Prevent destruction of self in SMILTimeContainer with 'discard'

Source/core/svg/animation/SMILTimeContainer.cpp

 /*
  * Copyright (C) 2008 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 19 matching lines @@
 #include "core/animation/DocumentTimeline.h"
 #include "core/dom/ElementTraversal.h"
 #include "core/frame/FrameView.h"
 #include "core/svg/SVGSVGElement.h"
 #include "core/svg/animation/SVGSMILElement.h"
 
 using namespace std;
 
 namespace WebCore {
 
+// Every entry-point that calls updateAnimations() should instantiate a
+// DiscardScope to prevent deletion of the ownerElement (and hence itself.)
+class DiscardScope {
+public:
+    explicit DiscardScope(SVGSVGElement& timeContainerOwner) : m_discardScopeElement(&timeContainerOwner) { }
+
+private:
+    RefPtr<SVGSVGElement> m_discardScopeElement;
+};
+
 SMILTimeContainer::SMILTimeContainer(SVGSVGElement& owner)
     : m_beginTime(0)
     , m_pauseTime(0)
     , m_resumeTime(0)
     , m_accumulatedActiveTime(0)
     , m_presetStartTime(0)
     , m_frameSchedulingState(Idle)
     , m_documentOrderIndexesDirty(false)
     , m_animationClock(AnimationClock::create())
     , m_wakeupTimer(this, &SMILTimeContainer::wakeupTimerFired)
@@ skipping 90 matching lines @@
 }
 
 void SMILTimeContainer::begin()
 {
     ASSERT(!m_beginTime);
     double now = currentTime();
 
     // If 'm_presetStartTime' is set, the timeline was modified via setElapsed() before the document began.
     // In this case pass on 'seekToTime=true' to updateAnimations().
     m_beginTime = now - m_presetStartTime;
+    DiscardScope discardScope(m_ownerSVGElement);
     SMILTime earliestFireTime = updateAnimations(SMILTime(m_presetStartTime), m_presetStartTime ? true : false);
     m_presetStartTime = 0;
 
     if (m_pauseTime) {
         m_pauseTime = now;
         cancelAnimationFrame();
     } else {
         ASSERT(isTimelineRunning());
         // If the timeline is running, and there's pending animation updates,
         // always perform the first update after the timeline was started using
@@ skipping 52 matching lines @@
     for (GroupedAnimationsMap::iterator it = m_scheduledAnimations.begin(); it != end; ++it) {
         AnimationsVector* scheduled = it->value.get();
         unsigned size = scheduled->size();
         for (unsigned n = 0; n < size; n++)
             scheduled->at(n)->reset();
     }
 #ifndef NDEBUG
     m_preventScheduledAnimationsChanges = false;
 #endif
 
+    DiscardScope discardScope(m_ownerSVGElement);
     updateAnimationsAndScheduleFrameIfNeeded(time, true);
 }
 
 bool SMILTimeContainer::isTimelineRunning() const
 {
     return m_beginTime && !isPaused();
 }
 
 void SMILTimeContainer::scheduleAnimationFrame(SMILTime fireTime)
 {
@@ skipping 22 matching lines @@
 
 void SMILTimeContainer::wakeupTimerFired(Timer<SMILTimeContainer>*)
 {
     if (m_frameSchedulingState == AnimationFrame) {
         ASSERT(isTimelineRunning());
         m_frameSchedulingState = Idle;
         serviceOnNextFrame();
     } else {
         ASSERT(m_frameSchedulingState == SynchronizeAnimations);
         m_frameSchedulingState = Idle;
+        DiscardScope discardScope(m_ownerSVGElement);
         updateAnimationsAndScheduleFrameIfNeeded(elapsed());
     }
 }
 
 void SMILTimeContainer::updateDocumentOrderIndexes()
 {
     unsigned timingElementCount = 0;
     for (SVGSMILElement* element = Traversal<SVGSMILElement>::firstWithin(m_ownerSVGElement); element; element = Traversal<SVGSMILElement>::next(*element, &m_ownerSVGElement))
         element->setDocumentOrderIndex(timingElementCount++);
     m_documentOrderIndexesDirty = false;
@@ skipping 40 matching lines @@
     }
 }
 
 void SMILTimeContainer::serviceAnimations(double monotonicAnimationStartTime)
 {
     if (m_frameSchedulingState != AnimationFrame)
         return;
 
     m_frameSchedulingState = Idle;
     animationClock().updateTime(monotonicAnimationStartTime);
+    DiscardScope discardScope(m_ownerSVGElement);

[kouhei (in TOK), 2014/03/12 00:30:30]

Can we put this inside updateAnimationsAndScheduleFrameIfNeeded?

[fs, 2014/03/12 07:32:14]

No (unfortunately), because on the next line following it here is an access to
|this|.

     updateAnimationsAndScheduleFrameIfNeeded(elapsed());
     animationClock().unfreeze();
 }
 
 void SMILTimeContainer::updateAnimationsAndScheduleFrameIfNeeded(SMILTime elapsed, bool seekToTime)
 {
     SMILTime earliestFireTime = updateAnimations(elapsed, seekToTime);
     if (!isTimelineRunning())
         return;
 
@@ skipping 86 matching lines @@
             if (animDiscard->inDocument()) {
                 animDiscard->remove(IGNORE_EXCEPTION);
                 ASSERT(!animDiscard->inDocument());
             }
         }
     }
     return earliestFireTime;
 }
 
 }