Diff
Modified: branches/safari-601.1.46-branch/LayoutTests/ChangeLog (198245 => 198246)
--- branches/safari-601.1.46-branch/LayoutTests/ChangeLog 2016-03-16 00:02:05 UTC (rev 198245)
+++ branches/safari-601.1.46-branch/LayoutTests/ChangeLog 2016-03-16 00:22:02 UTC (rev 198246)
@@ -1,3 +1,21 @@
+2016-03-14 Matthew Hanson <matthew_han...@apple.com>
+
+ Merge r196268. rdar://problem/24748259
+
+ 2016-02-08 Said Abou-Hallawa <sabouhall...@apple.com>
+
+ REGRESSION(r181345): SVG polyline and polygon leak page
+ https://bugs.webkit.org/show_bug.cgi?id=152759
+
+ Reviewed by Darin Adler.
+
+ * TestExpectations: Remove flaky tests from test expectation.
+
+ * svg/animations/smil-leak-list-property-instances-expected.txt: Added.
+ * svg/animations/smil-leak-list-property-instances.svg: Added.
+ Ensure if SVGPolylineElement.points is requested from JS, the document will
+ not leak.
+
2016-02-16 Babak Shafiei <bshaf...@apple.com>
Merge patch for r192036 and r196679.
Modified: branches/safari-601.1.46-branch/LayoutTests/TestExpectations (198245 => 198246)
--- branches/safari-601.1.46-branch/LayoutTests/TestExpectations 2016-03-16 00:02:05 UTC (rev 198245)
+++ branches/safari-601.1.46-branch/LayoutTests/TestExpectations 2016-03-16 00:22:02 UTC (rev 198246)
@@ -503,12 +503,6 @@
# Content extensions are Mac-WK2-only for now
http/tests/contentextensions [ Skip ]
-# These tests were flaky on Mac only but they became flaky on all ports after r181345
-webkit.org/b/114280 svg/animations/smil-leak-dynamically-added-element-instances.svg [ Pass Failure ]
-webkit.org/b/114280 svg/animations/smil-leak-element-instances-noBaseValRef.svg [ Pass Failure ]
-webkit.org/b/114280 svg/animations/smil-leak-element-instances.svg [ Pass Failure ]
-webkit.org/b/114280 svg/animations/smil-leak-elements.svg [ Pass Failure ]
-
webkit.org/b/143085 media/track/track-mode.html [ Pass Timeout ]
# In ES6, Object type restrictions on a first parameter of several Object.* functions are relaxed.
Added: branches/safari-601.1.46-branch/LayoutTests/svg/animations/smil-leak-list-property-instances-expected.txt (0 => 198246)
--- branches/safari-601.1.46-branch/LayoutTests/svg/animations/smil-leak-list-property-instances-expected.txt (rev 0)
+++ branches/safari-601.1.46-branch/LayoutTests/svg/animations/smil-leak-list-property-instances-expected.txt 2016-03-16 00:22:02 UTC (rev 198246)
@@ -0,0 +1 @@
+PASS
Added: branches/safari-601.1.46-branch/LayoutTests/svg/animations/smil-leak-list-property-instances.svg (0 => 198246)
--- branches/safari-601.1.46-branch/LayoutTests/svg/animations/smil-leak-list-property-instances.svg (rev 0)
+++ branches/safari-601.1.46-branch/LayoutTests/svg/animations/smil-leak-list-property-instances.svg 2016-03-16 00:22:02 UTC (rev 198246)
@@ -0,0 +1,87 @@
+<svg id="svg" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" _onload_="load()">
+<defs>
+ <polyline id="polyline" points="20,20 80,20 80,80 20,80" />
+</defs>
+<g id="g"/>
+<text x="50" y="50" id="log"/>
+<script id="script">
+<![CDATA[
+
+var g = document.getElementById("g");
+
+function log(message) {
+ var logDiv = document.getElementById('log');
+ logDiv.appendChild(document.createTextNode(message));
+}
+
+function createAnimatedPolylineInstance() {
+ var use = document.createElementNS("http://www.w3.org/2000/svg", "use");
+ use.setAttributeNS("http://www.w3.org/1999/xlink", "href", "#polyline");
+
+ var anim = document.createElementNS("http://www.w3.org/2000/svg", "animate");
+ anim.setAttribute("attributeType", "XML");
+ anim.setAttribute("attributeName", "points");
+ anim.setAttribute("from", "20,20 80,20 80,80 20,80");
+ anim.setAttribute("to", "10,10 90,10 90,90 10,90");
+ anim.setAttribute("begin", "0s");
+ anim.setAttribute("dur", "10.0s");
+ anim.setAttribute("repeatCount", 1);
+
+ use.appendChild(anim);
+
+ return use;
+}
+
+function startTest() {
+ // Collect garbage before recording starting live node count, in case there are live elements from previous tests.
+ GCController.collect();
+ originalLiveElements = window.internals.numberOfLiveNodes();
+
+ // Hold references to points and animatedPoints on the root instance.
+ points = document.getElementById("polyline").points;
+ animatedPoints = document.getElementById("polyline").animatedPoints;
+
+ for (var i = 0; i < 100; i++)
+ g.appendChild(createAnimatedPolylineInstance());
+
+ setTimeout(continueTest, 0);
+}
+
+function continueTest() {
+ while (g.hasChildNodes())
+ g.removeChild(g.lastChild);
+
+ setTimeout(finishTest, 0);
+}
+
+var attemptsToFinish = 5;
+
+function finishTest() {
+ GCController.collect();
+
+ var liveDelta = window.internals.numberOfLiveNodes() - originalLiveElements;
+ if (liveDelta == 0)
+ log("PASS");
+ else if (--attemptsToFinish) {
+ setTimeout(finishTest, 100);
+ return;
+ } else
+ log("FAIL: " + liveDelta + " extra live node(s)");
+
+ testRunner.notifyDone();
+}
+
+function load() {
+ if (window.testRunner && window.GCController && window.internals) {
+ testRunner.dumpAsText();
+ testRunner.waitUntilDone();
+ } else {
+ log("This test only works when run with the testRunner, GCController, and internals available.");
+ return;
+ }
+
+ setTimeout(startTest, 0);
+}
+]]>
+</script>
+</svg>
Modified: branches/safari-601.1.46-branch/Source/WebCore/ChangeLog (198245 => 198246)
--- branches/safari-601.1.46-branch/Source/WebCore/ChangeLog 2016-03-16 00:02:05 UTC (rev 198245)
+++ branches/safari-601.1.46-branch/Source/WebCore/ChangeLog 2016-03-16 00:22:02 UTC (rev 198246)
@@ -1,3 +1,141 @@
+2016-03-14 Matthew Hanson <matthew_han...@apple.com>
+
+ Merge r196268. rdar://problem/24748259
+
+ 2016-02-08 Said Abou-Hallawa <sabouhall...@apple.com>
+
+ REGRESSION(r181345): SVG polyline and polygon leak page
+ https://bugs.webkit.org/show_bug.cgi?id=152759
+
+ Reviewed by Darin Adler.
