commit e4345b102c31a9adb5ce02f7df4cf97cd86cd483
author sigbjornf@opera.com <sigbjornf@opera.com> Thu Sep 10 19:18:55 2015
committer sigbjornf@opera.com <sigbjornf@opera.com> Thu Sep 10 19:18:55 2015
tree 85f5d370a3ed00063ceb5b8c62d7fcc9bd142c65
parent c96849debc2abcadcdf722deb06dfcf7dd9b6d54

Avoid a SVG property list-induced leak (Oilpan).

Address animations/svg-attribute-interpolation/svg-d-interpolation.html
leak.

R=haraken,kouhei
BUG=528275

Review URL: https://codereview.chromium.org/1328223002

git-svn-id: svn://svn.chromium.org/blink/trunk@202067 bbb929c8-8fbe-4397-9dbb-9b2b20218538

third_party/WebKit/Source/core/svg/SVGPathSeg.cpp

diff --git a/third_party/WebKit/Source/core/svg/SVGPathSeg.cpp b/third_party/WebKit/Source/core/svg/SVGPathSeg.cpp
index 5741959..6fe840f 100644
--- a/third_party/WebKit/Source/core/svg/SVGPathSeg.cpp
+++ b/third_party/WebKit/Source/core/svg/SVGPathSeg.cpp
@@ -44,7 +44,6 @@
 DEFINE_TRACE(SVGPathSeg)
 {
     visitor->trace(m_ownerList);
-    visitor->trace(m_contextElement);
 }
 
 void SVGPathSeg::commitChange()

third_party/WebKit/Source/core/svg/SVGPathSeg.h

diff --git a/third_party/WebKit/Source/core/svg/SVGPathSeg.h b/third_party/WebKit/Source/core/svg/SVGPathSeg.h
index 58422ba..ffa59f3 100644
--- a/third_party/WebKit/Source/core/svg/SVGPathSeg.h
+++ b/third_party/WebKit/Source/core/svg/SVGPathSeg.h
@@ -163,7 +163,8 @@
 
 private:
     RawPtrWillBeMember<SVGPropertyBase> m_ownerList;
-    RawPtrWillBeMember<SVGElement> m_contextElement;
+    GC_PLUGIN_IGNORE("528275")
+    SVGElement* m_contextElement;
 };
 
 class SVGPathSegSingleCoordinate : public SVGPathSeg {

third_party/WebKit/Source/core/svg/SVGPathSegList.cpp

diff --git a/third_party/WebKit/Source/core/svg/SVGPathSegList.cpp b/third_party/WebKit/Source/core/svg/SVGPathSegList.cpp
index 1a84163a..9fecc71 100644
--- a/third_party/WebKit/Source/core/svg/SVGPathSegList.cpp
+++ b/third_party/WebKit/Source/core/svg/SVGPathSegList.cpp
@@ -58,7 +58,6 @@
 
 DEFINE_TRACE(SVGPathSegList)
 {
-    visitor->trace(m_contextElement);
     SVGListPropertyHelper<SVGPathSegList, SVGPathSeg>::trace(visitor);
 }
 

third_party/WebKit/Source/core/svg/SVGPathSegList.h

diff --git a/third_party/WebKit/Source/core/svg/SVGPathSegList.h b/third_party/WebKit/Source/core/svg/SVGPathSegList.h
index fc3dbf6..cb67418 100644
--- a/third_party/WebKit/Source/core/svg/SVGPathSegList.h
+++ b/third_party/WebKit/Source/core/svg/SVGPathSegList.h
@@ -165,7 +165,8 @@
     //
     // SVGPathSegList is either owned by SVGAnimatedPath or SVGPathSegListTearOff.
     // Both keep |contextElement| alive, so this ptr is always valid.
-    RawPtrWillBeMember<SVGPathElement> m_contextElement;
+    GC_PLUGIN_IGNORE("528275")
+    SVGPathElement* m_contextElement;
 
     mutable OwnPtr<SVGPathByteStream> m_byteStream;
     bool m_listSyncedToByteStream;

third_party/WebKit/Source/core/svg/properties/SVGProperty.h

diff --git a/third_party/WebKit/Source/core/svg/properties/SVGProperty.h b/third_party/WebKit/Source/core/svg/properties/SVGProperty.h
index cb2e630..7e6ab25 100644
--- a/third_party/WebKit/Source/core/svg/properties/SVGProperty.h
+++ b/third_party/WebKit/Source/core/svg/properties/SVGProperty.h
@@ -88,10 +88,7 @@
         m_ownerList = ownerList;
     }
 
-    DEFINE_INLINE_VIRTUAL_TRACE()
-    {
-        visitor->trace(m_ownerList);
-    }
+    DEFINE_INLINE_VIRTUAL_TRACE() { }
 
 protected:
     explicit SVGPropertyBase(AnimatedPropertyType type)
@@ -103,7 +100,11 @@
 private:
     const AnimatedPropertyType m_type;
 
-    RawPtrWillBeMember<SVGPropertyBase> m_ownerList;
+    // Oilpan: the back reference to the owner should be a Member, but this can create
+    // cycles when SVG properties meet the off-heap InterpolationValue hierarchy.
+    // Not tracing it is safe, albeit an undesirable state of affairs.
+    GC_PLUGIN_IGNORE("528275")
+    SVGPropertyBase* m_ownerList;
 };
 
 }