Fix crash in which elementData() might be null.

Source/core/svg/SVGAnimateElement.cpp

Index: Source/core/svg/SVGAnimateElement.cpp
diff --git a/Source/core/svg/SVGAnimateElement.cpp b/Source/core/svg/SVGAnimateElement.cpp
index df0ffceb40bae5f0358658e46009d005c3e8cf87..6d50d9cf1b896287adef85647b796a60979a9a9c 100644
--- a/Source/core/svg/SVGAnimateElement.cpp
+++ b/Source/core/svg/SVGAnimateElement.cpp
@@ -202,6 +202,7 @@ void SVGAnimateElement::resetAnimatedType()
         return;
 
     if (shouldApply == ApplyXMLAnimation) {
+        targetElement->invalidateSVGAttributes();

[adamk, 2014/02/24 21:33:01]

Why did you put this here instead of next to the svgAttributeChanged call? It's
not clear to me that all the code paths in this if statement actually touch
attribute backing stores. If this is the correct place for it, it probably
deserves a comment and some text in your CL description.

[chrishtr, 2014/02/24 21:46:19]

It is indeed the case that not all callers of these animations need invalidation
of svg attributes. The alternative is essentially to to go back to the original
version of the patch (which is what I think your suggestion amounts to). I also
attempted to implement invalidation on update of the animation, in a method that
is performing the mutation. Unfortunately that method is editing an SVG-internal
class which is storing its own private copy of the attribute, then calling
attributeChanged on the name of the attribute. Getting in code there is possible
but a lot of work, and still doesn't reuse the Element::setAttribute call path
which would solve the issue.

The call stack in this example is:
WebCore::SVGGraphicsElement::svgAttributeChanged
WebCore::SVGSVGElement::svgAttributeChanged
WebCore::notifyTargetAboutAnimValChange
WebCore::notifyTargetAndInstancesAboutAnimValChange
WebCore::SVGAnimateElement::applyResultsToTarget
WebCore::SMILTimeContainer::updateAnimations
...

Note that svgAttributeChanged is not being called from Element. It's a
SVG-specific call path.

[chrishtr, 2014/02/24 22:30:46]

Done.

         // SVG DOM animVal animation code-path.
         m_animatedProperties = animator->findAnimatedPropertiesForAttributeName(targetElement, attributeName);
         SVGElementAnimatedPropertyList::const_iterator end = m_animatedProperties.end();
@@ -225,6 +226,7 @@ void SVGAnimateElement::resetAnimatedType()
     String baseValue;
 
     if (shouldApply == ApplyCSSAnimation) {
+        targetElement->invalidateSVGAttributes();

[adamk, 2014/02/24 21:33:01]

Same question as above.

[chrishtr, 2014/02/24 22:30:46]

Done.

         ASSERT(SVGAnimationElement::isTargetAttributeCSSProperty(targetElement, attributeName));
         computeCSSPropertyValue(targetElement, cssPropertyID(attributeName.localName()), baseValue);
     }