+
+ The leak happens because of cyclic reference between SVGListPropertyTearOff
+ and SVGAnimatedListPropertyTearOff which is derived from SVGAnimatedProperty.
+ There is also cyclic reference between SVGAnimatedProperty and SVGElement
+ and this causes the whole document to be leaked. So if the JS requests, for
+ example, an instance of SVGPolylineElement.points, the whole document will be
+ leaked.
+
+ The fix depends on having the cyclic reference as is since the owning and the
+ owned classes have to live together if any of them is referenced. But the owning
+ class caches a raw 'ref-counted' pointer of the owned class. If it is requested
+ for an instance of the owned class it returned a RefPtr<> of it. Once the owned
+ class is not used, it can delete itself. The only thing needed here is to notify
+ the owner class of the deletion so it cleans its caches and be able to create a
+ new pointer if it is requested for an instance of the owned class later.
+
+ Revert the change of r181345 in SVGAnimatedProperty::lookupOrCreateWrapper()
+ to break the cyclic reference between SVGElement and SVGAnimatedProperty.
+
+ Also apply the same approach in SVGAnimatedListPropertyTearOff::baseVal() and
+ animVal() to break cyclic reference between SVGListPropertyTearOff and
+ SVGAnimatedListPropertyTearOff.
+
+ Test: svg/animations/smil-leak-list-property-instances.svg
+
+ * bindings/scripts/CodeGeneratorJS.pm:
+ (NativeToJSValue): The SVG non-string list tear-off properties became of
+ type RefPtr<>. So we need to use get() with the casting expressions.
+
+ * svg/SVGMarkerElement.cpp:
+ (WebCore::SVGMarkerElement::orientType):
+ Use 'auto' type for the return of SVGAnimatedProperty::lookupWrapper().
+
+ * svg/SVGPathElement.cpp:
+ (WebCore::SVGPathElement::pathByteStream):
+ (WebCore::SVGPathElement::lookupOrCreateDWrapper):
+ Since SVGAnimatedProperty::lookupWrappe() returns a RefPtr<> we need to
+ use get() for the casting expressions.
+
+ (WebCore::SVGPathElement::pathSegList):
+ (WebCore::SVGPathElement::normalizedPathSegList):
+ (WebCore::SVGPathElement::animatedPathSegList):
+ (WebCore::SVGPathElement::animatedNormalizedPathSegList):
+ * svg/SVGPathElement.h:
+ Change the return value from raw pointer to RefPtr<>.
+
+ * svg/SVGPathSegWithContext.h:
+ (WebCore::SVGPathSegWithContext::animatedProperty):
+ Change the return type to be RefPtr<> to preserve the value from being deleted.
+
+ * svg/SVGPolyElement.cpp:
+ (WebCore::SVGPolyElement::parseAttribute):
+ Since SVGAnimatedProperty::lookupWrapper() returns a RefPtr<> we need to
+ use get() for the casting expressions.
+
+ (WebCore::SVGPolyElement::points):
+ (WebCore::SVGPolyElement::animatedPoints):
+ * svg/SVGPolyElement.h:
+ Change the return value from raw pointer to RefPtr<>.
+
+ * svg/SVGViewSpec.cpp:
+ (WebCore::SVGViewSpec::setTransformString):
+ Since SVGAnimatedProperty::lookupWrapper() returns a RefPtr<> we need to
+ use get() for the casting expressions.
+
+ (WebCore::SVGViewSpec::transform):
+ * svg/SVGViewSpec.h:
+ Change the return value from raw pointer to RefPtr<>.
+
+ * svg/properties/SVGAnimatedListPropertyTearOff.h:
+ (WebCore::SVGAnimatedListPropertyTearOff::baseVal):
+ (WebCore::SVGAnimatedListPropertyTearOff::animVal):
+ Change the return value from raw pointer to RefPtr<> and change the cached
+ value from RefPtr<> to raw pointer. If the property is null, it will be
+ created, its raw pointer will be cached and the only ref-counted RefPtr<>
+ will be returned. This will guarantee, the RefPtr<> will be deleted once
+ it is not used anymore.
+
+ (WebCore::SVGAnimatedListPropertyTearOff::propertyWillBeDeleted):
+ Clean the raw pointer caches m_baseVal and m_animVal upon deleting the
+ actual pointer. This function will be called from the destructor of
+ SVGListPropertyTearOff.
+
+ (WebCore::SVGAnimatedListPropertyTearOff::findItem):
+ (WebCore::SVGAnimatedListPropertyTearOff::removeItemFromList):
+ We have to ensure the baseVal() is created before using it.
+
+ (WebCore::SVGAnimatedListPropertyTearOff::detachListWrappers):
+ (WebCore::SVGAnimatedListPropertyTearOff::currentAnimatedValue):
+ (WebCore::SVGAnimatedListPropertyTearOff::animationStarted):
+ (WebCore::SVGAnimatedListPropertyTearOff::animationEnded):
+ (WebCore::SVGAnimatedListPropertyTearOff::synchronizeWrappersIfNeeded):
+ (WebCore::SVGAnimatedListPropertyTearOff::animValWillChange):
+ (WebCore::SVGAnimatedListPropertyTearOff::animValDidChange):
+ For animation, a separate RefPtr<> 'm_animatingAnimVal' will be assigned
+ to the animVal(). This will prevent deleting m_animVal while animation.
+
+ * svg/properties/SVGAnimatedPathSegListPropertyTearOff.h:
+ (WebCore::SVGAnimatedPathSegListPropertyTearOff::baseVal):
+ (WebCore::SVGAnimatedPathSegListPropertyTearOff::animVal):
+ Same as what is done in SVGAnimatedListPropertyTearOff.
