SVGViewSpec objects should mark relevant SVG elements
authorbfulgham@apple.com <bfulgham@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Tue, 11 Dec 2018 06:50:33 +0000 (06:50 +0000)
committerbfulgham@apple.com <bfulgham@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Tue, 11 Dec 2018 06:50:33 +0000 (06:50 +0000)
https://bugs.webkit.org/show_bug.cgi?id=192567
<rdar://problem/46491325>

Reviewed by Ryosuke Niwa.

Source/WebCore:

SVGViewSpec elements reflect the state of an underlying SVGElement. Teach the mark algorithm to
recognize the relevant SVGElement as active as long as the SVGViewSpec is active.

Update SVGElement so that it can vend WeakPtrs. I also noticed that SVGAttributeOwner used a bare
pointer to the SVGElement, so switched to a WeakPtr.

Test: svg/animations/view-dependency-crash.html

* Sources.txt: Add new files.
* WebCore.xcodeproj/project.pbxproj: Ditto.
* bindings/js/JSSVGViewSpecCustom.cpp: Added.
(WebCore::JSSVGViewSpec::visitAdditionalChildren):
* svg/SVGElement.h:
* svg/SVGPathElement.h:
* svg/SVGViewSpec.cpp:
(WebCore::SVGViewSpec::SVGViewSpec): Hold a weak pointer (rather than a bare pointer) to the underlying element.
* svg/SVGViewSpec.h:
* svg/SVGViewSpec.idl:
* svg/properties/SVGAttributeOwnerProxy.cpp: Added.
(WebCore::SVGAttributeOwnerProxy::SVGAttributeOwnerProxy): Hold a weak pointer (rather than a bare pointer) to
the underling SVGElement.
(WebCore::SVGAttributeOwnerProxy::element const): Ditto.
* svg/properties/SVGAttributeOwnerProxy.h:
(WebCore::SVGAttributeOwnerProxy::SVGAttributeOwnerProxy): Move implementation to cpp file.
(WebCore::SVGAttributeOwnerProxy::element const): Ditto.
* svg/properties/SVGAttributeOwnerProxyImpl.h: Update for WeakPtr use.

LayoutTests:

* svg/animations/view-dependency-crash-expected.txt: Added.
* svg/animations/view-dependency-crash.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@239070 268f45cc-cd09-0410-ab3c-d52691b4dbfc

15 files changed:
LayoutTests/ChangeLog
LayoutTests/svg/animations/view-dependency-crash-expected.txt [new file with mode: 0644]
LayoutTests/svg/animations/view-dependency-crash.html [new file with mode: 0644]
Source/WebCore/ChangeLog
Source/WebCore/Sources.txt
Source/WebCore/WebCore.xcodeproj/project.pbxproj
Source/WebCore/bindings/js/JSSVGViewSpecCustom.cpp [new file with mode: 0644]
Source/WebCore/svg/SVGElement.h
Source/WebCore/svg/SVGPathElement.h
Source/WebCore/svg/SVGViewSpec.cpp
Source/WebCore/svg/SVGViewSpec.h
Source/WebCore/svg/SVGViewSpec.idl
Source/WebCore/svg/properties/SVGAttributeOwnerProxy.cpp [new file with mode: 0644]
Source/WebCore/svg/properties/SVGAttributeOwnerProxy.h
Source/WebCore/svg/properties/SVGAttributeOwnerProxyImpl.h

index acf1ae8..9bfefe1 100644 (file)
@@ -1,3 +1,14 @@
+2018-12-10  Brent Fulgham  <bfulgham@apple.com>
+
+        SVGViewSpec objects should mark relevant SVG elements
+        https://bugs.webkit.org/show_bug.cgi?id=192567
+        <rdar://problem/46491325>
+
+        Reviewed by Ryosuke Niwa.
+
+        * svg/animations/view-dependency-crash-expected.txt: Added.
+        * svg/animations/view-dependency-crash.html: Added.
+
 2018-12-10  Benjamin Poulain  <benjamin@webkit.org>
 
