-
simon.fraser@apple.com authored
Reviewed by Darin Adler https://bugs.webkit.org/show_bug.cgi?id=22046 Fix a crash when an animation or transition end event handler removes the element upon which the transition/animation is running, by keeping a reference to the AnimationBase object on the stack. Tests: animations/transform-animation-event-destroy-element.html transitions/transform-transition-event-destroy-element.html * page/animation/AnimationBase.cpp: (WebCore::AnimationBase::setChanged): (WebCore::AnimationBase::updateStateMachine): * page/animation/AnimationBase.h: (WebCore::AnimationBase::clearRenderer): * page/animation/AnimationController.cpp: (WebCore::AnimationControllerPrivate::clear): * page/animation/CompositeAnimation.cpp: (WebCore::CompositeAnimationPrivate::~CompositeAnimationPrivate): * page/animation/CompositeAnimation.h: git-svn-id: http://svn.webkit.org/repository/webkit/trunk@38768 268f45cc-cd09-0410-ab3c-d52691b4dbfc
7c14de36