Title: [198247] branches/safari-601.1.46-branch/Source/WebCore
- Revision
- 198247
- Author
- [email protected]
- Date
- 2016-03-15 17:22:05 -0700 (Tue, 15 Mar 2016)
Log Message
Merge r196670. rdar://problem/24860681
Modified Paths
Diff
Modified: branches/safari-601.1.46-branch/Source/WebCore/ChangeLog (198246 => 198247)
--- branches/safari-601.1.46-branch/Source/WebCore/ChangeLog 2016-03-16 00:22:02 UTC (rev 198246)
+++ branches/safari-601.1.46-branch/Source/WebCore/ChangeLog 2016-03-16 00:22:05 UTC (rev 198247)
@@ -1,5 +1,30 @@
2016-03-14 Matthew Hanson <[email protected]>
+ Merge r196670. rdar://problem/24860681
+
+ 2016-02-16 Said Abou-Hallawa <[email protected]>
+
+ REGRESSION(r196268): WTFCrashWithSecurityImplication on SVG path animation tests
+ https://bugs.webkit.org/show_bug.cgi?id=154221
+
+ Reviewed by Brent Fulgham.
+
+ In r196268, a destructor was added to SVGListPropertyTearOff that notifies
+ its wrapper (the SVGAnimatedListPropertyTearoff) about its deletion. This
+ allows the wrapper to nullify any references to the wrapped content.
+
+ We needed to do the same thing for SVGPathSegListPropertyTearOff. Both
+ SVGPathSegListPropertyTearOff and SVGListPropertyTearOff inherit from
+ SVGListProperty and both hold pointers to SVGAnimatedListPropertyTearOff
+ which needs to be notified.
+
+ Tests: exiting svg path animation tests should not crash.
+
+ * svg/properties/SVGPathSegListPropertyTearOff.h:
+ (WebCore::SVGPathSegListPropertyTearOff::~SVGPathSegListPropertyTearOff):
+
+2016-03-14 Matthew Hanson <[email protected]>
+
Merge r196268. rdar://problem/24748259
2016-02-08 Said Abou-Hallawa <[email protected]>
Modified: branches/safari-601.1.46-branch/Source/WebCore/svg/properties/SVGPathSegListPropertyTearOff.h (198246 => 198247)
--- branches/safari-601.1.46-branch/Source/WebCore/svg/properties/SVGPathSegListPropertyTearOff.h 2016-03-16 00:22:02 UTC (rev 198246)
+++ branches/safari-601.1.46-branch/Source/WebCore/svg/properties/SVGPathSegListPropertyTearOff.h 2016-03-16 00:22:05 UTC (rev 198247)
@@ -115,6 +115,12 @@
{
}
+ virtual ~SVGPathSegListPropertyTearOff()
+ {
+ if (m_animatedProperty)
+ m_animatedProperty->propertyWillBeDeleted(*this);
+ }
+
SVGPathElement* contextElement() const;
void clearContextAndRoles();
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