         <rdar://problem/45296285> Content blocker rule "raw" blocks media elements from loading
diff --git a/LayoutTests/svg/animations/view-dependency-crash-expected.txt b/LayoutTests/svg/animations/view-dependency-crash-expected.txt
new file mode 100644 (file)
index 0000000..9ad40cf
--- /dev/null
@@ -0,0 +1,2 @@
+This test passes if it does not crash
+
diff --git a/LayoutTests/svg/animations/view-dependency-crash.html b/LayoutTests/svg/animations/view-dependency-crash.html
new file mode 100644 (file)
index 0000000..efd0a01
--- /dev/null
@@ -0,0 +1,24 @@
+<!DOCTYPE html>
+<html>
+<head>
+    <script src="../../resources/gc.js"></script>
+</head>
+<body onload="runTest()">
+This test passes if it does not crash<br/>
+<script>
+if (window.testRunner)
+  testRunner.dumpAsText();
+
+function runTest() {
+    var svg = document.createElementNS("http://www.w3.org/2000/svg", "svg");
+    var view = svg.currentView;
+    svg.pauseAnimations();
+    svg = null;
+    if (window.gc)
+        gc();
+    var rect = document.createElementNS("http://www.w3.org/2000/svg", "rect");
+    var viewBox = view.viewBox;
+}
+</script>
+</body>
+</html>
index d55624c..6bc3338 100644 (file)
@@ -1,3 +1,38 @@
+2018-12-10  Brent Fulgham  <bfulgham@apple.com>
+
+        SVGViewSpec objects should mark relevant SVG elements
+        https://bugs.webkit.org/show_bug.cgi?id=192567
+        <rdar://problem/46491325>
+
+        Reviewed by Ryosuke Niwa.
+
+        SVGViewSpec elements reflect the state of an underlying SVGElement. Teach the mark algorithm to
+        recognize the relevant SVGElement as active as long as the SVGViewSpec is active.
+
+        Update SVGElement so that it can vend WeakPtrs. I also noticed that SVGAttributeOwner used a bare
+        pointer to the SVGElement, so switched to a WeakPtr.
+
+        Test: svg/animations/view-dependency-crash.html
+
+        * Sources.txt: Add new files.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * bindings/js/JSSVGViewSpecCustom.cpp: Added.
+        (WebCore::JSSVGViewSpec::visitAdditionalChildren):
+        * svg/SVGElement.h:
+        * svg/SVGPathElement.h:
+        * svg/SVGViewSpec.cpp:
+        (WebCore::SVGViewSpec::SVGViewSpec): Hold a weak pointer (rather than a bare pointer) to the underlying element.
+        * svg/SVGViewSpec.h:
+        * svg/SVGViewSpec.idl:
+        * svg/properties/SVGAttributeOwnerProxy.cpp: Added.
+        (WebCore::SVGAttributeOwnerProxy::SVGAttributeOwnerProxy): Hold a weak pointer (rather than a bare pointer) to
+        the underling SVGElement.
+        (WebCore::SVGAttributeOwnerProxy::element const): Ditto.
+        * svg/properties/SVGAttributeOwnerProxy.h:
+        (WebCore::SVGAttributeOwnerProxy::SVGAttributeOwnerProxy): Move implementation to cpp file.
+        (WebCore::SVGAttributeOwnerProxy::element const): Ditto.
+        * svg/properties/SVGAttributeOwnerProxyImpl.h: Update for WeakPtr use.
+
 2018-12-10  Benjamin Poulain  <benjamin@webkit.org>
 
         <rdar://problem/45296285> Content blocker rule "raw" blocks media elements from loading
index 6a9882d..7349487 100644 (file)
@@ -468,6 +468,7 @@ bindings/js/JSReadableStreamSourceCustom.cpp
 bindings/js/JSRemoteDOMWindowBase.cpp
 bindings/js/JSRemoteDOMWindowCustom.cpp
 bindings/js/JSSVGPathSegCustom.cpp
+bindings/js/JSSVGViewSpecCustom.cpp
 bindings/js/JSStyleSheetCustom.cpp
 bindings/js/JSServiceWorkerClientCustom.cpp
 bindings/js/JSServiceWorkerGlobalScopeCustom.cpp
@@ -2342,6 +2343,7 @@ svg/graphics/filters/SVGFilterBuilder.cpp
 
 svg/properties/SVGAnimatedPathSegListPropertyTearOff.cpp
 svg/properties/SVGAnimatedProperty.cpp
+svg/properties/SVGAttributeOwnerProxy.cpp
 
