REGRESSION (r179101): SVGUseElement::expandUseElementsInShadowTree has an object...
authordarin@apple.com <darin@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Tue, 27 Jan 2015 04:39:58 +0000 (04:39 +0000)
committerdarin@apple.com <darin@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Tue, 27 Jan 2015 04:39:58 +0000 (04:39 +0000)
commit09ff528a4c333ae03a6738166563e73049b08b01
tree7b1c899942ba15f911d562858f1b6cbb0c369879
parentbd10be16bd1a35ab3a9e38ee1ba007751c4159d6
REGRESSION (r179101): SVGUseElement::expandUseElementsInShadowTree has an object lifetime mistake
https://bugs.webkit.org/show_bug.cgi?id=140921

Reviewed by Alexey Proskuryakov.

Bug found by running regression tests with Address Sanitizer.

* svg/SVGUseElement.cpp:
(WebCore::SVGUseElement::expandUseElementsInShadowTree): Use a Ref to protect
the original use element after it's been replaced in the tree; we use it for
one more thing after that.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@179163 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Source/WebCore/ChangeLog
Source/WebCore/svg/SVGUseElement.cpp