| commit | e479ba936891358d4d20bf702d21b682d3172e48 | [log] [tgz] |
|---|---|---|
| author | fs@opera.com <fs@opera.com@bbb929c8-8fbe-4397-9dbb-9b2b20218538> | Fri Mar 14 12:09:49 2014 |
| committer | fs@opera.com <fs@opera.com@bbb929c8-8fbe-4397-9dbb-9b2b20218538> | Fri Mar 14 12:09:49 2014 |
| tree | c5d384f69de46aa4e180f7b3f215ecdd7d05105f | |
| parent | 82345b607862af57f334083840e8fe23f7bc0fe4 [diff] |
Prevent destruction of self in SMILTimeContainer with 'discard' If discarding the <svg> root an animation update could end up destroying the SVGSVGElement owning the SMILTimeContainer, leading to use-after-free. Make sure to keep an additional reference to the owning SVGSVGElement across affected callsites. BUG=351316 Review URL: https://codereview.chromium.org/195233003 git-svn-id: svn://svn.chromium.org/blink/trunk@169239 bbb929c8-8fbe-4397-9dbb-9b2b20218538