+
+ (WebCore::SVGAnimatedPathSegListPropertyTearOff::findItem):
+ (WebCore::SVGAnimatedPathSegListPropertyTearOff::removeItemFromList):
+ Same as what is done in SVGAnimatedListPropertyTearOff.
+
+ * svg/properties/SVGAnimatedProperty.h:
+ (WebCore::SVGAnimatedProperty::lookupOrCreateWrapper):
+ Change the return value from raw reference to Ref<> and change the
+ cached value from Ref<> to raw pointer. This reverts the change of
+ r181345 in this function.
+
+ (WebCore::SVGAnimatedProperty::lookupWrapper):
+ Change the return value from raw pointer to RefPtr<>.
+
+ * svg/properties/SVGAnimatedPropertyMacros.h:
+ Use 'auto' type for the return of SVGAnimatedProperty::lookupWrapper().
+
+ * svg/properties/SVGAnimatedTransformListPropertyTearOff.h:
+ (WebCore::SVGAnimatedTransformListPropertyTearOff::baseVal):
+ (WebCore::SVGAnimatedTransformListPropertyTearOff::animVal):
+ Same as what is done in SVGAnimatedListPropertyTearOff.
+
+ * svg/properties/SVGListPropertyTearOff.h:
+ (WebCore::SVGListPropertyTearOff::~SVGListPropertyTearOff):
+ Call the SVGAnimatedListPropertyTearOff::propertyWillBeDeleted() to clean
+ its raw pointers when the RefPtr<> deletes itself.
+
2016-02-12 Babak Shafiei <bshaf...@apple.com>
Merge r196401.
Modified: branches/safari-601.1.46-branch/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm (198245 => 198246)
--- branches/safari-601.1.46-branch/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm 2016-03-16 00:02:05 UTC (rev 198245)
+++ branches/safari-601.1.46-branch/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm 2016-03-16 00:22:02 UTC (rev 198246)
@@ -4050,7 +4050,11 @@
return "toJSNewlyCreated(exec, $globalObject, WTF::getPtr($value))";
}
- if ($codeGenerator->IsSVGAnimatedType($interfaceName) or $interfaceName eq "SVGViewSpec") {
+ # $type has to be used here because SVGViewSpec.transform is of type SVGTransformList.
+ if ($codeGenerator->IsSVGTypeNeedingTearOff($type) and $type =~ /(?<!String)List$/) {
+ # Convert from abstract RefPtr<ListProperty> to real type, so the right toJS() method can be invoked.
+ $value = "static_cast<" . GetNativeType($type) . ">($value" . ".get())";
+ } elsif ($codeGenerator->IsSVGAnimatedType($interfaceName) or $interfaceName eq "SVGViewSpec") {
# Convert from abstract SVGProperty to real type, so the right toJS() method can be invoked.
$value = "static_cast<" . GetNativeType($type) . ">($value)";
} elsif ($codeGenerator->IsSVGTypeNeedingTearOff($type) and not $interfaceName =~ /List$/) {
Modified: branches/safari-601.1.46-branch/Source/WebCore/svg/SVGMarkerElement.cpp (198245 => 198246)
--- branches/safari-601.1.46-branch/Source/WebCore/svg/SVGMarkerElement.cpp 2016-03-16 00:02:05 UTC (rev 198245)
+++ branches/safari-601.1.46-branch/Source/WebCore/svg/SVGMarkerElement.cpp 2016-03-16 00:22:02 UTC (rev 198246)
@@ -251,7 +251,7 @@
SVGMarkerOrientType& SVGMarkerElement::orientType() const
{
- if (SVGAnimatedEnumeration* wrapper = SVGAnimatedProperty::lookupWrapper<UseOwnerType, SVGAnimatedEnumeration>(this, orientTypePropertyInfo())) {
+ if (auto wrapper = SVGAnimatedProperty::lookupWrapper<UseOwnerType, SVGAnimatedEnumeration>(this, orientTypePropertyInfo())) {
if (wrapper->isAnimating()) {
ASSERT(wrapper->currentAnimatedValue() < SVGMarkerOrientMax);
return reinterpret_cast<SVGMarkerOrientType&>(wrapper->currentAnimatedValue());
Modified: branches/safari-601.1.46-branch/Source/WebCore/svg/SVGPathElement.cpp (198245 => 198246)
--- branches/safari-601.1.46-branch/Source/WebCore/svg/SVGPathElement.cpp 2016-03-16 00:02:05 UTC (rev 198245)
+++ branches/safari-601.1.46-branch/Source/WebCore/svg/SVGPathElement.cpp 2016-03-16 00:22:02 UTC (rev 198246)
@@ -295,10 +295,10 @@
SVGPathByteStream* SVGPathElement::pathByteStream() const
{
- SVGAnimatedProperty* property = SVGAnimatedProperty::lookupWrapper<SVGPathElement, SVGAnimatedPathSegListPropertyTearOff>(this, dPropertyInfo());
+ auto property = SVGAnimatedProperty::lookupWrapper<SVGPathElement, SVGAnimatedPathSegListPropertyTearOff>(this, dPropertyInfo());
if (!property || !property->isAnimating())
return m_pathByteStream.get();
- return static_cast<SVGAnimatedPathSegListPropertyTearOff*>(property)->animatedPathByteStream();
+ static_cast<SVGAnimatedPathSegListPropertyTearOff*>(property.get())->animatedPathByteStream();
}
Ref<SVGAnimatedProperty> SVGPathElement::lookupOrCreateDWrapper(SVGElement* contextElement)
@@ -306,7 +306,7 @@
ASSERT(contextElement);
SVGPathElement& ownerType = downcast<SVGPathElement>(*contextElement);
- if (SVGAnimatedProperty* property = SVGAnimatedProperty::lookupWrapper<SVGPathElement, SVGAnimatedPathSegListPropertyTearOff>(&ownerType, dPropertyInfo()))
+ if (auto property = SVGAnimatedProperty::lookupWrapper<SVGPathElement, SVGAnimatedPathSegListPropertyTearOff>(&ownerType, dPropertyInfo()))
return *property;
// Build initial SVGPathSegList.
