Index: Source/core/svg/properties/SVGAnimatedProperty.cpp |
diff --git a/Source/core/svg/properties/SVGAnimatedProperty.cpp b/Source/core/svg/properties/SVGAnimatedProperty.cpp |
index 2258ad93f57ec028c6defd8dd123d7983db95770..b1e1e7835cdc6d546d5216195cdead1d12f713fc 100644 |
--- a/Source/core/svg/properties/SVGAnimatedProperty.cpp |
+++ b/Source/core/svg/properties/SVGAnimatedProperty.cpp |
@@ -56,8 +56,13 @@ void SVGAnimatedProperty::detachAnimatedPropertiesForElement(SVGElement* element |
} |
} |
- for (Vector<SVGAnimatedPropertyDescription>::const_iterator it = keysToRemove.begin(); it != keysToRemove.end(); ++it) |
+ for (Vector<SVGAnimatedPropertyDescription>::const_iterator it = keysToRemove.begin(); it != keysToRemove.end(); ++it) { |
+ // http://crbug.com/333156 : |
+ // There are cases where detachAnimatedPropertiesForElement is called recursively from ~SVGAnimatedProperty. |
+ // This below protect makes this function safe by deferring the recursive call until we finish touching the HashMap. |
+ RefPtr<SVGAnimatedProperty> protect = cache->get(*it); |
cache->remove(*it); |
+ } |
} |
void SVGAnimatedProperty::commitChange() |