• antti@apple.com's avatar
    2008-04-17 Antti Koivisto <antti@apple.com> · 8450dde3
    antti@apple.com authored
            Reviewed by Oliver.
            
            Fix https://bugs.webkit.org/show_bug.cgi?id=18551
            Bug 18551: REGRESSION (r31801?): Crash in ContainerNode::removedFromDocument on many SVG tests under guard malloc
            
            Freeing a RefPtr that is the last ref to the parent from removedFromDocument() is a bad idea.
    
            Caching the target element is too dangerous, let's simply not do it. Getting it is very cheap anyway.
    
            * svg/animation/SVGSMILElement.cpp:
            (WebCore::SVGSMILElement::removedFromDocument):
            (WebCore::SVGSMILElement::attributeChanged):
            (WebCore::SVGSMILElement::targetElement):
            * svg/animation/SVGSMILElement.h:
    
    
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@32039 268f45cc-cd09-0410-ab3c-d52691b4dbfc
    8450dde3
SVGSMILElement.cpp 29.5 KB