 workers/AbstractWorker.cpp
 workers/DedicatedWorkerGlobalScope.cpp
index df2c955..5e1ec89 100644 (file)
                7A29BA67187B732200F29CEB /* TemporaryOpenGLSetting.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = TemporaryOpenGLSetting.h; sourceTree = "<group>"; };
                7A29BA69187B781C00F29CEB /* TemporaryOpenGLSetting.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = TemporaryOpenGLSetting.cpp; sourceTree = "<group>"; };
                7A29F57118C69514004D0F81 /* OutOfBandTextTrackPrivateAVF.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = OutOfBandTextTrackPrivateAVF.h; sourceTree = "<group>"; };
+               7A3EBEAA21BF054C000D043D /* JSSVGViewSpecCustom.cpp */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.cpp; path = JSSVGViewSpecCustom.cpp; sourceTree = "<group>"; };
+               7A3EBEAC21BF0921000D043D /* SVGAttributeOwnerProxy.cpp */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.cpp; path = SVGAttributeOwnerProxy.cpp; sourceTree = "<group>"; };
                7A45032D18DB717200377B34 /* BufferedLineReader.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = BufferedLineReader.cpp; sourceTree = "<group>"; };
                7A45032E18DB717200377B34 /* BufferedLineReader.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = BufferedLineReader.h; sourceTree = "<group>"; };
                7A54857D14E02D51006AE05A /* InspectorHistory.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InspectorHistory.cpp; sourceTree = "<group>"; };
                                085A15921289A8DD002710E3 /* SVGAnimatedTransformListPropertyTearOff.h */,
                                55FA7FEF210FA386005AEFE7 /* SVGAttribute.h */,
                                55FA7FF4210FB688005AEFE7 /* SVGAttributeAccessor.h */,
+                               7A3EBEAC21BF0921000D043D /* SVGAttributeOwnerProxy.cpp */,
                                55346AF021150FAF0059BCDD /* SVGAttributeOwnerProxy.h */,
                                55346AFA2117FFAF0059BCDD /* SVGAttributeOwnerProxyImpl.h */,
                                55FA7FF6210FBE3E005AEFE7 /* SVGAttributeRegistry.h */,
                                4B6B5CBE216434FB00603817 /* JSPaintWorkletGlobalScopeCustom.cpp */,
                                418C395D1C8F0AAB0051C8A3 /* JSReadableStreamSourceCustom.cpp */,
                                46BCBBBE2085005B00710638 /* JSRemoteDOMWindowCustom.cpp */,
+                               7A3EBEAA21BF054C000D043D /* JSSVGViewSpecCustom.cpp */,
                        );
                        name = Custom;
                        sourceTree = "<group>";
                                11310CF620BA4A560065A8D0 /* LayoutChildIterator.h in Headers */,
                                1199FA46208E35A3002358CC /* LayoutContainer.h in Headers */,
                                11310CF520BA4A4C0065A8D0 /* LayoutDescendantIterator.h in Headers */,
-                               6F7CA3C6208C2957002F29AB /* LayoutState.h in Headers */,
                                1199FA53208E38D3002358CC /* LayoutInlineBox.h in Headers */,
                                1199FA4F208E3899002358CC /* LayoutInlineContainer.h in Headers */,
                                11310CF420BA4A3D0065A8D0 /* LayoutIterator.h in Headers */,
                                A12538D413F9B60A00024754 /* LayoutRepainter.h in Headers */,
                                11310CF320BA4A370065A8D0 /* LayoutReplaced.h in Headers */,
                                141DC054164834B900371E5A /* LayoutSize.h in Headers */,
-                               2D9066070BE141D400956998 /* RenderLayoutState.h in Headers */,
+                               6F7CA3C6208C2957002F29AB /* LayoutState.h in Headers */,
                                11310CF220BA4A320065A8D0 /* LayoutTreeBuilder.h in Headers */,
                                141DC0481648348F00371E5A /* LayoutUnit.h in Headers */,
                                CDE8B5ED1A69777300B4B66A /* LegacyCDMPrivateClearKey.h in Headers */,
                                0F580CFF0F12DE9B0051D689 /* RenderLayerBacking.h in Headers */,
                                0F580CFD0F12DE9B0051D689 /* RenderLayerCompositor.h in Headers */,
                                3C244FEAA375AC633F88BE6F /* RenderLayerModelObject.h in Headers */,
+                               2D9066070BE141D400956998 /* RenderLayoutState.h in Headers */,
                                0BE030A20F3112FB003C1A46 /* RenderLineBoxList.h in Headers */,
                                BCEA4864097D93020094C9E4 /* RenderLineBreak.h in Headers */,
                                ABB5419F0ACDDFE4002820EB /* RenderListBox.h in Headers */,
diff --git a/Source/WebCore/bindings/js/JSSVGViewSpecCustom.cpp b/Source/WebCore/bindings/js/JSSVGViewSpecCustom.cpp
new file mode 100644 (file)
index 0000000..f1ca384
--- /dev/null
@@ -0,0 +1,39 @@
+/*
+ * Copyright (C) 2018 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSSVGViewSpec.h"
+
+#include "JSNode.h"
+
+namespace WebCore {
+
+void JSSVGViewSpec::visitAdditionalChildren(JSC::SlotVisitor& visitor)
+{
+    ASSERT(wrapped().contextElementConcurrently().get());
+    visitor.addOpaqueRoot(root(wrapped().contextElementConcurrently().get()));
+}
+
+}
index 34bd9e0..f8339e4 100644 (file)
@@ -31,6 +31,7 @@
 #include "StyledElement.h"
 #include <wtf/HashMap.h>
 #include <wtf/HashSet.h>
+#include <wtf/WeakPtr.h>
 
