Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(155)

Unified Diff: Source/WebCore/svg/SVGTRefElement.cpp

Issue 8015009: Merge 95791 - use after free in WebCore::SVGTRefElement::updateReferencedText (Closed) Base URL: http://svn.webkit.org/repository/webkit/branches/chromium/874/
Patch Set: Created 9 years, 3 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
« no previous file with comments | « Source/WebCore/svg/SVGTRefElement.h ('k') | no next file » | no next file with comments »
Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
Index: Source/WebCore/svg/SVGTRefElement.cpp
===================================================================
--- Source/WebCore/svg/SVGTRefElement.cpp (revision 95815)
+++ Source/WebCore/svg/SVGTRefElement.cpp (working copy)
@@ -195,9 +195,11 @@
return;
}
updateReferencedText();
- m_eventListener = SubtreeModificationEventListener::create(this, id);
- ASSERT(target->parentNode());
- target->parentNode()->addEventListener(eventNames().DOMSubtreeModifiedEvent, m_eventListener.get(), false);
+ if (inDocument()) {
+ m_eventListener = SubtreeModificationEventListener::create(this, id);
+ ASSERT(target->parentNode());
+ target->parentNode()->addEventListener(eventNames().DOMSubtreeModifiedEvent, m_eventListener.get(), false);
+ }
if (RenderObject* renderer = this->renderer())
RenderSVGResource::markForLayoutAndParentResourceInvalidation(renderer);
return;
@@ -242,6 +244,21 @@
}
}
+void SVGTRefElement::insertedIntoDocument()
+{
+ SVGStyledElement::insertedIntoDocument();
+ String id;
+ Element* target = SVGURIReference::targetElementFromIRIString(href(), document(), &id);
+ if (!target) {
+ document()->accessSVGExtensions()->addPendingResource(id, this);
+ return;
+ }
+ updateReferencedText();
+ m_eventListener = SubtreeModificationEventListener::create(this, id);
+ ASSERT(target->parentNode());
+ target->parentNode()->addEventListener(eventNames().DOMSubtreeModifiedEvent, m_eventListener.get(), false);
+}
+
void SVGTRefElement::removedFromDocument()
{
SVGStyledElement::removedFromDocument();
« no previous file with comments | « Source/WebCore/svg/SVGTRefElement.h ('k') | no next file » | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698