2009-04-20 Geoffrey Garen <ggaren@apple.com>

        Reviewed by Adam Roben.

        One last loose end, discovered using COLLECT_ON_EVERY_ALLOCATION, for
        https://bugs.webkit.org/show_bug.cgi?id=21260
        Unbounded memory growth when churning elements with anonymous event handler functions
        
        * bindings/js/JSSVGElementInstanceCustom.cpp:
        (WebCore::JSSVGElementInstance::mark): Don't ASSERT that an ElementInstance's
        correspondingElement has a JS wrapper. If a GC falls exactly between the
        allocation of the ElementInstance wrapper and the correspondingElement
        wrapper, the correspondingElement won't have a wrapper at the time we
        mark the ElementInstance's wrapper.



git-svn-id: svn://svn.chromium.org/blink/trunk@42695 bbb929c8-8fbe-4397-9dbb-9b2b20218538

third_party/WebKit/WebCore/ChangeLog

+2009-04-20  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Adam Roben.
+
+        One last loose end, discovered using COLLECT_ON_EVERY_ALLOCATION, for
+        https://bugs.webkit.org/show_bug.cgi?id=21260
+        Unbounded memory growth when churning elements with anonymous event handler functions
+        
+        * bindings/js/JSSVGElementInstanceCustom.cpp:
+        (WebCore::JSSVGElementInstance::mark): Don't ASSERT that an ElementInstance's
+        correspondingElement has a JS wrapper. If a GC falls exactly between the
+        allocation of the ElementInstance wrapper and the correspondingElement
+        wrapper, the correspondingElement won't have a wrapper at the time we
+        mark the ElementInstance's wrapper.
+
 2009-04-20  Brady Eidson  <beidson@apple.com>
 
         Rubberstamped by Mark Rowe

third_party/WebKit/WebCore/bindings/js/JSSVGElementInstanceCustom.cpp

@@ -43,8 +43,7 @@ void JSSVGElementInstance::mark()
 
     // Mark the wrapper for our corresponding element, so it can mark its event handlers.
     JSNode* correspondingWrapper = getCachedDOMNodeWrapper(impl()->correspondingElement()->document(), impl()->correspondingElement());
-    ASSERT(correspondingWrapper);
-    if (!correspondingWrapper->marked())
+    if (correspondingWrapper && !correspondingWrapper->marked())
         correspondingWrapper->mark();
 }