try: alert(myRect.x == myRect.x) :-) snippet from JSSVGRectElement: JSValue* JSSVGRectElement::getValueProperty(ExecState* exec, int token) const { SVGRectElement* imp = static_cast<SVGRectElement*>(impl()); switch (token) { case XAttrNum: { ASSERT(exec && exec->dynamicInterpreter()); RefPtr<SVGAnimatedLength> obj = imp->xAnimated(); .... snippet from SVGElement.h: PassRefPtr<ClassName::SVGAnimatedTemplate##UpperProperty> ClassName::LowerProperty##Animated() const \ { \ return RefPtr<ClassName::SVGAnimatedTemplate##UpperProperty>(new ClassName::SVGAnimatedTemplate##UpperProperty(this)); \ } It's pretty clear that the SVG DOM semantics are broken w/o this. Need to discuss with Eric, and come up with yet another caching solution. Bug 13963 fixes similar problems for JSSVGLength - same fixes are needed for JSSVGAnimatedLength. Once that patch is landed, this already works: var one = myRect.x.baseVal; var two = myRect.x.baseVal; one.value = 100; two.value = 200; and one.value == two.value returns true. Similar fix is needed for the JSSVGAnimated* classes. Will be fun :-)
In case anyone wonders if we were smoking crack because no one ever noticed that before: Visually everything works - there are no crashes etc. It only breaks if you're making assumptions about the SVG DOM itself! I think Antoine reported similar stuff.
Created attachment 16623 [details] Fix (and formal application for my 1337 template hacker merit badge)
Created attachment 16625 [details] test case
Comment on attachment 16623 [details] Fix (and formal application for my 1337 template hacker merit badge) Yay! Excellent work Eric - this was on my TODO list way too long :-) Finally it's fixed, r=me.
Landed on feature-branch as r26357.