 namespace WebCore {
 
@@ -45,7 +46,7 @@ class SVGUseElement;
 
 void mapAttributeToCSSProperty(HashMap<AtomicStringImpl*, CSSPropertyID>* propertyNameToIdMap, const QualifiedName& attrName);
 
-class SVGElement : public StyledElement, public SVGLangSpace {
+class SVGElement : public StyledElement, public SVGLangSpace, public CanMakeWeakPtr<SVGElement> {
     WTF_MAKE_ISO_ALLOCATED(SVGElement);
 public:
     bool isOutermostSVGSVGElement() const;
index 6c45a1b..667a620 100644 (file)
@@ -55,7 +55,7 @@ class SVGPathSegCurvetoQuadraticSmoothRel;
 class SVGPathSegList;
 class SVGPoint;
 
-class SVGPathElement final : public SVGGeometryElement, public SVGExternalResourcesRequired, public CanMakeWeakPtr<SVGPathElement> {
+class SVGPathElement final : public SVGGeometryElement, public SVGExternalResourcesRequired {
     WTF_MAKE_ISO_ALLOCATED(SVGPathElement);
 public:
     static Ref<SVGPathElement> create(const QualifiedName&, Document&);
index caea7ca..9af8783 100644 (file)
@@ -34,7 +34,7 @@ namespace WebCore {
 
 SVGViewSpec::SVGViewSpec(SVGElement& contextElement)
     : SVGFitToViewBox(&contextElement, PropertyIsReadOnly)
-    , m_contextElement(&contextElement)
+    , m_contextElement(makeWeakPtr(contextElement))
     , m_attributeOwnerProxy(*this, contextElement)
 {
     registerAttributes();
index b884996..b6fd7bc 100644 (file)
@@ -49,6 +49,8 @@ public:
     RefPtr<SVGTransformList> transform();
     SVGTransformListValues transformValue() const { return m_transform.value(); }
 
+    const WeakPtr<SVGElement>& contextElementConcurrently() const { return m_contextElement; }
+
 private:
     explicit SVGViewSpec(SVGElement&);
 
@@ -58,7 +60,7 @@ private:
     static AttributeOwnerProxy::AttributeRegistry& attributeRegistry() { return AttributeOwnerProxy::attributeRegistry(); }
     static bool isKnownAttribute(const QualifiedName& attributeName) { return AttributeOwnerProxy::isKnownAttribute(attributeName); }
 
