Fix lifetime handling of SVGPropertyTearOffs
[WebKit-https.git] / Source / WebCore / ChangeLog
index 5d4ab53c229cbd2d132e0c885ee3c8cddd20d913..34e7c7f4b8bb9aa7638b03a6468e3a6af1ee9812 100644 (file)
@@ -1,3 +1,40 @@
+2014-03-01  David Kilzer  <ddkilzer@apple.com>
+
+        Fix lifetime handling of SVGPropertyTearOffs
+        <http://webkit.org/b/129211>
+        <rdar://problem/15696025>
+
+        Reviewed by Maciej Stachowiak.
+
+        Merged from Blink (patch by Ojan Vafai):
+        https://src.chromium.org/viewvc/blink?revision=157801&view=revision
+        http://crbug.com/288771
+
+            -Replace SVGStaticPropertyWithParentTearOff with SVGMatrixTearOff
+            since it's only used in that one place. This means we can get rid
+            of the templatizing and the method pointer.
+            -Change SVGPropertyTearOff to keep track of it's child tearoffs
+            and call detachWrapper on its child tearoffs when it's destroyed
+            or when it's wrapper is detached.
+            -Have SVGPropertyTearOff hold WeakPtrs to the child tearoffs
+            to avoid having a cycle.
+
+        Test: svg/transforms/svg-matrix-tearoff-crash.html
+
+        * GNUmakefile.list.am:
+        * WebCore.vcxproj/WebCore.vcxproj:
+        * WebCore.vcxproj/WebCore.vcxproj.filters:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (NativeToJSValue):
+        * svg/properties/SVGMatrixTearOff.h: Renamed from Source/WebCore/svg/properties/SVGStaticPropertyWithParentTearOff.h.
+        (WebCore::SVGMatrixTearOff::create):
+        (WebCore::SVGMatrixTearOff::commitChange):
+        (WebCore::SVGMatrixTearOff::SVGMatrixTearOff):
+        * svg/properties/SVGPropertyTearOff.h:
+        (WebCore::SVGPropertyTearOff::addChild):
+        (WebCore::SVGPropertyTearOff::detachChildren):
+
 2014-03-01  Zan Dobersek  <zdobersek@igalia.com>
 
         Unreviewed build fix after r164913.