2011-02-24 Dirk Schulze <krit@webkit.org>
authorkrit@webkit.org <krit@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Thu, 24 Feb 2011 16:22:46 +0000 (16:22 +0000)
committerkrit@webkit.org <krit@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Thu, 24 Feb 2011 16:22:46 +0000 (16:22 +0000)
commit1318bd53f47fb26c76edacced86c78884a5673d6
tree24df852a03750bf073857bb79cd7479f7feb4bc1
parent66b0fde8fcaa55b472ef9d0b62e0511649452dd1
2011-02-24  Dirk Schulze  <krit@webkit.org>

        Reviewed by Darin Adler.

        Removing a SVG animation target during animation crashes WebKit
        https://bugs.webkit.org/show_bug.cgi?id=12065

        SVGAnimations with IRI references via 'xlink:href' are slow
        https://bugs.webkit.org/show_bug.cgi?id=49437

        Test that WebKit does not crash, if the target element of a SVG animation gets removed, or if
        its id changed.

        * platform/mac/svg/custom/animate-target-id-changed-expected.checksum: Added.
        * platform/mac/svg/custom/animate-target-id-changed-expected.png: Added.
        * platform/mac/svg/custom/animate-target-id-changed-expected.txt: Added.
        * platform/mac/svg/custom/animate-target-removed-from-document-expected.checksum: Added.
        * platform/mac/svg/custom/animate-target-removed-from-document-expected.png: Added.
        * platform/mac/svg/custom/animate-target-removed-from-document-expected.txt: Added.
        * svg/custom/animate-target-id-changed.svg: Added.
        * svg/custom/animate-target-removed-from-document.svg: Added.
2011-02-24  Dirk Schulze  <krit@webkit.org>

        Reviewed by Darin Adler.

        Removing a SVG animation target during animation crashes WebKit
        https://bugs.webkit.org/show_bug.cgi?id=12065

        SVGAnimations with IRI references via 'xlink:href' are slow
        https://bugs.webkit.org/show_bug.cgi?id=49437

        Store reference to target element for SVG animation elements. This is important if the
        target gets referenced via 'xlink:href'. At the moment we would call getElementById() multiple
        times on every animation step. A very expensive operation. This will be avoided with this patch.
        On the other hand, we need to be sure that the target element is always valid. The reference is
        reset, if the target was removed from document or its destructor was called. A HashMap in
        SVGDocumentExtensions stores all mappings from target element to all current animation elements.

        Tests: svg/custom/animate-target-id-changed.svg
               svg/custom/animate-target-removed-from-document.svg

        * svg/SVGDocumentExtensions.cpp:
        (WebCore::SVGDocumentExtensions::~SVGDocumentExtensions):
        (WebCore::SVGDocumentExtensions::addAnimationElementToTarget): New animation gets applied to target.
        (WebCore::SVGDocumentExtensions::removeAnimationElementFromTarget): Animation stoped, remove it from HashMap.
        (WebCore::SVGDocumentExtensions::removeAllAnimationElementsFromTarget): Target no longer in document, reset all
        references in SVG animation elements.
        * svg/SVGDocumentExtensions.h:
        * svg/SVGElement.cpp:
        (WebCore::SVGElement::~SVGElement):
        (WebCore::SVGElement::removedFromDocument):
        (WebCore::SVGElement::attributeChanged):
        * svg/SVGElement.h:
        * svg/SVGHKernElement.cpp:
        (WebCore::SVGHKernElement::removedFromDocument):
        * svg/SVGVKernElement.cpp:
        (WebCore::SVGVKernElement::removedFromDocument):
        * svg/animation/SVGSMILElement.cpp:
        (WebCore::SVGSMILElement::SVGSMILElement):
        (WebCore::SVGSMILElement::removedFromDocument):
        (WebCore::SVGSMILElement::eventBaseFor):
        (WebCore::SVGSMILElement::targetElement):
        * svg/animation/SVGSMILElement.h:
        (WebCore::SVGSMILElement::resetTargetElement):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@79569 268f45cc-cd09-0410-ab3c-d52691b4dbfc
18 files changed:
LayoutTests/ChangeLog
LayoutTests/platform/mac/svg/custom/animate-target-id-changed-expected.checksum [new file with mode: 0644]
LayoutTests/platform/mac/svg/custom/animate-target-id-changed-expected.png [new file with mode: 0644]
LayoutTests/platform/mac/svg/custom/animate-target-id-changed-expected.txt [new file with mode: 0644]
LayoutTests/platform/mac/svg/custom/animate-target-removed-from-document-expected.checksum [new file with mode: 0644]
LayoutTests/platform/mac/svg/custom/animate-target-removed-from-document-expected.png [new file with mode: 0644]
LayoutTests/platform/mac/svg/custom/animate-target-removed-from-document-expected.txt [new file with mode: 0644]
LayoutTests/svg/custom/animate-target-id-changed.svg [new file with mode: 0644]
LayoutTests/svg/custom/animate-target-removed-from-document.svg [new file with mode: 0644]
Source/WebCore/ChangeLog
Source/WebCore/svg/SVGDocumentExtensions.cpp
Source/WebCore/svg/SVGDocumentExtensions.h
Source/WebCore/svg/SVGElement.cpp
Source/WebCore/svg/SVGElement.h
Source/WebCore/svg/SVGHKernElement.cpp
Source/WebCore/svg/SVGVKernElement.cpp
Source/WebCore/svg/animation/SVGSMILElement.cpp
Source/WebCore/svg/animation/SVGSMILElement.h