-    SVGElement* m_contextElement;
+    WeakPtr<SVGElement> m_contextElement;
     String m_viewTargetString;
     AttributeOwnerProxy m_attributeOwnerProxy;
     SVGAnimatedTransformListAttribute m_transform;
index 4411d57..012c9e1 100644 (file)
@@ -28,6 +28,7 @@
 // It would require that any of those classes would be RefCounted, and we want to avoid that.
 [
     ImplementationLacksVTable,
+    JSCustomMarkFunction,
     JSGenerateToJSObject,
 ] interface SVGViewSpec {
     readonly attribute SVGTransformList transform;
diff --git a/Source/WebCore/svg/properties/SVGAttributeOwnerProxy.cpp b/Source/WebCore/svg/properties/SVGAttributeOwnerProxy.cpp
new file mode 100644 (file)
index 0000000..840233b
--- /dev/null
@@ -0,0 +1,43 @@
+/*
+ * Copyright (C) 2018 Apple Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "config.h"
+#include "SVGAttributeOwnerProxy.h"
+
+namespace WebCore {
+
+SVGAttributeOwnerProxy::SVGAttributeOwnerProxy(SVGElement& element)
+    : m_element(makeWeakPtr(element))
+{
+}
+
+SVGElement& SVGAttributeOwnerProxy::element() const
+{
+    return *m_element;
+}
+
+}
index 00d03b0..c6b6821 100644 (file)
@@ -26,6 +26,7 @@
 #pragma once
 
 #include "SVGAnimatedPropertyType.h"
+#include <wtf/WeakPtr.h>
 
 namespace WebCore {
 
@@ -35,14 +36,11 @@ class SVGElement;
 
 class SVGAttributeOwnerProxy {
 public:
-    SVGAttributeOwnerProxy(SVGElement& element)
-        : m_element(element)
-    {
-    }
+    SVGAttributeOwnerProxy(SVGElement&);
 
     virtual ~SVGAttributeOwnerProxy() = default;
 
-    SVGElement& element() const { return m_element; }
+    SVGElement& element() const;
 
     virtual void synchronizeAttributes() const = 0;
     virtual void synchronizeAttribute(const QualifiedName&) const = 0;
@@ -54,7 +52,7 @@ public:
     virtual Vector<RefPtr<SVGAnimatedProperty>> lookupOrCreateAnimatedProperties(const QualifiedName&) const = 0;
 
 protected:
-    SVGElement& m_element;
+    WeakPtr<SVGElement> m_element;
 };
 
 }
index 51d21ec..2dd22bb 100644 (file)
@@ -68,12 +68,12 @@ public:
 private:
     void synchronizeAttributes() const override
     {
-        attributeRegistry().synchronizeAttributes(m_owner, m_element);
+        attributeRegistry().synchronizeAttributes(m_owner, *m_element);
     }
 
     void synchronizeAttribute(const QualifiedName& attributeName) const override
     {
-        attributeRegistry().synchronizeAttribute(m_owner, m_element, attributeName);
+        attributeRegistry().synchronizeAttribute(m_owner, *m_element, attributeName);
     }
 
     Vector<AnimatedPropertyType> animatedTypes(const QualifiedName& attributeName) const override
@@ -83,17 +83,17 @@ private:
 
     RefPtr<SVGAnimatedProperty> lookupOrCreateAnimatedProperty(const SVGAttribute& attribute) const override
     {
-        return attributeRegistry().lookupOrCreateAnimatedProperty(m_owner, m_element, attribute, m_animatedState);
+        return attributeRegistry().lookupOrCreateAnimatedProperty(m_owner, *m_element, attribute, m_animatedState);
     }
 
     RefPtr<SVGAnimatedProperty> lookupAnimatedProperty(const SVGAttribute& attribute) const override
     {
-        return attributeRegistry().lookupAnimatedProperty(m_owner, m_element, attribute);
+        return attributeRegistry().lookupAnimatedProperty(m_owner, *m_element, attribute);
     }
 
     Vector<RefPtr<SVGAnimatedProperty>> lookupOrCreateAnimatedProperties(const QualifiedName& attributeName) const override
     {
-        return attributeRegistry().lookupOrCreateAnimatedProperties(m_owner, m_element, attributeName, m_animatedState);
+        return attributeRegistry().lookupOrCreateAnimatedProperties(m_owner, *m_element, attributeName, m_animatedState);
     }
 
     OwnerType& m_owner;