tree 41d643ee88f5dd6e8f1bfdbc4fb046bf0ac17c48
parent e829b39dab5afcba4f33eafe8ba3e7473dca65b1
author commit-queue@webkit.org <commit-queue@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc> 1575333496 +0000
committer commit-queue@webkit.org <commit-queue@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc> 1575333496 +0000

Crash when animating an enum attribute for multiple instances of an SVG element
https://bugs.webkit.org/show_bug.cgi?id=204766

Patch by Said Abou-Hallawa <sabouhallawa@apple.com> on 2019-12-02
Reviewed by Simon Fraser.

Source/WebCore:

Test: svg/animations/animated-enum-lengthAdjust-instances.svg

All instances of SVG animated properties have to share a single animVal
such that once its value is progressed, all the instances will see the
change. This was not happening for SVGAnimatedDecoratedProperty. To do
that we need to:

-- Make SVGDecoratedProperty be RefCounted.
-- Change the type of SVGAnimatedDecoratedProperty::m_baseVal to
   Ref<SVGDecoratedProperty<DecorationType>>.
-- Change the type of SVGAnimatedDecoratedProperty::m_animVal to
   RefPtr<SVGDecoratedProperty<DecorationType>>. The master property
   creates it and all the instances hold references to the same pointer.
-- Override the virtual methods instanceStartAnimation() and
   instanceStopAnimation() of SVGAnimatedDecoratedProperty.

* svg/properties/SVGAnimatedDecoratedProperty.h:
(WebCore::SVGAnimatedDecoratedProperty::create):
(WebCore::SVGAnimatedDecoratedProperty::SVGAnimatedDecoratedProperty):
(WebCore::SVGAnimatedDecoratedProperty::animVal const):
(WebCore::SVGAnimatedDecoratedProperty::currentValue const):
* svg/properties/SVGDecoratedEnumeration.h:
(WebCore::SVGDecoratedEnumeration::create):
* svg/properties/SVGDecoratedProperty.h:

LayoutTests:

* svg/animations/animated-enum-lengthAdjust-instances-expected.txt: Added.
* svg/animations/animated-enum-lengthAdjust-instances.svg: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@253017 268f45cc-cd09-0410-ab3c-d52691b4dbfc