haikuwebkit/LayoutTests/svg/custom/use-crash-using-children-be...

PASS if no crash/assert
Clear SVGElementInstance's children immediately upon detachment https://bugs.webkit.org/show_bug.cgi?id=63739 <rdar://problem/9705708> Patch by Tim Horton <timothy_horton@apple.com> on 2011-07-14 Reviewed by Nikolas Zimmermann. In addition to clearing the instance's children in the destructor, clear them when the instance is detached from its <use>. This way, we won't attempt to use them after we're detached but before the destructor has been called. Source/WebCore: Test: svg/custom/use-crash-using-children-before-destroy.svg * svg/SVGElementInstance.cpp: (WebCore::SVGElementInstance::~SVGElementInstance): (WebCore::SVGElementInstance::clearChildren): * svg/SVGElementInstance.h: * svg/SVGUseElement.cpp: (WebCore::SVGUseElement::detachInstance): LayoutTests: * svg/custom/use-crash-using-children-before-destroy-expected.txt: Added. * svg/custom/use-crash-using-children-before-destroy.svg: Added. Canonical link: https://commits.webkit.org/80262@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@91005 268f45cc-cd09-0410-ab3c-d52691b4dbfc 2011-07-14 16:57:44 +00:00			`PASS if no crash/assert`