[SVG] Handle endEvent for svg animations

[SVG] Handle endEvent for svg animations

Handled endEvent for svg animations according to http://www.w3.org/TR/SMIL3/smil-timing.html#q135

R=pdr@chromium.org, schenney@chromium.org, dschulze@chromium.org, fmalita@chromium.org
BUG=269648
Committed: https://src.chromium.org/viewvc/blink?view=rev&revision=157012

[pavane, 2013-08-08 19:11:36]

WIP patch, Please have a look.

Facing problem with writing layout tests, please help.

I triggered a discussion at https://codereview.chromium.org/22604002/

[pdr., 2013-08-29 20:48:59]

On 2013/08/08 19:11:36, pavane wrote:
> WIP patch, Please have a look.
> 
> Facing problem with writing layout tests, please help.
> 
> I triggered a discussion at https://codereview.chromium.org/22604002/

I think this looks reasonable.

LGTM

[pdr., 2013-08-29 21:14:54]

On 2013/08/29 20:48:59, pdr wrote:
> On 2013/08/08 19:11:36, pavane wrote:
> > WIP patch, Please have a look.
> > 
> > Facing problem with writing layout tests, please help.
> > 
> > I triggered a discussion at https://codereview.chromium.org/22604002/
> 
> I think this looks reasonable.
> 
> LGTM

Oops--we found an issue but it shouldn't be too hard to fix. Because this will
lead to a security bug, "not lgtm" until we resolve this.

I'm happy to explain further on irc if it will help.

[pdr., 2013-08-29 21:15:05]

https://codereview.chromium.org/22385010/diff/6002/Source/core/svg/animation/...
File Source/core/svg/animation/SVGSMILElement.cpp (right):

https://codereview.chromium.org/22385010/diff/6002/Source/core/svg/animation/...
Source/core/svg/animation/SVGSMILElement.cpp:1110:
dispatchEvent(Event::create("endEvent", false, false));
Unfortunately, synchronously calling dispatchEvent can lead to 'this' being
freed right here, causing a use-after-free in endedActiveInterval below. Can you
use the dispatchEventSoon pattern, instead of calling dispatchEvent? There's an
example of this pattern in HTMLStyleElement.cpp.

https://codereview.chromium.org/22385010/diff/6002/Source/core/svg/animation/...
Source/core/svg/animation/SVGSMILElement.cpp:1119:
dispatchEvent(Event::create("endEvent", false, false));
ditto here

[pdr., 2013-08-29 21:38:00]

This is really tricky, I wrote up a simple example to show what could be
happening here:
http://pr.gg/uaf.cpp

[pavane, 2013-08-30 09:07:37]

Changes done. Please have a look once more.

[pdr., 2013-08-30 17:20:08]

On 2013/08/30 09:07:37, pavane wrote:
> Changes done. Please have a look once more.

LGTM

[commit-bot: I haz the power, 2013-08-30 17:20:24]

CQ is trying da patch. Follow status at
https://chromium-status.appspot.com/cq/pavan.e@samsung.com/22385010/16001

[commit-bot: I haz the power, 2013-08-30 17:39:32]

Sorry for I got bad news for ya.
Compile failed with a clobber build on linux_blink_rel.
http://build.chromium.org/p/tryserver.chromium/buildstatus?builder=linux_blin...
Your code is likely broken or HEAD is junk. Please ensure your
code is not broken then alert the build sheriffs.
Look at the try server FAQ for more details.

[commit-bot: I haz the power, 2013-08-30 17:45:25]

CQ is trying da patch. Follow status at
https://chromium-status.appspot.com/cq/pavan.e@samsung.com/22385010/33001

[pdr., 2013-08-30 18:12:22]

On 2013/08/30 17:45:25, I haz the power (commit-bot) wrote:
> CQ is trying da patch. Follow status at
> https://chromium-status.appspot.com/cq/pavan.e%40samsung.com/22385010/33001

LGTM2

[commit-bot: I haz the power, 2013-08-30 18:12:35]

CQ is trying da patch. Follow status at
https://chromium-status.appspot.com/cq/pavan.e@samsung.com/22385010/4002

[commit-bot: I haz the power, 2013-08-30 20:01:11]

Change committed as 157012