SVG: Items inserted into list should be made a tear-off.

Source/core/svg/properties/SVGListPropertyTearOffHelper.h

 /*
  * Copyright (C) 2013 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 26 matching lines @@
 #include "wtf/TypeTraits.h"
 
 namespace WebCore {
 
 template<typename ItemProperty>
 class ListItemPropertyTraits {
 public:
     typedef ItemProperty ItemPropertyType;
     typedef typename ItemPropertyType::TearOffType ItemTearOffType;
 
-    static PassRefPtr<ItemPropertyType> getValueForInsertionFromTearOff(PassRefPtr<ItemTearOffType> passNewItem)
+    static PassRefPtr<ItemPropertyType> getValueForInsertionFromTearOff(PassRefPtr<ItemTearOffType> passNewItem, SVGElement* contextElement, const QualifiedName& attributeName)
     {
         RefPtr<ItemTearOffType> newItem = passNewItem;
 
         // |newItem| is immutable, OR
         // |newItem| belongs to a SVGElement, but it does not belong to an animated list
         // (for example: "textElement.x.baseVal.appendItem(rectElement.width.baseVal)")
         if (newItem->isImmutable()
             || (newItem->contextElement() && !newItem->target()->ownerList())) {
             // We have to copy the incoming |newItem|,
-            // Otherwise we'll end up having two tearoffs that operate on the same SVGProperty. Consider the example above:
+            // Otherwise we'll end up having two tearoffs that operate on the same SVGProperty. Consider the example below:
             // SVGRectElements SVGAnimatedLength 'width' property baseVal points to the same tear off object
             // that's inserted into SVGTextElements SVGAnimatedLengthList 'x'. textElement.x.baseVal.getItem(0).value += 150 would
             // mutate the rectElement width _and_ the textElement x list. That's obviously wrong, take care of that.
             return newItem->target()->clone();
         }
 
+        newItem->attachToSVGElementAttribute(contextElement, attributeName);
         return newItem->target();
     }
 
     static PassRefPtr<ItemTearOffType> createTearOff(PassRefPtr<ItemPropertyType> value, SVGElement* contextElement, PropertyIsAnimValType propertyIsAnimVal, const QualifiedName& attributeName)
     {
         return ItemTearOffType::create(value, contextElement, propertyIsAnimVal, attributeName);
     }
 };
 
 template<typename Derived, typename ListProperty>
@@ skipping 121 matching lines @@
 
         return createItemTearOff(value.release());
     }
 
 protected:
     SVGListPropertyTearOffHelper(PassRefPtr<ListPropertyType> target, SVGElement* contextElement, PropertyIsAnimValType propertyIsAnimVal, const QualifiedName& attributeName = nullQName())
         : SVGPropertyTearOff<ListPropertyType>(target, contextElement, propertyIsAnimVal, attributeName)
     {
     }
 
-    static PassRefPtr<ItemPropertyType> getValueForInsertionFromTearOff(PassRefPtr<ItemTearOffType> passNewItem)
+    PassRefPtr<ItemPropertyType> getValueForInsertionFromTearOff(PassRefPtr<ItemTearOffType> passNewItem)
     {
-        return ItemTraits::getValueForInsertionFromTearOff(passNewItem);
+        return ItemTraits::getValueForInsertionFromTearOff(passNewItem, toDerived()->contextElement(), toDerived()->attributeName());
     }
 
     PassRefPtr<ItemTearOffType> createItemTearOff(PassRefPtr<ItemPropertyType> value)
     {
         if (!value)
             return nullptr;
 
-        return ItemTraits::createTearOff(value, toDerived()->contextElement(), toDerived()->propertyIsAnimVal(), toDerived()->attributeName());
+        if (value->ownerList() == toDerived()->target())
+            return ItemTraits::createTearOff(value, toDerived()->contextElement(), toDerived()->propertyIsAnimVal(), toDerived()->attributeName());
+
+        return ItemTraits::createTearOff(value, 0, PropertyIsNotAnimVal, nullQName());
     }
 
 private:
     Derived* toDerived() { return static_cast<Derived*>(this); }
 };
 
 }
 
 #endif // SVGListPropertyTearOffHelper_h