Merge 95791 - use after free in WebCore::SVGTRefElement::updateReferencedText

Source/WebCore/svg/SVGTRefElement.cpp

 /*
  * Copyright (C) 2004, 2005 Nikolas Zimmermann <zimmermann@kde.org>
  * Copyright (C) 2004, 2005, 2006 Rob Buis <buis@kde.org>
  * Copyright (C) Research In Motion Limited 2011. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
  *
@@ skipping 175 matching lines @@
             m_eventListener->removeFromTarget();
             m_eventListener = 0;
         }
         String id = SVGURIReference::getTarget(href());
         Element* target = treeScope()->getElementById(id);
         if (!target) {
             document()->accessSVGExtensions()->addPendingResource(id, this);
             return;
         }
         updateReferencedText();
-        m_eventListener = SubtreeModificationEventListener::create(this, id);
-        ASSERT(target->parentNode());
-        target->parentNode()->addEventListener(eventNames().DOMSubtreeModifiedEvent, m_eventListener.get(), false);
+        if (inDocument()) {
+            m_eventListener = SubtreeModificationEventListener::create(this, id);
+            ASSERT(target->parentNode());
+            target->parentNode()->addEventListener(eventNames().DOMSubtreeModifiedEvent, m_eventListener.get(), false);
+        }
         if (RenderObject* renderer = this->renderer())
             RenderSVGResource::markForLayoutAndParentResourceInvalidation(renderer);
         return;
     }
 
     ASSERT_NOT_REACHED();
 }
 
 RenderObject* SVGTRefElement::createRenderer(RenderArena* arena, RenderStyle*)
 {
@@ skipping 25 matching lines @@
     updateReferencedText();
     String id = SVGURIReference::getTarget(href());
     if (Element* target = treeScope()->getElementById(id)) {
         ASSERT(!m_eventListener);
         m_eventListener = SubtreeModificationEventListener::create(this, id);
         ASSERT(target->parentNode());
         target->parentNode()->addEventListener(eventNames().DOMSubtreeModifiedEvent, m_eventListener.get(), false);
     }
 }
 
+void SVGTRefElement::insertedIntoDocument()
+{
+    SVGStyledElement::insertedIntoDocument();
+    String id;
+    Element* target = SVGURIReference::targetElementFromIRIString(href(), document(), &id);
+    if (!target) {
+        document()->accessSVGExtensions()->addPendingResource(id, this);
+        return;
+    }
+    updateReferencedText();
+    m_eventListener = SubtreeModificationEventListener::create(this, id);
+    ASSERT(target->parentNode());
+    target->parentNode()->addEventListener(eventNames().DOMSubtreeModifiedEvent, m_eventListener.get(), false);
+}
+
 void SVGTRefElement::removedFromDocument()
 {
     SVGStyledElement::removedFromDocument();
 
     if (!m_eventListener)
         return;
 
     m_eventListener->removeFromTarget();
     m_eventListener = 0;
 }
 
 }
 
 #endif // ENABLE(SVG)