Merge 143454

Source/WebCore/svg/properties/SVGPathSegListPropertyTearOff.cpp

Index: Source/WebCore/svg/properties/SVGPathSegListPropertyTearOff.cpp
===================================================================
--- Source/WebCore/svg/properties/SVGPathSegListPropertyTearOff.cpp	(revision 143527)
+++ Source/WebCore/svg/properties/SVGPathSegListPropertyTearOff.cpp	(working copy)
@@ -29,18 +29,23 @@
 
 namespace WebCore {
 
-void SVGPathSegListPropertyTearOff::clear(ExceptionCode& ec)
+void SVGPathSegListPropertyTearOff::clearContextAndRoles()
 {
     ASSERT(m_values);
-    if (m_values->isEmpty())
-        return;
-
     unsigned size = m_values->size();
     for (unsigned i = 0; i < size; ++i) {
         ListItemType item = m_values->at(i);
         static_cast<SVGPathSegWithContext*>(item.get())->setContextAndRole(0, PathSegUndefinedRole);
     }
+}
 
+void SVGPathSegListPropertyTearOff::clear(ExceptionCode& ec)
+{
+    ASSERT(m_values);
+    if (m_values->isEmpty())
+        return;
+
+    clearContextAndRoles();
     SVGPathSegListPropertyTearOff::Base::clearValues(ec);
 }
 
@@ -54,6 +59,24 @@
     return returnedItem.release();
 }
 
+SVGPathSegListPropertyTearOff::PassListItemType SVGPathSegListPropertyTearOff::replaceItem(PassListItemType passNewItem, unsigned index, ExceptionCode& ec)
+{
+    // Not specified, but FF/Opera do it this way, and it's just sane.
+    if (!passNewItem) {
+        ec = SVGException::SVG_WRONG_TYPE_ERR;
+        return 0;
+    }
+
+    if (index < m_values->size()) {
+        ListItemType replacedItem = m_values->at(index);
+        ASSERT(replacedItem);
+        static_cast<SVGPathSegWithContext*>(replacedItem.get())->setContextAndRole(0, PathSegUndefinedRole);
+    }
+
+    ListItemType newItem = passNewItem;
+    return Base::replaceItemValues(newItem, index, ec);
+}
+
 SVGPathSegListPropertyTearOff::PassListItemType SVGPathSegListPropertyTearOff::removeItem(unsigned index, ExceptionCode& ec)
 {
     SVGPathSegListPropertyTearOff::ListItemType removedItem = SVGPathSegListPropertyTearOff::Base::removeItemValues(index, ec);