@@ -325,29 +325,29 @@
ownerType.m_pathSegList.synchronize(&ownerType, dPropertyInfo()->attributeName, ownerType.m_pathSegList.value.valueAsString());
}
-SVGPathSegListPropertyTearOff* SVGPathElement::pathSegList()
+RefPtr<SVGPathSegListPropertyTearOff> SVGPathElement::pathSegList()
{
m_pathSegList.shouldSynchronize = true;
- return static_cast<SVGPathSegListPropertyTearOff*>(static_reference_cast<SVGAnimatedPathSegListPropertyTearOff>(lookupOrCreateDWrapper(this))->baseVal());
+ return static_cast<SVGPathSegListPropertyTearOff*>(static_reference_cast<SVGAnimatedPathSegListPropertyTearOff>(lookupOrCreateDWrapper(this))->baseVal().get());
}
-SVGPathSegListPropertyTearOff* SVGPathElement::normalizedPathSegList()
+RefPtr<SVGPathSegListPropertyTearOff> SVGPathElement::normalizedPathSegList()
{
// FIXME: https://bugs.webkit.org/show_bug.cgi?id=15412 - Implement normalized path segment lists!
- return 0;
+ return nullptr;
}
-SVGPathSegListPropertyTearOff* SVGPathElement::animatedPathSegList()
+RefPtr<SVGPathSegListPropertyTearOff> SVGPathElement::animatedPathSegList()
{
m_pathSegList.shouldSynchronize = true;
m_isAnimValObserved = true;
- return static_cast<SVGPathSegListPropertyTearOff*>(static_reference_cast<SVGAnimatedPathSegListPropertyTearOff>(lookupOrCreateDWrapper(this))->animVal());
+ return static_cast<SVGPathSegListPropertyTearOff*>(static_reference_cast<SVGAnimatedPathSegListPropertyTearOff>(lookupOrCreateDWrapper(this))->animVal().get());
}
-SVGPathSegListPropertyTearOff* SVGPathElement::animatedNormalizedPathSegList()
+RefPtr<SVGPathSegListPropertyTearOff> SVGPathElement::animatedNormalizedPathSegList()
{
// FIXME: https://bugs.webkit.org/show_bug.cgi?id=15412 - Implement normalized path segment lists!
- return 0;
+ return nullptr;
}
void SVGPathElement::pathSegListChanged(SVGPathSegRole role, ListModification listModification)
Modified: branches/safari-601.1.46-branch/Source/WebCore/svg/SVGPathElement.h (198245 => 198246)
--- branches/safari-601.1.46-branch/Source/WebCore/svg/SVGPathElement.h 2016-03-16 00:02:05 UTC (rev 198245)
+++ branches/safari-601.1.46-branch/Source/WebCore/svg/SVGPathElement.h 2016-03-16 00:22:02 UTC (rev 198246)
@@ -82,10 +82,10 @@
Ref<SVGPathSegCurvetoQuadraticSmoothRel> createSVGPathSegCurvetoQuadraticSmoothRel(float x, float y, SVGPathSegRole = PathSegUndefinedRole);
// Used in the bindings only.
- SVGPathSegListPropertyTearOff* pathSegList();
- SVGPathSegListPropertyTearOff* animatedPathSegList();
- SVGPathSegListPropertyTearOff* normalizedPathSegList();
- SVGPathSegListPropertyTearOff* animatedNormalizedPathSegList();
+ RefPtr<SVGPathSegListPropertyTearOff> pathSegList();
+ RefPtr<SVGPathSegListPropertyTearOff> animatedPathSegList();
+ RefPtr<SVGPathSegListPropertyTearOff> normalizedPathSegList();
+ RefPtr<SVGPathSegListPropertyTearOff> animatedNormalizedPathSegList();
SVGPathByteStream* pathByteStream() const;
Modified: branches/safari-601.1.46-branch/Source/WebCore/svg/SVGPathSegWithContext.h (198245 => 198246)
--- branches/safari-601.1.46-branch/Source/WebCore/svg/SVGPathSegWithContext.h 2016-03-16 00:02:05 UTC (rev 198245)
+++ branches/safari-601.1.46-branch/Source/WebCore/svg/SVGPathSegWithContext.h 2016-03-16 00:22:02 UTC (rev 198246)
@@ -32,7 +32,7 @@
{
}
- SVGAnimatedProperty* animatedProperty() const
+ RefPtr<SVGAnimatedProperty> animatedProperty() const
{
switch (m_role) {
case PathSegUndefinedRole:
Modified: branches/safari-601.1.46-branch/Source/WebCore/svg/SVGPolyElement.cpp (198245 => 198246)
--- branches/safari-601.1.46-branch/Source/WebCore/svg/SVGPolyElement.cpp 2016-03-16 00:02:05 UTC (rev 198245)
+++ branches/safari-601.1.46-branch/Source/WebCore/svg/SVGPolyElement.cpp 2016-03-16 00:22:02 UTC (rev 198246)
@@ -68,8 +68,8 @@
if (!pointsListFromSVGData(newList, value))
document().accessSVGExtensions().reportError("Problem parsing points=\"" + value + "\"");
- if (SVGAnimatedProperty* wrapper = SVGAnimatedProperty::lookupWrapper<SVGPolyElement, SVGAnimatedPointList>(this, pointsPropertyInfo()))
- static_cast<SVGAnimatedPointList*>(wrapper)->detachListWrappers(newList.size());
+ if (auto wrapper = SVGAnimatedProperty::lookupWrapper<SVGPolyElement, SVGAnimatedPointList>(this, pointsPropertyInfo()))
+ static_pointer_cast<SVGAnimatedPointList>(wrapper)->detachListWrappers(newList.size());
m_points.value = newList;
return;
@@ -118,16 +118,16 @@
(&ownerType, pointsPropertyInfo(), ownerType.m_points.value);
}
-SVGListPropertyTearOff<SVGPointList>* SVGPolyElement::points()
+RefPtr<SVGListPropertyTearOff<SVGPointList>> SVGPolyElement::points()
{
m_points.shouldSynchronize = true;
- return static_cast<SVGListPropertyTearOff<SVGPointList>*>(static_reference_cast<SVGAnimatedPointList>(lookupOrCreatePointsWrapper(this))->baseVal());
+ return static_cast<SVGListPropertyTearOff<SVGPointList>*>(static_reference_cast<SVGAnimatedPointList>(lookupOrCreatePointsWrapper(this))->baseVal().get());
}
-SVGListPropertyTearOff<SVGPointList>* SVGPolyElement::animatedPoints()
+RefPtr<SVGListPropertyTearOff<SVGPointList>> SVGPolyElement::animatedPoints()
