Store element reference for event-bases too

third_party/WebKit/Source/core/svg/animation/SVGSMILElement.cpp

 /*
  * Copyright (C) 2008 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 126 matching lines @@
     : m_type(type),
       m_beginOrEnd(beginOrEnd),
       m_baseID(baseID),
       m_name(name),
       m_offset(offset),
       m_repeat(repeat) {}
 
 SVGSMILElement::Condition::~Condition() = default;
 
 DEFINE_TRACE(SVGSMILElement::Condition) {
-  visitor->trace(m_syncBase);
+  visitor->trace(m_baseElement);
   visitor->trace(m_eventListener);
 }
 
 void SVGSMILElement::Condition::connectSyncBase(SVGSMILElement& timedElement) {
   DCHECK(!m_baseID.isEmpty());
+  DCHECK_EQ(m_type, Syncbase);
   Element* element = timedElement.treeScope().getElementById(m_baseID);
   if (!element || !isSVGSMILElement(*element)) {
-    m_syncBase = nullptr;
+    m_baseElement = nullptr;
     return;
   }
-  m_syncBase = toSVGSMILElement(element);
-  m_syncBase->addSyncBaseDependent(timedElement);
+  m_baseElement = toSVGSMILElement(element);
+  toSVGSMILElement(*element).addSyncBaseDependent(timedElement);
 }
 
 void SVGSMILElement::Condition::disconnectSyncBase(
     SVGSMILElement& timedElement) {
-  if (!m_syncBase)
+  DCHECK_EQ(m_type, Syncbase);
+  if (!m_baseElement)
     return;
-  m_syncBase->removeSyncBaseDependent(timedElement);
-  m_syncBase = nullptr;
+  toSVGSMILElement(*m_baseElement).removeSyncBaseDependent(timedElement);
+  m_baseElement = nullptr;
 }
 
 SVGElement* SVGSMILElement::Condition::lookupEventBase(
     SVGSMILElement& timedElement) const {
   Element* eventBase = m_baseID.isEmpty()
                            ? timedElement.targetElement()
                            : timedElement.treeScope().getElementById(m_baseID);
   if (!eventBase || !eventBase->isSVGElement())
     return nullptr;
   return toSVGElement(eventBase);
 }
 
 void SVGSMILElement::Condition::connectEventBase(SVGSMILElement& timedElement) {
-  DCHECK(!m_syncBase);
+  DCHECK_EQ(m_type, EventBase);
+  DCHECK(!m_baseElement);
   SVGElement* eventBase = lookupEventBase(timedElement);
   if (!eventBase) {
     if (m_baseID.isEmpty())
       return;
     SVGTreeScopeResources& treeScopeResources =
         timedElement.treeScope().ensureSVGTreeScopedResources();
     if (!treeScopeResources.isElementPendingResource(timedElement, m_baseID))
       treeScopeResources.addPendingResource(m_baseID, timedElement);
     return;
   }
   DCHECK(!m_eventListener);
   m_eventListener = ConditionEventListener::create(&timedElement, this);
-  eventBase->addEventListener(m_name, m_eventListener, false);
-  timedElement.addReferenceTo(eventBase);
+  m_baseElement = eventBase;
+  m_baseElement->addEventListener(m_name, m_eventListener, false);
+  timedElement.addReferenceTo(m_baseElement);
 }
 
 void SVGSMILElement::Condition::disconnectEventBase(
     SVGSMILElement& timedElement) {
-  DCHECK(!m_syncBase);
+  DCHECK_EQ(m_type, EventBase);
   if (!m_eventListener)
     return;
-  // Note: It's a memory optimization to try to remove our condition event
-  // listener, but it's not guaranteed to work, since we have no guarantee that
-  // we will be able to find our condition's original eventBase. So, we also
-  // have to disconnect ourselves from our condition event listener, in case it
-  // later fires.
-  if (SVGElement* eventBase = lookupEventBase(timedElement))
-    eventBase->removeEventListener(m_name, m_eventListener, false);
+  m_baseElement->removeEventListener(m_name, m_eventListener, false);
+  m_baseElement = nullptr;
   m_eventListener->disconnectAnimation();
   m_eventListener = nullptr;
 }
 
 SVGSMILElement::SVGSMILElement(const QualifiedName& tagName, Document& doc)
     : SVGElement(tagName, doc),
       SVGTests(this),
       m_attributeName(anyQName()),
       m_targetElement(nullptr),
       m_syncBaseConditionsConnected(false),
@@ skipping 1071 matching lines @@
 DEFINE_TRACE(SVGSMILElement) {
   visitor->trace(m_targetElement);
   visitor->trace(m_timeContainer);
   visitor->trace(m_conditions);
   visitor->trace(m_syncBaseDependents);
   SVGElement::trace(visitor);
   SVGTests::trace(visitor);
 }
 
 }  // namespace blink