Merge 167817 "Fix crash in which elementData() might be null."

Source/core/svg/SVGAnimateElement.cpp

 /*
  * Copyright (C) 2004, 2005 Nikolas Zimmermann <zimmermann@kde.org>
  * Copyright (C) 2004, 2005, 2006 Rob Buis <buis@kde.org>
  * Copyright (C) 2008 Apple Inc. All rights reserved.
  * Copyright (C) Research In Motion Limited 2011. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
@@ skipping 283 matching lines @@
     const HashSet<SVGElementInstance*>::const_iterator end = instances.end();
     for (HashSet<SVGElementInstance*>::const_iterator it = instances.begin(); it != end; ++it) {
         if (SVGElement* shadowTreeElement = (*it)->shadowTreeElement())
             removeCSSPropertyFromTarget(shadowTreeElement, id);
     }
 }
 
 static inline void notifyTargetAboutAnimValChange(SVGElement* targetElement, const QualifiedName& attributeName)
 {
     ASSERT_WITH_SECURITY_IMPLICATION(!targetElement->m_deletionHasBegun);
+    targetElement->invalidateSVGAttributes();
     targetElement->svgAttributeChanged(attributeName);
 }
 
 static inline void notifyTargetAndInstancesAboutAnimValChange(SVGElement* targetElement, const QualifiedName& attributeName)
 {
     ASSERT(targetElement);
     if (attributeName == anyQName() || !targetElement->inDocument() || !targetElement->parentNode())
         return;
 
     SVGElementInstance::InstanceUpdateBlocker blocker(targetElement);
@@ skipping 117 matching lines @@
 
 SVGAnimatedTypeAnimator* SVGAnimateElement::ensureAnimator()
 {
     if (!m_animator)
         m_animator = SVGAnimatorFactory::create(this, targetElement(), m_animatedPropertyType);
     ASSERT(m_animatedPropertyType == m_animator->type());
     return m_animator.get();
 }
 
 }