{
m_points.shouldSynchronize = true;
- return static_cast<SVGListPropertyTearOff<SVGPointList>*>(static_reference_cast<SVGAnimatedPointList>(lookupOrCreatePointsWrapper(this))->animVal());
+ return static_cast<SVGListPropertyTearOff<SVGPointList>*>(static_reference_cast<SVGAnimatedPointList>(lookupOrCreatePointsWrapper(this))->animVal().get());
}
}
Modified: branches/safari-601.1.46-branch/Source/WebCore/svg/SVGPolyElement.h (198245 => 198246)
--- branches/safari-601.1.46-branch/Source/WebCore/svg/SVGPolyElement.h 2016-03-16 00:02:05 UTC (rev 198245)
+++ branches/safari-601.1.46-branch/Source/WebCore/svg/SVGPolyElement.h 2016-03-16 00:22:02 UTC (rev 198246)
@@ -31,8 +31,8 @@
class SVGPolyElement : public SVGGraphicsElement, public SVGExternalResourcesRequired {
public:
- SVGListPropertyTearOff<SVGPointList>* points();
- SVGListPropertyTearOff<SVGPointList>* animatedPoints();
+ RefPtr<SVGListPropertyTearOff<SVGPointList>> points();
+ RefPtr<SVGListPropertyTearOff<SVGPointList>> animatedPoints();
SVGPointList& pointList() const { return m_points.value; }
Modified: branches/safari-601.1.46-branch/Source/WebCore/svg/SVGViewSpec.cpp (198245 => 198246)
--- branches/safari-601.1.46-branch/Source/WebCore/svg/SVGViewSpec.cpp 2016-03-16 00:02:05 UTC (rev 198245)
+++ branches/safari-601.1.46-branch/Source/WebCore/svg/SVGViewSpec.cpp 2016-03-16 00:22:02 UTC (rev 198246)
@@ -114,8 +114,8 @@
SVGTransformList newList;
newList.parse(transform);
- if (SVGAnimatedProperty* wrapper = SVGAnimatedProperty::lookupWrapper<SVGElement, SVGAnimatedTransformList>(m_contextElement, transformPropertyInfo()))
- static_cast<SVGAnimatedTransformList*>(wrapper)->detachListWrappers(newList.size());
+ if (auto wrapper = SVGAnimatedProperty::lookupWrapper<SVGElement, SVGAnimatedTransformList>(m_contextElement, transformPropertyInfo()))
+ static_pointer_cast<SVGAnimatedTransformList>(wrapper)->detachListWrappers(newList.size());
m_transform = newList;
}
@@ -145,12 +145,12 @@
return downcast<SVGElement>(element);
}
-SVGTransformListPropertyTearOff* SVGViewSpec::transform()
+RefPtr<SVGTransformListPropertyTearOff> SVGViewSpec::transform()
{
if (!m_contextElement)
return nullptr;
// Return the animVal here, as its readonly by default - which is exactly what we want here.
- return static_cast<SVGTransformListPropertyTearOff*>(static_reference_cast<SVGAnimatedTransformList>(lookupOrCreateTransformWrapper(this))->animVal());
+ return static_pointer_cast<SVGTransformListPropertyTearOff>(static_reference_cast<SVGAnimatedTransformList>(lookupOrCreateTransformWrapper(this))->animVal());
}
RefPtr<SVGAnimatedRect> SVGViewSpec::viewBoxAnimated()
Modified: branches/safari-601.1.46-branch/Source/WebCore/svg/SVGViewSpec.h (198245 => 198246)
--- branches/safari-601.1.46-branch/Source/WebCore/svg/SVGViewSpec.h 2016-03-16 00:02:05 UTC (rev 198245)
+++ branches/safari-601.1.46-branch/Source/WebCore/svg/SVGViewSpec.h 2016-03-16 00:22:02 UTC (rev 198246)
@@ -68,7 +68,7 @@
void resetContextElement() { m_contextElement = nullptr; }
// Custom non-animated 'transform' property.
- SVGTransformListPropertyTearOff* transform();
+ RefPtr<SVGTransformListPropertyTearOff> transform();
SVGTransformList transformBaseValue() const { return m_transform; }
// Custom animated 'viewBox' property.
Modified: branches/safari-601.1.46-branch/Source/WebCore/svg/properties/SVGAnimatedListPropertyTearOff.h (198245 => 198246)
--- branches/safari-601.1.46-branch/Source/WebCore/svg/properties/SVGAnimatedListPropertyTearOff.h 2016-03-16 00:02:05 UTC (rev 198245)
+++ branches/safari-601.1.46-branch/Source/WebCore/svg/properties/SVGAnimatedListPropertyTearOff.h 2016-03-16 00:22:02 UTC (rev 198246)
@@ -39,35 +39,49 @@
typedef SVGListPropertyTearOff<PropertyType> ListPropertyTearOff;
typedef PropertyType ContentType;
- virtual ListProperty* baseVal()
+ virtual RefPtr<ListProperty> baseVal()
{
- if (!m_baseVal)
- m_baseVal = ListPropertyTearOff::create(this, BaseValRole, m_values, m_wrappers);
- return static_cast<ListProperty*>(m_baseVal.get());
+ if (m_baseVal)
+ return m_baseVal;
+
+ auto property = ListPropertyTearOff::create(this, BaseValRole, m_values, m_wrappers);
+ m_baseVal = property.ptr();
+ return WTF::move(property);
}
- virtual ListProperty* animVal()
+ virtual RefPtr<ListProperty> animVal()
{
- if (!m_animVal)
- m_animVal = ListPropertyTearOff::create(this, AnimValRole, m_values, m_wrappers);
- return static_cast<ListProperty*>(m_animVal.get());
+ if (m_animVal)
+ return m_animVal;
+
+ auto property = ListPropertyTearOff::create(this, AnimValRole, m_values, m_wrappers);
+ m_animVal = property.ptr();
+ return WTF::move(property);
}
+ void propertyWillBeDeleted(const ListProperty& property)
+ {
+ if (&property == m_baseVal)
+ m_baseVal = nullptr;
+ else if (&property == m_animVal)
+ m_animVal = nullptr;
+ }
+
virtual bool isAnimatedListTearOff() const override { return true; }
- int findItem(SVGProperty* property) const
+ int findItem(SVGProperty* property)
{
// This should ever be called for our baseVal, as animVal can't modify the list.
