Merge 96707 - Crash in SVGTRefElement::updateReferencedText.

Source/WebCore/svg/SVGTRefElement.cpp

 /*
  * Copyright (C) 2004, 2005 Nikolas Zimmermann <zimmermann@kde.org>
  * Copyright (C) 2004, 2005, 2006 Rob Buis <buis@kde.org>
  * Copyright (C) Research In Motion Limited 2011. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
  *
@@ skipping 57 matching lines @@
         return adoptRef(new SubtreeModificationEventListener(trefElement, targetId));
     }
 
     static const SubtreeModificationEventListener* cast(const EventListener* listener)
     {
         return listener->type() == CPPEventListenerType ? static_cast<const SubtreeModificationEventListener*>(listener) : 0;
     }
 
     virtual bool operator==(const EventListener&);
 
-    void removeFromTarget()
+    void clear()
     {
         Element* target = m_trefElement->treeScope()->getElementById(m_targetId);
         if (target && target->parentNode())
             target->parentNode()->removeEventListener(eventNames().DOMSubtreeModifiedEvent, this, false);
+        
+        m_trefElement = 0;
+        m_targetId = String();
     }
 
 private:
     SubtreeModificationEventListener(SVGTRefElement* trefElement, String targetId)
         : EventListener(CPPEventListenerType)
         , m_trefElement(trefElement)
         , m_targetId(targetId)
     {
     }
 
     virtual void handleEvent(ScriptExecutionContext*, Event*);
 
     SVGTRefElement* m_trefElement;
     String m_targetId;
 };
 
 bool SubtreeModificationEventListener::operator==(const EventListener& listener)
 {
     if (const SubtreeModificationEventListener* subtreeModificationEventListener = SubtreeModificationEventListener::cast(&listener))
         return m_trefElement == subtreeModificationEventListener->m_trefElement;
     return false;
 }
 
 void SubtreeModificationEventListener::handleEvent(ScriptExecutionContext*, Event* event)
 {
-    if (event->type() == eventNames().DOMSubtreeModifiedEvent && m_trefElement != event->target())
+    if (m_trefElement && event->type() == eventNames().DOMSubtreeModifiedEvent && m_trefElement != event->target())
         m_trefElement->updateReferencedText();
 }
 
 class SVGShadowText : public Text {
 public:
     static PassRefPtr<SVGShadowText> create(Document* document, const String& data)
     {
         return adoptRef(new SVGShadowText(document, data));
     }
 private:
@@ skipping 12 matching lines @@
 
 bool SVGShadowText::willRecalcStyle(StyleChange change)
 {
     if (change != NoChange && parentNode()->shadowHost()) {
         if (renderer())
             renderer()->setStyle(parentNode()->shadowHost()->renderer()->style());
     }
     return true;
 }
 
+SVGTRefElement::~SVGTRefElement()
+{
+    clearEventListener();
+}
+
 void SVGTRefElement::updateReferencedText()
 {
     Element* target = SVGURIReference::targetElementFromIRIString(href(), document());
     ASSERT(target);
     String textContent;
     if (target->parentNode())
         textContent = target->textContent();
     ExceptionCode ignore = 0;
     if (!ensureShadowRoot()->firstChild())
         shadowRoot()->appendChild(SVGShadowText::create(document(), textContent), ignore);
@@ skipping 26 matching lines @@
 void SVGTRefElement::svgAttributeChanged(const QualifiedName& attrName)
 {
     if (!isSupportedAttribute(attrName)) {
         SVGTextPositioningElement::svgAttributeChanged(attrName);
         return;
     }
 
     SVGElementInstance::InvalidationGuard invalidationGuard(this);
 
     if (SVGURIReference::isKnownAttribute(attrName)) {
-        if (m_eventListener) {
-            m_eventListener->removeFromTarget();
-            m_eventListener = 0;
-        }
-        String id;
-        Element* target = SVGURIReference::targetElementFromIRIString(href(), document(), &id);
-        if (!target) {
-            document()->accessSVGExtensions()->addPendingResource(id, this);
-            return;
-        }
-        updateReferencedText();
-        if (inDocument()) {
-            m_eventListener = SubtreeModificationEventListener::create(this, id);
-            ASSERT(target->parentNode());
-            target->parentNode()->addEventListener(eventNames().DOMSubtreeModifiedEvent, m_eventListener.get(), false);
-        }
+        buildPendingResource();
         if (RenderObject* renderer = this->renderer())
             RenderSVGResource::markForLayoutAndParentResourceInvalidation(renderer);
         return;
     }
 
     ASSERT_NOT_REACHED();
 }
 
 RenderObject* SVGTRefElement::createRenderer(RenderArena* arena, RenderStyle*)
 {
@@ skipping 15 matching lines @@
             || parentNode()->hasTagName(SVGNames::textTag)
             || parentNode()->hasTagName(SVGNames::textPathTag)
             || parentNode()->hasTagName(SVGNames::tspanTag)))
         return StyledElement::rendererIsNeeded(context);
 
     return false;
 }
 
 void SVGTRefElement::buildPendingResource()
 {
+    // Remove any existing event listener.
+    clearEventListener();
+
+    String id;
+    Element* target = SVGURIReference::targetElementFromIRIString(href(), document(), &id);
+    if (!target) {
+        if (hasPendingResources() || id.isEmpty())
+            return;
+
+        ASSERT(!hasPendingResources());
+        document()->accessSVGExtensions()->addPendingResource(id, this);
+        ASSERT(hasPendingResources());
+        return;
+    }
+
     updateReferencedText();
-    if (Element* target = SVGURIReference::targetElementFromIRIString(href(), document())) {
-        ASSERT(!m_eventListener);
-        m_eventListener = SubtreeModificationEventListener::create(this, target->getIdAttribute());
-        ASSERT(target->parentNode());
-        target->parentNode()->addEventListener(eventNames().DOMSubtreeModifiedEvent, m_eventListener.get(), false);
-    }
+
+    // We should not add the event listener if we are not in document yet.
+    if (!inDocument())
+        return;
+
+    m_eventListener = SubtreeModificationEventListener::create(this, id);
+    ASSERT(target->parentNode());
+    target->parentNode()->addEventListener(eventNames().DOMSubtreeModifiedEvent, m_eventListener.get(), false);
 }
 
 void SVGTRefElement::insertedIntoDocument()
 {
     SVGStyledElement::insertedIntoDocument();
-    String id;
-    Element* target = SVGURIReference::targetElementFromIRIString(href(), document(), &id);
-    if (!target) {
-        document()->accessSVGExtensions()->addPendingResource(id, this);
-        return;
-    }
-    updateReferencedText();
-    m_eventListener = SubtreeModificationEventListener::create(this, id);
-    ASSERT(target->parentNode());
-    target->parentNode()->addEventListener(eventNames().DOMSubtreeModifiedEvent, m_eventListener.get(), false);
+    buildPendingResource();
 }
 
 void SVGTRefElement::removedFromDocument()
 {
     SVGStyledElement::removedFromDocument();
+    clearEventListener();
+}
 
-    if (!m_eventListener)
-        return;
-
-    m_eventListener->removeFromTarget();
-    m_eventListener = 0;
+void SVGTRefElement::clearEventListener()
+{
+    if (m_eventListener) {
+        m_eventListener->clear();
+        m_eventListener = 0;
+    }
 }
 
 }
 
 #endif // ENABLE(SVG)