Fix lifetime handling of SVGPropertyTearOffs.

Source/core/svg/properties/SVGPropertyTearOff.h

 /*
  * Copyright (C) Research In Motion Limited 2010. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
  *
  * This library is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  * Library General Public License for more details.
  *
  * You should have received a copy of the GNU Library General Public License
  * along with this library; see the file COPYING.LIB.  If not, write to
  * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
  * Boston, MA 02110-1301, USA.
  */
 
 #ifndef SVGPropertyTearOff_h
 #define SVGPropertyTearOff_h
 
 #include "core/svg/SVGElement.h"
 #include "core/svg/properties/SVGAnimatedProperty.h"
 #include "core/svg/properties/SVGProperty.h"
 
 namespace WebCore {
 
+class SVGPropertyTearOffBase : public SVGProperty {
+public:
+    virtual void detachWrapper() = 0;
+};
+
 template<typename PropertyType>
-class SVGPropertyTearOff : public SVGProperty {
+class SVGPropertyTearOff : public SVGPropertyTearOffBase {
 public:
     typedef SVGPropertyTearOff<PropertyType> Self;
 
     // Used for child types (baseVal/animVal) of a SVGAnimated* property (for example: SVGAnimatedLength::baseVal()).
     // Also used for list tear offs (for example: text.x.baseVal.getItem(0)).
     static PassRefPtr<Self> create(SVGAnimatedProperty* animatedProperty, SVGPropertyRole role, PropertyType& value)
     {
         ASSERT(animatedProperty);
         return adoptRef(new Self(animatedProperty, role, value));
     }
@@ skipping 23 matching lines @@
             m_contextElement = m_animatedProperty->contextElement();
     }
 
     SVGElement* contextElement() const
     {
         if (!m_animatedProperty || m_valueIsCopy)
             return 0;
         return m_contextElement.get();
     }
 
-    void detachWrapper()
+    void addChild(SVGPropertyTearOffBase* child)
+    {
+        m_childTearOffs.append(child);
+    }
+
+    virtual void detachWrapper() OVERRIDE
     {
         if (m_valueIsCopy)
             return;
 
+        detachChildren();
+
         // Switch from a live value, to a non-live value.
         // For example: <text x="50"/>
         // var item = text.x.baseVal.getItem(0);
         // text.setAttribute("x", "100");
         // item.value still has to report '50' and it has to be possible to modify 'item'
         // w/o changing the "new item" (with x=100) in the text element.
         // Whenever the XML DOM modifies the "x" attribute, all existing wrappers are detached, using this function.
         m_value = new PropertyType(*m_value);
         m_valueIsCopy = true;
         m_animatedProperty = 0;
@@ skipping 32 matching lines @@
     SVGPropertyTearOff(const PropertyType& initialValue)
         : m_animatedProperty(0)
         , m_role(UndefinedRole)
         , m_value(new PropertyType(initialValue))
         , m_valueIsCopy(true)
     {
     }
 
     virtual ~SVGPropertyTearOff()
     {
+        detachChildren();
+
         if (m_valueIsCopy)
             delete m_value;
     }
 
+    void detachChildren()
+    {
+        for (Vector<RefPtr<SVGPropertyTearOffBase> >::iterator iter = m_childTearOffs.begin(); iter != m_childTearOffs.end(); iter++)

[pdr., 2013/09/13 22:01:15]

This pattern can lead to badness if detachWrapper() ends up modifying this list.
Typically we fix this by copying m)childTearOffs. Are you sure this is safe?

[ojan, 2013/09/13 22:12:04]

This definitely cannot change the list.

+            (*iter)->detachWrapper();
+        m_childTearOffs.clear();
+    }
+
     RefPtr<SVGElement> m_contextElement;
     SVGAnimatedProperty* m_animatedProperty;
     SVGPropertyRole m_role;
     PropertyType* m_value;
+    Vector<RefPtr<SVGPropertyTearOffBase> > m_childTearOffs;
     bool m_valueIsCopy : 1;
 };
 
 }
 
 #endif // SVGPropertyTearOff_h