// It's safe to cast to ListPropertyTearOff here as all classes inheriting from us supply their own removeItemFromList() method.
typedef SVGPropertyTearOff<typename SVGPropertyTraits<PropertyType>::ListItemType> ListItemTearOff;
- return static_cast<ListPropertyTearOff*>(m_baseVal.get())->findItem(static_cast<ListItemTearOff*>(property));
+ return static_pointer_cast<ListPropertyTearOff>(baseVal())->findItem(static_cast<ListItemTearOff*>(property));
}
void removeItemFromList(size_t itemIndex, bool shouldSynchronizeWrappers)
{
// This should ever be called for our baseVal, as animVal can't modify the list.
// It's safe to cast to ListPropertyTearOff here as all classes inheriting from us supply their own removeItemFromList() method.
- static_cast<ListPropertyTearOff*>(m_baseVal.get())->removeItemFromList(itemIndex, shouldSynchronizeWrappers);
+ static_pointer_cast<ListPropertyTearOff>(baseVal())->removeItemFromList(itemIndex, shouldSynchronizeWrappers);
}
void detachListWrappers(unsigned newListSize)
@@ -78,8 +92,8 @@
PropertyType& currentAnimatedValue()
{
ASSERT(m_isAnimating);
- ASSERT(m_animVal);
- return static_cast<ListProperty*>(m_animVal.get())->values();
+ ASSERT(m_animatingAnimVal);
+ return static_pointer_cast<ListProperty>(m_animatingAnimVal)->values();
}
const PropertyType& currentBaseValue() const
@@ -90,6 +104,7 @@
void animationStarted(PropertyType* newAnimVal, bool shouldOwnValues = false)
{
ASSERT(!m_isAnimating);
+ ASSERT(!m_animatingAnimVal);
ASSERT(newAnimVal);
ASSERT(m_values.size() == m_wrappers.size());
ASSERT(m_animatedWrappers.isEmpty());
@@ -98,57 +113,55 @@
if (!newAnimVal->isEmpty())
m_animatedWrappers.fill(0, newAnimVal->size());
- ListProperty* animVal = static_cast<ListProperty*>(this->animVal());
- animVal->setValuesAndWrappers(newAnimVal, &m_animatedWrappers, shouldOwnValues);
- ASSERT(animVal->values().size() == animVal->wrappers().size());
- ASSERT(animVal->wrappers().size() == m_animatedWrappers.size());
+ m_animatingAnimVal = animVal();
+ m_animatingAnimVal->setValuesAndWrappers(newAnimVal, &m_animatedWrappers, shouldOwnValues);
+ ASSERT(m_animatingAnimVal->values().size() == m_animatingAnimVal->wrappers().size());
+ ASSERT(m_animatingAnimVal->wrappers().size() == m_animatedWrappers.size());
m_isAnimating = true;
}
void animationEnded()
{
ASSERT(m_isAnimating);
- ASSERT(m_animVal);
+ ASSERT(m_animatingAnimVal);
ASSERT(m_values.size() == m_wrappers.size());
- ListProperty* animVal = static_cast<ListProperty*>(m_animVal.get());
- ASSERT(animVal->values().size() == animVal->wrappers().size());
- ASSERT(animVal->wrappers().size() == m_animatedWrappers.size());
+ ASSERT(m_animatingAnimVal->values().size() == m_animatingAnimVal->wrappers().size());
+ ASSERT(m_animatingAnimVal->wrappers().size() == m_animatedWrappers.size());
- animVal->setValuesAndWrappers(&m_values, &m_wrappers, false);
- ASSERT(animVal->values().size() == animVal->wrappers().size());
- ASSERT(animVal->wrappers().size() == m_wrappers.size());
+ m_animatingAnimVal->setValuesAndWrappers(&m_values, &m_wrappers, false);
+ ASSERT(m_animatingAnimVal->values().size() == m_animatingAnimVal->wrappers().size());
+ ASSERT(m_animatingAnimVal->wrappers().size() == m_wrappers.size());
m_animatedWrappers.clear();
+ m_animatingAnimVal = nullptr;
m_isAnimating = false;
}
void synchronizeWrappersIfNeeded()
{
+ ASSERT(m_isAnimating);
+ ASSERT(m_animatingAnimVal);
+
// Eventually the wrapper list needs synchronization because any SVGAnimateLengthList::calculateAnimatedValue() call may
// mutate the length of our values() list, and thus the wrapper() cache needs synchronization, to have the same size.
// Also existing wrappers which point directly at elements in the existing SVGLengthList have to be detached (so a copy
// of them is created, so existing animVal variables in JS are kept-alive). If we'd detach them later the underlying
// SVGLengthList was already mutated, and our list item wrapper tear offs would point nowhere. Assertions would fire.
- ListProperty* animVal = static_cast<ListProperty*>(m_animVal.get());
- animVal->detachListWrappers(animVal->values().size());
+ m_animatingAnimVal->detachListWrappers(m_animatingAnimVal->values().size());
- ASSERT(animVal->values().size() == animVal->wrappers().size());
- ASSERT(animVal->wrappers().size() == m_animatedWrappers.size());
+ ASSERT(m_animatingAnimVal->values().size() == m_animatingAnimVal->wrappers().size());
+ ASSERT(m_animatingAnimVal->wrappers().size() == m_animatedWrappers.size());
}
void animValWillChange()
{
- ASSERT(m_isAnimating);
- ASSERT(m_animVal);
ASSERT(m_values.size() == m_wrappers.size());
synchronizeWrappersIfNeeded();
}
void animValDidChange()
{
- ASSERT(m_isAnimating);
- ASSERT(m_animVal);
ASSERT(m_values.size() == m_wrappers.size());
synchronizeWrappersIfNeeded();
}
@@ -173,8 +186,13 @@
ListWrapperCache m_wrappers;
ListWrapperCache m_animatedWrappers;
- RefPtr<SVGProperty> m_baseVal;
- RefPtr<SVGProperty> m_animVal;
+ // Cache the raw pointer but return a RefPtr<>. This will break the cyclic reference
+ // between SVGListPropertyTearOff and SVGAnimatedListPropertyTearOff once the property
+ // pointer is not needed.
