Revert 96034 - Merge 95791 - use after free in WebCore::SVGTRefElement::updateReferencedText

Source/WebCore/svg/SVGTRefElement.cpp

Index: Source/WebCore/svg/SVGTRefElement.cpp
===================================================================
--- Source/WebCore/svg/SVGTRefElement.cpp	(revision 96047)
+++ Source/WebCore/svg/SVGTRefElement.cpp	(working copy)
@@ -193,11 +193,9 @@
             return;
         }
         updateReferencedText();
-        if (inDocument()) {
-            m_eventListener = SubtreeModificationEventListener::create(this, id);
-            ASSERT(target->parentNode());
-            target->parentNode()->addEventListener(eventNames().DOMSubtreeModifiedEvent, m_eventListener.get(), false);
-        }
+        m_eventListener = SubtreeModificationEventListener::create(this, id);
+        ASSERT(target->parentNode());
+        target->parentNode()->addEventListener(eventNames().DOMSubtreeModifiedEvent, m_eventListener.get(), false);
         if (RenderObject* renderer = this->renderer())
             RenderSVGResource::markForLayoutAndParentResourceInvalidation(renderer);
         return;
@@ -243,21 +241,6 @@
     }
 }
 
-void SVGTRefElement::insertedIntoDocument()
-{
-    SVGStyledElement::insertedIntoDocument();
-    String id;
-    Element* target = SVGURIReference::targetElementFromIRIString(href(), document(), &id);
-    if (!target) {
-        document()->accessSVGExtensions()->addPendingResource(id, this);
-        return;
-    }
-    updateReferencedText();
-    m_eventListener = SubtreeModificationEventListener::create(this, id);
-    ASSERT(target->parentNode());
-    target->parentNode()->addEventListener(eventNames().DOMSubtreeModifiedEvent, m_eventListener.get(), false);
-}
-
 void SVGTRefElement::removedFromDocument()
 {
     SVGStyledElement::removedFromDocument();