Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(1604)

Unified Diff: Source/core/svg/properties/SVGAnimatedProperty.cpp

Issue 133273005: [SVG] Defer recursive detachAnimatedProperty call to avoid touching invalidated iterator (Closed) Base URL: svn://svn.chromium.org/blink/trunk
Patch Set: removed vec Created 6 years, 11 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
« no previous file with comments | « no previous file | no next file » | no next file with comments »
Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
Index: Source/core/svg/properties/SVGAnimatedProperty.cpp
diff --git a/Source/core/svg/properties/SVGAnimatedProperty.cpp b/Source/core/svg/properties/SVGAnimatedProperty.cpp
index 2258ad93f57ec028c6defd8dd123d7983db95770..b1e1e7835cdc6d546d5216195cdead1d12f713fc 100644
--- a/Source/core/svg/properties/SVGAnimatedProperty.cpp
+++ b/Source/core/svg/properties/SVGAnimatedProperty.cpp
@@ -56,8 +56,13 @@ void SVGAnimatedProperty::detachAnimatedPropertiesForElement(SVGElement* element
}
}
- for (Vector<SVGAnimatedPropertyDescription>::const_iterator it = keysToRemove.begin(); it != keysToRemove.end(); ++it)
+ for (Vector<SVGAnimatedPropertyDescription>::const_iterator it = keysToRemove.begin(); it != keysToRemove.end(); ++it) {
+ // http://crbug.com/333156 :
+ // There are cases where detachAnimatedPropertiesForElement is called recursively from ~SVGAnimatedProperty.
+ // This below protect makes this function safe by deferring the recursive call until we finish touching the HashMap.
+ RefPtr<SVGAnimatedProperty> protect = cache->get(*it);
cache->remove(*it);
+ }
}
void SVGAnimatedProperty::commitChange()
« no previous file with comments | « no previous file | no next file » | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698