+ ListProperty* m_baseVal { nullptr };
+ ListProperty* m_animVal { nullptr };
+
+ RefPtr<ListProperty> m_animatingAnimVal;
};
}
Modified: branches/safari-601.1.46-branch/Source/WebCore/svg/properties/SVGAnimatedPathSegListPropertyTearOff.h (198245 => 198246)
--- branches/safari-601.1.46-branch/Source/WebCore/svg/properties/SVGAnimatedPathSegListPropertyTearOff.h 2016-03-16 00:02:05 UTC (rev 198245)
+++ branches/safari-601.1.46-branch/Source/WebCore/svg/properties/SVGAnimatedPathSegListPropertyTearOff.h 2016-03-16 00:22:02 UTC (rev 198246)
@@ -31,32 +31,36 @@
class SVGAnimatedPathSegListPropertyTearOff : public SVGAnimatedListPropertyTearOff<SVGPathSegList> {
public:
- virtual SVGListProperty<SVGPathSegList>* baseVal() override
+ virtual RefPtr<ListProperty> baseVal() override
{
- if (!m_baseVal)
- m_baseVal = SVGPathSegListPropertyTearOff::create(this, BaseValRole, PathSegUnalteredRole, m_values, m_wrappers);
- return static_cast<SVGListProperty<SVGPathSegList>*>(m_baseVal.get());
+ if (m_baseVal)
+ return m_baseVal;
+
+ auto property = SVGPathSegListPropertyTearOff::create(this, BaseValRole, PathSegUnalteredRole, m_values, m_wrappers);
+ m_baseVal = property.ptr();
+ return WTFMove(property);
}
- virtual SVGListProperty<SVGPathSegList>* animVal() override
+ virtual RefPtr<ListProperty> animVal() override
{
- if (!m_animVal)
- m_animVal = SVGPathSegListPropertyTearOff::create(this, AnimValRole, PathSegUnalteredRole, m_values, m_wrappers);
- return static_cast<SVGListProperty<SVGPathSegList>*>(m_animVal.get());
+ if (m_animVal)
+ return m_animVal;
+
+ auto property = SVGPathSegListPropertyTearOff::create(this, AnimValRole, PathSegUnalteredRole, m_values, m_wrappers);
+ m_animVal = property.ptr();
+ return WTFMove(property);
}
- int findItem(const RefPtr<SVGPathSeg>& segment) const
+ int findItem(const RefPtr<SVGPathSeg>& segment)
{
// This should ever be called for our baseVal, as animVal can't modify the list.
- ASSERT(m_baseVal);
- return static_cast<SVGPathSegListPropertyTearOff*>(m_baseVal.get())->findItem(segment);
+ return static_cast<SVGPathSegListPropertyTearOff*>(baseVal().get())->findItem(segment);
}
void removeItemFromList(size_t itemIndex, bool shouldSynchronizeWrappers)
{
// This should ever be called for our baseVal, as animVal can't modify the list.
- ASSERT(m_baseVal);
- static_cast<SVGPathSegListPropertyTearOff*>(m_baseVal.get())->removeItemFromList(itemIndex, shouldSynchronizeWrappers);
+ static_cast<SVGPathSegListPropertyTearOff*>(baseVal().get())->removeItemFromList(itemIndex, shouldSynchronizeWrappers);
}
static Ref<SVGAnimatedPathSegListPropertyTearOff> create(SVGElement* contextElement, const QualifiedName& attributeName, AnimatedPropertyType animatedPropertyType, SVGPathSegList& values)
Modified: branches/safari-601.1.46-branch/Source/WebCore/svg/properties/SVGAnimatedProperty.h (198245 => 198246)
--- branches/safari-601.1.46-branch/Source/WebCore/svg/properties/SVGAnimatedProperty.h 2016-03-16 00:02:05 UTC (rev 198245)
+++ branches/safari-601.1.46-branch/Source/WebCore/svg/properties/SVGAnimatedProperty.h 2016-03-16 00:22:02 UTC (rev 198246)
@@ -48,22 +48,27 @@
virtual ~SVGAnimatedProperty();
template<typename OwnerType, typename TearOffType, typename PropertyType>
- static TearOffType& lookupOrCreateWrapper(OwnerType* element, const SVGPropertyInfo* info, PropertyType& property)
+ static Ref<TearOffType> lookupOrCreateWrapper(OwnerType* element, const SVGPropertyInfo* info, PropertyType& property)
{
ASSERT(info);
SVGAnimatedPropertyDescription key(element, info->propertyIdentifier);
- auto& slot = animatedPropertyCache()->add(key, nullptr).iterator->value;
- if (!slot) {
- Ref<SVGAnimatedProperty> wrapper = TearOffType::create(element, info->attributeName, info->animatedPropertyType, property);
- if (info->animatedPropertyState == PropertyIsReadOnly)
- wrapper->setIsReadOnly();
- slot = &wrapper.leakRef();
- }
- return static_cast<TearOffType&>(*slot);
+
+ auto result = animatedPropertyCache()->add(key, nullptr);
+ if (!result.isNewEntry)
+ return static_cast<TearOffType&>(*result.iterator->value);
+
+ Ref<SVGAnimatedProperty> wrapper = TearOffType::create(element, info->attributeName, info->animatedPropertyType, property);
+ if (info->animatedPropertyState == PropertyIsReadOnly)
+ wrapper->setIsReadOnly();
+
+ // Cache the raw pointer but return a Ref<>. This will break the cyclic reference
+ // between SVGAnimatedProperty and SVGElement once the property pointer is not needed.
