Bug 14150 – SVG DOM is broken in fundamental ways

• Status: RESOLVED
• Resolution: FIXED
• Component: SVG

[Nikolas Zimmermann]

try: alert(myRect.x == myRect.x) :-)

snippet from JSSVGRectElement:
JSValue* JSSVGRectElement::getValueProperty(ExecState* exec, int token) const
{
    SVGRectElement* imp = static_cast<SVGRectElement*>(impl());

    switch (token) {
    case XAttrNum:
    {
        ASSERT(exec && exec->dynamicInterpreter());
        RefPtr<SVGAnimatedLength> obj = imp->xAnimated();
....

snippet from SVGElement.h:
PassRefPtr<ClassName::SVGAnimatedTemplate##UpperProperty> ClassName::LowerProperty##Animated() const \
{ \
    return RefPtr<ClassName::SVGAnimatedTemplate##UpperProperty>(new ClassName::SVGAnimatedTemplate##UpperProperty(this)); \
}


It's pretty clear that the SVG DOM semantics are broken w/o this.
Need to discuss with Eric, and come up with yet another caching solution.

Bug 13963 fixes similar problems for JSSVGLength - same fixes are needed
for JSSVGAnimatedLength. Once that patch is landed, this already works:

var one = myRect.x.baseVal; var two = myRect.x.baseVal;
one.value = 100; two.value = 200;

and one.value == two.value returns true.

Similar fix is needed for the JSSVGAnimated* classes.
Will be fun :-)

[Nikolas Zimmermann]

In case anyone wonders if we were smoking crack because no one ever noticed that before:
Visually everything works - there are no crashes etc.

It only breaks if you're making assumptions about the SVG DOM itself!
I think Antoine reported similar stuff.

[Eric Seidel (no email)]

Created attachment 16623 [details]
Fix (and formal application for my 1337 template hacker merit badge)

[Eric Seidel (no email)]

Created attachment 16625 [details]
test case

[Nikolas Zimmermann]

Comment on attachment 16623 [details]
Fix (and formal application for my 1337 template hacker merit badge)

Yay! Excellent work Eric - this was on my TODO list way too long :-)

Finally it's fixed, r=me.

[Eric Seidel (no email)]

Landed on feature-branch as r26357.