2009-11-13 Vitaly Repeshko <vitalyr@chromium.org>
authoreric@webkit.org <eric@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Fri, 13 Nov 2009 19:56:43 +0000 (19:56 +0000)
committereric@webkit.org <eric@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Fri, 13 Nov 2009 19:56:43 +0000 (19:56 +0000)
commit5da9c8160ac63bb416cc92b9bc18e6a10c919685
tree3833355bc9cb2f74896f93615af4286bb210fb0b
parent9481b9470f3cbc9565d8c17c073efaaa63fdfab7
2009-11-13  Vitaly Repeshko  <vitalyr@chromium.org>

        Reviewed by Dimitri Glazkov.

        [V8] Protect SVG animated properties from destruction in bindings.
        https://bugs.webkit.org/show_bug.cgi?id=31474

        See http://crbug.com/26719.

        Tested by LayoutTests/svg/custom/js-update-transform-addition.svg
        under Valgrind.

        Made sure we keep a reference to SVG properties while setting a
        context:
        * bindings/scripts/CodeGeneratorV8.pm:
        * bindings/v8/V8Proxy.h:
        (WebCore::V8Proxy::withSVGContext):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@50958 268f45cc-cd09-0410-ab3c-d52691b4dbfc
WebCore/ChangeLog
WebCore/bindings/scripts/CodeGeneratorV8.pm
WebCore/bindings/v8/V8Proxy.h