Remove SVGElementInstance

Source/core/svg/SVGElement.cpp

Index: Source/core/svg/SVGElement.cpp
diff --git a/Source/core/svg/SVGElement.cpp b/Source/core/svg/SVGElement.cpp
index 7f1904c2b9d4b2db6f74236dd3ac24ed2f8dae74..0ad2ff2ebe9a5b642cd3f8f3e2a464949b7feeb1 100644
--- a/Source/core/svg/SVGElement.cpp
+++ b/Source/core/svg/SVGElement.cpp
@@ -88,6 +88,8 @@ SVGElement::~SVGElement()
 {
     ASSERT(inDocument() || !hasRelativeLengths());
 
+    if (correspondingElement() && correspondingElement()->instancesForElement().contains(this))
+        correspondingElement()->removeInstanceMapping(this);
     // The below teardown is all handled by weak pointer processing in oilpan.
 #if !ENABLE(OILPAN)
     if (hasSVGRareData()) {
@@ -523,7 +525,7 @@ void SVGElement::mapInstanceToElement(SVGElement* instance)
 void SVGElement::removeInstanceMapping(SVGElement* instance)
 {
     ASSERT(instance);
-    ASSERT(instance->inUseShadowTree());
+    // ASSERT(instance->inUseShadowTree());

[eseidel, 2014/06/03 18:20:25]

Why commit commented out code?

 
     WillBeHeapHashSet<RawPtrWillBeWeakMember<SVGElement> >& instances = svgRareData()->elementInstances();
     ASSERT(instances.contains(instance));
@@ -598,7 +600,7 @@ void SVGElement::cursorImageValueRemoved()
 
 SVGElement* SVGElement::correspondingElement()
 {
-    ASSERT(!hasSVGRareData() || !svgRareData()->correspondingElement() || containingShadowRoot());
+//    ASSERT(!hasSVGRareData() || !svgRareData()->correspondingElement() || containingShadowRoot());
     return hasSVGRareData() ? svgRareData()->correspondingElement() : 0;
 }
 
@@ -1042,6 +1044,8 @@ void SVGElement::invalidateInstances()
         }
     }
 
+    svgRareData()->elementInstances().clear();
+
     document().updateRenderTreeIfNeeded();
 }