+ result.iterator->value = wrapper.ptr();
+ return static_reference_cast<TearOffType>(wrapper);
}
template<typename OwnerType, typename TearOffType>
- static TearOffType* lookupWrapper(OwnerType* element, const SVGPropertyInfo* info)
+ static RefPtr<TearOffType> lookupWrapper(OwnerType* element, const SVGPropertyInfo* info)
{
ASSERT(info);
SVGAnimatedPropertyDescription key(element, info->propertyIdentifier);
@@ -71,7 +76,7 @@
}
template<typename OwnerType, typename TearOffType>
- static TearOffType* lookupWrapper(const OwnerType* element, const SVGPropertyInfo* info)
+ static RefPtr<TearOffType> lookupWrapper(const OwnerType* element, const SVGPropertyInfo* info)
{
return lookupWrapper<OwnerType, TearOffType>(const_cast<OwnerType*>(element), info);
}
Modified: branches/safari-601.1.46-branch/Source/WebCore/svg/properties/SVGAnimatedPropertyMacros.h (198245 => 198246)
--- branches/safari-601.1.46-branch/Source/WebCore/svg/properties/SVGAnimatedPropertyMacros.h 2016-03-16 00:02:05 UTC (rev 198245)
+++ branches/safari-601.1.46-branch/Source/WebCore/svg/properties/SVGAnimatedPropertyMacros.h 2016-03-16 00:22:02 UTC (rev 198246)
@@ -123,7 +123,7 @@
static const SVGPropertyInfo* LowerProperty##PropertyInfo(); \
PropertyType& LowerProperty() const \
{ \
- if (TearOffType* wrapper = SVGAnimatedProperty::lookupWrapper<UseOwnerType, TearOffType>(this, LowerProperty##PropertyInfo())) { \
+ if (auto wrapper = SVGAnimatedProperty::lookupWrapper<UseOwnerType, TearOffType>(this, LowerProperty##PropertyInfo())) { \
if (wrapper->isAnimating()) \
return wrapper->currentAnimatedValue(); \
} \
@@ -184,7 +184,7 @@
DECLARE_ANIMATED_PROPERTY(TearOffType, PropertyType, UpperProperty, LowerProperty, ) \
void detachAnimated##UpperProperty##ListWrappers(unsigned newListSize) \
{ \
- if (TearOffType* wrapper = SVGAnimatedProperty::lookupWrapper<UseOwnerType, TearOffType>(this, LowerProperty##PropertyInfo())) \
+ if (auto wrapper = SVGAnimatedProperty::lookupWrapper<UseOwnerType, TearOffType>(this, LowerProperty##PropertyInfo())) \
wrapper->detachListWrappers(newListSize); \
}
Modified: branches/safari-601.1.46-branch/Source/WebCore/svg/properties/SVGAnimatedTransformListPropertyTearOff.h (198245 => 198246)
--- branches/safari-601.1.46-branch/Source/WebCore/svg/properties/SVGAnimatedTransformListPropertyTearOff.h 2016-03-16 00:02:05 UTC (rev 198245)
+++ branches/safari-601.1.46-branch/Source/WebCore/svg/properties/SVGAnimatedTransformListPropertyTearOff.h 2016-03-16 00:22:02 UTC (rev 198246)
@@ -28,18 +28,24 @@
class SVGAnimatedTransformListPropertyTearOff : public SVGAnimatedListPropertyTearOff<SVGTransformList> {
public:
- virtual SVGListPropertyTearOff<SVGTransformList>* baseVal() override
+ virtual RefPtr<ListProperty> baseVal() override
{
- if (!m_baseVal)
- m_baseVal = SVGTransformListPropertyTearOff::create(this, BaseValRole, m_values, m_wrappers);
- return static_cast<SVGListPropertyTearOff<SVGTransformList>*>(m_baseVal.get());
+ if (m_baseVal)
+ return m_baseVal;
+
+ auto property = SVGTransformListPropertyTearOff::create(this, BaseValRole, m_values, m_wrappers);
+ m_baseVal = property.ptr();
+ return WTF::move(property);
}
- virtual SVGListPropertyTearOff<SVGTransformList>* animVal() override
+ virtual RefPtr<ListProperty> animVal() override
{
- if (!m_animVal)
- m_animVal = SVGTransformListPropertyTearOff::create(this, AnimValRole, m_values, m_wrappers);
- return static_cast<SVGListPropertyTearOff<SVGTransformList>*>(m_animVal.get());
+ if (m_animVal)
+ return m_animVal;
+
+ auto property = SVGTransformListPropertyTearOff::create(this, AnimValRole, m_values, m_wrappers);
+ m_animVal = property.ptr();
+ return WTF::move(property);
}
static Ref<SVGAnimatedTransformListPropertyTearOff> create(SVGElement* contextElement, const QualifiedName& attributeName, AnimatedPropertyType animatedPropertyType, SVGTransformList& values)
Modified: branches/safari-601.1.46-branch/Source/WebCore/svg/properties/SVGListPropertyTearOff.h (198245 => 198246)
--- branches/safari-601.1.46-branch/Source/WebCore/svg/properties/SVGListPropertyTearOff.h 2016-03-16 00:02:05 UTC (rev 198245)
+++ branches/safari-601.1.46-branch/Source/WebCore/svg/properties/SVGListPropertyTearOff.h 2016-03-16 00:22:02 UTC (rev 198246)
@@ -120,6 +120,12 @@
{
}
+ virtual ~SVGListPropertyTearOff()
+ {
+ if (m_animatedProperty)
+ m_animatedProperty->propertyWillBeDeleted(*this);
+ }
+
virtual bool isReadOnly() const override
{
if (m_role == AnimValRole)
Modified: branches/safari-601.1.46-branch/Source/WebCore/svg/properties/SVGPathSegListPropertyTearOff.cpp (198245 => 198246)
--- branches/safari-601.1.46-branch/Source/WebCore/svg/properties/SVGPathSegListPropertyTearOff.cpp 2016-03-16 00:02:05 UTC (rev 198245)
+++ branches/safari-601.1.46-branch/Source/WebCore/svg/properties/SVGPathSegListPropertyTearOff.cpp 2016-03-16 00:22:02 UTC (rev 198246)
@@ -90,7 +90,7 @@
bool SVGPathSegListPropertyTearOff::processIncomingListItemValue(const ListItemType& newItem, unsigned* indexToModify)
{
SVGPathSegWithContext* newItemWithContext = static_cast<SVGPathSegWithContext*>(newItem.get());
- SVGAnimatedProperty* animatedPropertyOfItem = newItemWithContext->animatedProperty();
+ RefPtr<SVGAnimatedProperty> animatedPropertyOfItem = newItemWithContext->animatedProperty();
// Alter the role, after calling animatedProperty(), as that may influence the returned animated property.
newItemWithContext->setContextAndRole(contextElement(), m_pathSegRole);
@@ -106,7 +106,7 @@
// Spec: If newItem is already in a list, it is removed from its previous list before it is inserted into this list.
// 'newItem' is already living in another list. If it's not our list, synchronize the other lists wrappers after the removal.
bool livesInOtherList = animatedPropertyOfItem != m_animatedProperty;
- SVGAnimatedPathSegListPropertyTearOff* propertyTearOff = static_cast<SVGAnimatedPathSegListPropertyTearOff*>(animatedPropertyOfItem);
+ RefPtr<SVGAnimatedPathSegListPropertyTearOff> propertyTearOff = static_pointer_cast<SVGAnimatedPathSegListPropertyTearOff>(animatedPropertyOfItem);
int indexToRemove = propertyTearOff->findItem(newItem.get());
ASSERT(indexToRemove != -1);
