CachedResourceRequest request(ResourceRequest(url.string()));
- m_cachedDocument = document()->cachedResourceLoader()->requestSVGDocument(request);
- if (m_cachedDocument)
- m_cachedDocument->addClient(this);
+ setCachedDocument(document()->cachedResourceLoader()->requestSVGDocument(request));
}
- }
+ } else
+ setCachedDocument(0);
- if (m_cachedDocument && !isExternalReference) {
- m_cachedDocument->removeClient(this);
- m_cachedDocument = 0;
- }
if (!m_wasInsertedByParser)
buildPendingResource();
+
return;
}
@@ -991,6 +986,19 @@
}
}
+void SVGUseElement::setCachedDocument(CachedResourceHandle<CachedSVGDocument> cachedDocument)
+{
+ if (m_cachedDocument == cachedDocument)
+ return;
+
+ if (m_cachedDocument)
+ m_cachedDocument->removeClient(this);
+
+ m_cachedDocument = cachedDocument;
+ if (m_cachedDocument)
+ m_cachedDocument->addClient(this);
}
+}
+
#endif // ENABLE(SVG)
Modified: branches/chromium/1312/Source/WebCore/svg/SVGUseElement.h (137693 => 137694)
--- branches/chromium/1312/Source/WebCore/svg/SVGUseElement.h 2012-12-14 02:02:51 UTC (rev 137693)
+++ branches/chromium/1312/Source/WebCore/svg/SVGUseElement.h 2012-12-14 02:12:05 UTC (rev 137694)
@@ -114,6 +114,7 @@
bool instanceTreeIsLoading(SVGElementInstance*);
virtual void notifyFinished(CachedResource*);
Document* referencedDocument() const;
+ void setCachedDocument(CachedResourceHandle<CachedSVGDocument>);
// SVGTests
virtual void synchronizeRequiredFeatures() { SVGTests::synchronizeRequiredFeatures(this); }
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo/webkit-changes
