[SVG] Handle endEvent for svg animations

Source/core/svg/animation/SVGSMILElement.cpp

 /*
  * Copyright (C) 2008 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 1033 matching lines @@
     // Animation does not contribute during the active time if it is past its repeating duration and has fill=remove.
     return (m_activeState == Active && (fill() == FillFreeze || elapsed <= m_intervalBegin + repeatingDuration())) || m_activeState == Frozen;
 }
 
 bool SVGSMILElement::progress(SMILTime elapsed, SVGSMILElement* resultElement, bool seekToTime)
 {
     ASSERT(resultElement);
     ASSERT(m_timeContainer);
     ASSERT(m_isWaitingForFirstInterval || m_intervalBegin.isFinite());
 
-    if (!m_conditionsConnected)
-        connectConditions();
-
     if (!m_intervalBegin.isFinite()) {
         ASSERT(m_activeState == Inactive);
         m_nextProgressTime = SMILTime::unresolved();
         return false;
     }
 
     if (elapsed < m_intervalBegin) {
         ASSERT(m_activeState != Active);
         if (m_activeState == Frozen) {
             if (this == resultElement)
@@ skipping 36 matching lines @@
     if (animationIsContributing) {
         if (oldActiveState == Inactive)
             startedActiveInterval();
 
         updateAnimation(percent, repeat, resultElement);
         m_lastPercent = percent;
         m_lastRepeat = repeat;
     }
 
     if (oldActiveState == Active && m_activeState != Active) {
+        dispatchEvent(Event::create("endEvent", false, false));

[pdr., 2013/08/29 21:15:06]

Unfortunately, synchronously calling dispatchEvent can lead to 'this' being
freed right here, causing a use-after-free in endedActiveInterval below. Can you
use the dispatchEventSoon pattern, instead of calling dispatchEvent? There's an
example of this pattern in HTMLStyleElement.cpp.

         endedActiveInterval();
         if (m_activeState != Frozen && this == resultElement)
             clearAnimatedType(m_targetElement);
     }
 
+    // Triggering all the pending events if the animation timeline is changed.
+    if (seekToTime) {
+        if (m_activeState == Inactive || m_activeState == Frozen)
+            dispatchEvent(Event::create("endEvent", false, false));

[pdr., 2013/08/29 21:15:06]

ditto here

+    }
+
     m_nextProgressTime = calculateNextProgressTime(elapsed);
     return animationIsContributing;
 }
 
 void SVGSMILElement::notifyDependentsIntervalChanged(NewOrExistingInterval newOrExisting)
 {
     ASSERT(m_intervalBegin.isFinite());
     DEFINE_STATIC_LOCAL(HashSet<SVGSMILElement*>, loopBreaker, ());
     if (!loopBreaker.add(this).isNewEntry)
         return;
@@ skipping 57 matching lines @@
     addBeginTime(elapsed, elapsed);
 }
 
 void SVGSMILElement::endedActiveInterval()
 {
     clearTimesWithDynamicOrigins(m_beginTimes);
     clearTimesWithDynamicOrigins(m_endTimes);
 }
 
 }