Fix lifetime handling of SVGPropertyTearOffs.

Source/core/svg/properties/SVGPropertyTearOff.h

Index: Source/core/svg/properties/SVGPropertyTearOff.h
diff --git a/Source/core/svg/properties/SVGPropertyTearOff.h b/Source/core/svg/properties/SVGPropertyTearOff.h
index ac22ff81825a79580ff0c98db26add7dbe3f6970..79af07384e03bf81e73e495177e3ec2725906678 100644
--- a/Source/core/svg/properties/SVGPropertyTearOff.h
+++ b/Source/core/svg/properties/SVGPropertyTearOff.h
@@ -26,8 +26,13 @@
 
 namespace WebCore {
 
+class SVGPropertyTearOffBase : public SVGProperty {
+public:
+    virtual void detachWrapper() = 0;
+};
+
 template<typename PropertyType>
-class SVGPropertyTearOff : public SVGProperty {
+class SVGPropertyTearOff : public SVGPropertyTearOffBase {
 public:
     typedef SVGPropertyTearOff<PropertyType> Self;
 
@@ -71,11 +76,18 @@ public:
         return m_contextElement.get();
     }
 
-    void detachWrapper()
+    void addChild(SVGPropertyTearOffBase* child)
+    {
+        m_childTearOffs.append(child);
+    }
+
+    virtual void detachWrapper() OVERRIDE
     {
         if (m_valueIsCopy)
             return;
 
+        detachChildren();
+
         // Switch from a live value, to a non-live value.
         // For example: <text x="50"/>
         // var item = text.x.baseVal.getItem(0);
@@ -128,14 +140,24 @@ protected:
 
     virtual ~SVGPropertyTearOff()
     {
+        detachChildren();
+
         if (m_valueIsCopy)
             delete m_value;
     }
 
+    void detachChildren()
+    {
+        for (Vector<RefPtr<SVGPropertyTearOffBase> >::iterator iter = m_childTearOffs.begin(); iter != m_childTearOffs.end(); iter++)

[pdr., 2013/09/13 22:01:15]

This pattern can lead to badness if detachWrapper() ends up modifying this list.
Typically we fix this by copying m)childTearOffs. Are you sure this is safe?

[ojan, 2013/09/13 22:12:04]

This definitely cannot change the list.

+            (*iter)->detachWrapper();
+        m_childTearOffs.clear();
+    }
+
     RefPtr<SVGElement> m_contextElement;
     SVGAnimatedProperty* m_animatedProperty;
     SVGPropertyRole m_role;
     PropertyType* m_value;
+    Vector<RefPtr<SVGPropertyTearOffBase> > m_childTearOffs;
     bool m_valueIsCopy : 1;
 };