[WIP] DOMMatrixReadOnly::m_matrix is changed to OwnPtr<>.

Source/core/dom/DOMMatrix.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "config.h"
 #include "core/dom/DOMMatrix.h"
 
 namespace blink {
 
 DOMMatrix* DOMMatrix::create()
@@ skipping 16 matching lines @@
 {
     if (m_is2D)
         m_is2D = value;
 }
 
 DOMMatrix* DOMMatrix::multiplySelf(DOMMatrix* other)
 {
     if (!other->is2D())
         m_is2D = false;
 
-    m_matrix = m_matrix * other->matrix();
+    m_matrix.multiply(other->matrix());

[zino, 2014/09/04 14:18:52]

I think this sentence is reasonable but it makes a crash on linux_blink_dbg.
(other os and release are okay)

I don't exactly know what the problem is. However, as my investigating,
I guess it occurs if we define TRANSFORMATION_MATRIX_USE_X86_64_SSE2 [1]
and DOMMatrix is derived garbage collected class.
If we don't use garbage collected class, it is okay.

m_matrix.multiply(other->matrix());    // crash
m_matrix = TransformationMatrix(m_matrix).multiply(other->matrix()); // normal

Could you please help me? Am I missing something here?

[1] The code path :
https://code.google.com/p/chromium/codesearch#chromium/src/third_party/WebKit...

 
     return this;
 }
 
 DOMMatrix* DOMMatrix::preMultiplySelf(DOMMatrix* other)
 {
     if (!other->is2D())
         m_is2D = false;
 
     m_matrix = other->matrix() * m_matrix;
@@ skipping 46 matching lines @@
     else
         m_matrix.scale3d(sx, sy, sz);
 
     if (hasTranslation)
         translateSelf(-ox, -oy, -oz);
 
     return this;
 }
 
 } // namespace blink