[SVG] Handle endEvent for svg animations

Source/core/svg/animation/SVGSMILElement.cpp

Index: Source/core/svg/animation/SVGSMILElement.cpp
diff --git a/Source/core/svg/animation/SVGSMILElement.cpp b/Source/core/svg/animation/SVGSMILElement.cpp
index c229f9544fca5d9521fe688681fd058adececdc4..c5e364cf5458209df2ff9295d92eedee806469a4 100644
--- a/Source/core/svg/animation/SVGSMILElement.cpp
+++ b/Source/core/svg/animation/SVGSMILElement.cpp
@@ -1051,9 +1051,6 @@ bool SVGSMILElement::progress(SMILTime elapsed, SVGSMILElement* resultElement, b
     ASSERT(m_timeContainer);
     ASSERT(m_isWaitingForFirstInterval || m_intervalBegin.isFinite());
 
-    if (!m_conditionsConnected)
-        connectConditions();
-
     if (!m_intervalBegin.isFinite()) {
         ASSERT(m_activeState == Inactive);
         m_nextProgressTime = SMILTime::unresolved();
@@ -1110,11 +1107,18 @@ bool SVGSMILElement::progress(SMILTime elapsed, SVGSMILElement* resultElement, b
     }
 
     if (oldActiveState == Active && m_activeState != Active) {
+        dispatchEvent(Event::create("endEvent", false, false));

[pdr., 2013/08/29 21:15:06]

Unfortunately, synchronously calling dispatchEvent can lead to 'this' being
freed right here, causing a use-after-free in endedActiveInterval below. Can you
use the dispatchEventSoon pattern, instead of calling dispatchEvent? There's an
example of this pattern in HTMLStyleElement.cpp.

         endedActiveInterval();
         if (m_activeState != Frozen && this == resultElement)
             clearAnimatedType(m_targetElement);
     }
 
+    // Triggering all the pending events if the animation timeline is changed.
+    if (seekToTime) {
+        if (m_activeState == Inactive || m_activeState == Frozen)
+            dispatchEvent(Event::create("endEvent", false, false));

[pdr., 2013/08/29 21:15:06]

ditto here

+    }
+
     m_nextProgressTime = calculateNextProgressTime(elapsed);
     return animationIsContributing;
 }