Revert 96034 - Merge 95791 - use after free in WebCore::SVGTRefElement::updateReferencedText

Source/WebCore/svg/SVGTRefElement.cpp

 /*
  * Copyright (C) 2004, 2005 Nikolas Zimmermann <zimmermann@kde.org>
  * Copyright (C) 2004, 2005, 2006 Rob Buis <buis@kde.org>
  * Copyright (C) Research In Motion Limited 2011. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
  *
@@ skipping 175 matching lines @@
             m_eventListener->removeFromTarget();
             m_eventListener = 0;
         }
         String id = SVGURIReference::getTarget(href());
         Element* target = treeScope()->getElementById(id);
         if (!target) {
             document()->accessSVGExtensions()->addPendingResource(id, this);
             return;
         }
         updateReferencedText();
-        if (inDocument()) {
-            m_eventListener = SubtreeModificationEventListener::create(this, id);
-            ASSERT(target->parentNode());
-            target->parentNode()->addEventListener(eventNames().DOMSubtreeModifiedEvent, m_eventListener.get(), false);
-        }
+        m_eventListener = SubtreeModificationEventListener::create(this, id);
+        ASSERT(target->parentNode());
+        target->parentNode()->addEventListener(eventNames().DOMSubtreeModifiedEvent, m_eventListener.get(), false);
         if (RenderObject* renderer = this->renderer())
             RenderSVGResource::markForLayoutAndParentResourceInvalidation(renderer);
         return;
     }
 
     ASSERT_NOT_REACHED();
 }
 
 RenderObject* SVGTRefElement::createRenderer(RenderArena* arena, RenderStyle*)
 {
@@ skipping 25 matching lines @@
     updateReferencedText();
     String id = SVGURIReference::getTarget(href());
     if (Element* target = treeScope()->getElementById(id)) {
         ASSERT(!m_eventListener);
         m_eventListener = SubtreeModificationEventListener::create(this, id);
         ASSERT(target->parentNode());
         target->parentNode()->addEventListener(eventNames().DOMSubtreeModifiedEvent, m_eventListener.get(), false);
     }
 }
 
-void SVGTRefElement::insertedIntoDocument()
-{
-    SVGStyledElement::insertedIntoDocument();
-    String id;
-    Element* target = SVGURIReference::targetElementFromIRIString(href(), document(), &id);
-    if (!target) {
-        document()->accessSVGExtensions()->addPendingResource(id, this);
-        return;
-    }
-    updateReferencedText();
-    m_eventListener = SubtreeModificationEventListener::create(this, id);
-    ASSERT(target->parentNode());
-    target->parentNode()->addEventListener(eventNames().DOMSubtreeModifiedEvent, m_eventListener.get(), false);
-}
-
 void SVGTRefElement::removedFromDocument()
 {
     SVGStyledElement::removedFromDocument();
 
     if (!m_eventListener)
         return;
 
     m_eventListener->removeFromTarget();
     m_eventListener = 0;
 }
 
 }
 
 #endif // ENABLE(SVG)