-
antti@apple.com authored
Reviewed by Oliver. Fix https://bugs.webkit.org/show_bug.cgi?id=18551 Bug 18551: REGRESSION (r31801?): Crash in ContainerNode::removedFromDocument on many SVG tests under guard malloc Freeing a RefPtr that is the last ref to the parent from removedFromDocument() is a bad idea. Caching the target element is too dangerous, let's simply not do it. Getting it is very cheap anyway. * svg/animation/SVGSMILElement.cpp: (WebCore::SVGSMILElement::removedFromDocument): (WebCore::SVGSMILElement::attributeChanged): (WebCore::SVGSMILElement::targetElement): * svg/animation/SVGSMILElement.h: git-svn-id: http://svn.webkit.org/repository/webkit/trunk@32039 268f45cc-cd09-0410-ab3c-d52691b4dbfc
8450dde3