Fix crash in which elementData() might be null.

Source/core/svg/SVGAnimateElement.cpp

 /*
  * Copyright (C) 2004, 2005 Nikolas Zimmermann <zimmermann@kde.org>
  * Copyright (C) 2004, 2005, 2006 Rob Buis <buis@kde.org>
  * Copyright (C) 2008 Apple Inc. All rights reserved.
  * Copyright (C) Research In Motion Limited 2011. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
@@ skipping 184 matching lines @@
     ASSERT(m_animatedPropertyType == animator->type());
 
     SVGElement* targetElement = this->targetElement();
     const QualifiedName& attributeName = this->attributeName();
     ShouldApplyAnimation shouldApply = shouldApplyAnimation(targetElement, attributeName);
 
     if (shouldApply == DontApplyAnimation)
         return;
 
     if (shouldApply == ApplyXMLAnimation) {
+        targetElement->invalidateSVGAttributes();

[adamk, 2014/02/24 21:33:01]

Why did you put this here instead of next to the svgAttributeChanged call? It's
not clear to me that all the code paths in this if statement actually touch
attribute backing stores. If this is the correct place for it, it probably
deserves a comment and some text in your CL description.

[chrishtr, 2014/02/24 21:46:19]

It is indeed the case that not all callers of these animations need invalidation
of svg attributes. The alternative is essentially to to go back to the original
version of the patch (which is what I think your suggestion amounts to). I also
attempted to implement invalidation on update of the animation, in a method that
is performing the mutation. Unfortunately that method is editing an SVG-internal
class which is storing its own private copy of the attribute, then calling
attributeChanged on the name of the attribute. Getting in code there is possible
but a lot of work, and still doesn't reuse the Element::setAttribute call path
which would solve the issue.

The call stack in this example is:
WebCore::SVGGraphicsElement::svgAttributeChanged
WebCore::SVGSVGElement::svgAttributeChanged
WebCore::notifyTargetAboutAnimValChange
WebCore::notifyTargetAndInstancesAboutAnimValChange
WebCore::SVGAnimateElement::applyResultsToTarget
WebCore::SMILTimeContainer::updateAnimations
...

Note that svgAttributeChanged is not being called from Element. It's a
SVG-specific call path.

[chrishtr, 2014/02/24 22:30:46]

Done.

         // SVG DOM animVal animation code-path.
         m_animatedProperties = animator->findAnimatedPropertiesForAttributeName(targetElement, attributeName);
         SVGElementAnimatedPropertyList::const_iterator end = m_animatedProperties.end();
         for (SVGElementAnimatedPropertyList::const_iterator it = m_animatedProperties.begin(); it != end; ++it)
             document().accessSVGExtensions()->addElementReferencingTarget(this, it->element);
 
         ASSERT(!m_animatedProperties.isEmpty());
 
         ASSERT(propertyTypesAreConsistent(m_animatedPropertyType, m_animatedProperties));
         if (!m_animatedType)
             m_animatedType = animator->startAnimValAnimation(m_animatedProperties);
         else {
             animator->resetAnimValToBaseVal(m_animatedProperties, m_animatedType.get());
             animator->animValDidChange(m_animatedProperties);
         }
         return;
     }
 
     // CSS properties animation code-path.
     ASSERT(m_animatedProperties.isEmpty());
     String baseValue;
 
     if (shouldApply == ApplyCSSAnimation) {
+        targetElement->invalidateSVGAttributes();

[adamk, 2014/02/24 21:33:01]

Same question as above.

[chrishtr, 2014/02/24 22:30:46]

Done.

         ASSERT(SVGAnimationElement::isTargetAttributeCSSProperty(targetElement, attributeName));
         computeCSSPropertyValue(targetElement, cssPropertyID(attributeName.localName()), baseValue);
     }
 
     if (!m_animatedType || !m_animatedType->setValueAsString(attributeName, baseValue))
         m_animatedType = animator->constructFromString(baseValue);
 }
 
 static inline void applyCSSPropertyToTarget(SVGElement* targetElement, CSSPropertyID id, const String& value)
 {
@@ skipping 186 matching lines @@
 
 SVGAnimatedTypeAnimator* SVGAnimateElement::ensureAnimator()
 {
     if (!m_animator)
         m_animator = SVGAnimatorFactory::create(this, targetElement(), m_animatedPropertyType);
     ASSERT(m_animatedPropertyType == m_animator->type());
     return m_animator.get();
 }
 
 }