nephele
/
haikuwebkit
1
0
Fork 0
Code Issues Releases Activity
haikuwebkit/LayoutTests/svg/custom/tref-nested-events-crash-ex...

2 lines
21 B
Plaintext
Raw Permalink Normal View History

[SVG] Tref target event listener cleanup https://bugs.webkit.org/show_bug.cgi?id=93004 Reviewed by Abhishek Arya. Source/WebCore: Currently SVGTRefElement allocates event listeners dynamically as it attaches to its targets. Synchronizing the lifetime of the target listener vs. the tref element is error prone, as various events can stack and trigger nested handlers. In order to reduce complexity and address a couple of outstanding issues, this patch changes the way event listeners are allocated: only one target listener is created for the lifetime of the SVGTRefElement, and gets reused if the target element changes. Test: svg/custom/tref-nested-events-crash.svg * dom/EventListener.h: Added new <tref> target event listener type. * svg/SVGTRefElement.cpp: (WebCore): (WebCore::SVGTRefTargetEventListener::create): (WebCore::SVGTRefTargetEventListener::cast): (SVGTRefTargetEventListener): (WebCore::SVGTRefTargetEventListener::isAttached): (WebCore::SVGTRefTargetEventListener::SVGTRefTargetEventListener): (WebCore::SVGTRefTargetEventListener::attach): (WebCore::SVGTRefTargetEventListener::detach): (WebCore::SVGTRefTargetEventListener::operator==): (WebCore::SVGTRefTargetEventListener::handleEvent): No need to check m_trefElement anymore - the listener is allocated for the whole element lifetime, detached when the element is removed and deallocated when the element is destroyed. (WebCore::SVGTRefElement::SVGTRefElement): Allocate one target listener per element, at construction time. (WebCore::SVGTRefElement::~SVGTRefElement): Detach the listener if necessary. (WebCore::SVGTRefElement::detachTarget): Check whether the element is still in document after updating the text (may have been removed by event handlers). (WebCore::SVGTRefElement::buildPendingResource): Attach the event listener before updating the text content to avoid racing with event handlers (which can remove the element). (WebCore::SVGTRefElement::removedFrom): * svg/SVGTRefElement.h: (WebCore): (SVGTRefElement): LayoutTests: * svg/custom/tref-nested-events-crash-expected.txt: Added. * svg/custom/tref-nested-events-crash.svg: Added. Canonical link: https://commits.webkit.org/111020@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@124681 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2012-08-04 01:23:58 +00:00
PASS: did not crash.