2009-11-13 Vitaly Repeshko <vitalyr@chromium.org>
[WebKit-https.git] / WebCore / ChangeLog
index 548ad42059fe3544762622553fd112fc51b74ae4..18714af49b0f985d63e5e5548521c3d35b3991f1 100644 (file)
@@ -1,3 +1,21 @@
+2009-11-13  Vitaly Repeshko  <vitalyr@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Protect SVG animated properties from destruction in bindings.
+        https://bugs.webkit.org/show_bug.cgi?id=31474
+
+        See http://crbug.com/26719.
+
+        Tested by LayoutTests/svg/custom/js-update-transform-addition.svg
+        under Valgrind.
+
+        Made sure we keep a reference to SVG properties while setting a
+        context:
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/V8Proxy.h:
+        (WebCore::V8Proxy::withSVGContext):
+
 2009-11-13  Brent Fulgham  <bfulgham@webkit.org>
 
         Reviewed by Alexey Proskuryakov.