1 files changed, 25 insertions, 11 deletions

diff --git a/Source/WebCore/svg/SVGPathElement.cpp b/Source/WebCore/svg/SVGPathElement.cpp
index 3324d0b5d..c34c476f4 100644
--- a/Source/WebCore/svg/SVGPathElement.cpp
+++ b/Source/WebCore/svg/SVGPathElement.cpp
@@ -310,10 +310,15 @@ void SVGPathElement::removedFrom(ContainerNode* rootParent)
 
 SVGPathByteStream* SVGPathElement::pathByteStream() const
 {
-    SVGAnimatedProperty* property = SVGAnimatedProperty::lookupWrapper<SVGPathElement, SVGAnimatedPathSegListPropertyTearOff>(this, dPropertyInfo());
+    RefPtr<SVGAnimatedProperty> property = SVGAnimatedProperty::lookupWrapper<SVGPathElement, SVGAnimatedPathSegListPropertyTearOff>(this, dPropertyInfo());
     if (!property || !property->isAnimating())
         return m_pathByteStream.get();
-    return static_cast<SVGAnimatedPathSegListPropertyTearOff*>(property)->animatedPathByteStream();
+
+    SVGPathByteStream* animatedPathByteStream = static_cast<SVGAnimatedPathSegListPropertyTearOff*>(property.get())->animatedPathByteStream();
+     if (!animatedPathByteStream)
+         return m_pathByteStream.get();
+
+     return animatedPathByteStream;
 }
 
 PassRefPtr<SVGAnimatedProperty> SVGPathElement::lookupOrCreateDWrapper(SVGElement* contextElement)
@@ -321,16 +326,25 @@ PassRefPtr<SVGAnimatedProperty> SVGPathElement::lookupOrCreateDWrapper(SVGElemen
     ASSERT(contextElement);
     SVGPathElement* ownerType = toSVGPathElement(contextElement);
 
-    if (SVGAnimatedProperty* property = SVGAnimatedProperty::lookupWrapper<SVGPathElement, SVGAnimatedPathSegListPropertyTearOff>(ownerType, dPropertyInfo()))
+    if (RefPtr<SVGAnimatedProperty> property = SVGAnimatedProperty::lookupWrapper<SVGPathElement, SVGAnimatedPathSegListPropertyTearOff>(ownerType, dPropertyInfo()))
         return property;
 
-    // Build initial SVGPathSegList.
-    buildSVGPathSegListFromByteStream(ownerType->m_pathByteStream.get(), ownerType, ownerType->m_pathSegList.value, UnalteredParsing);
+    if (ownerType->m_pathSegList.value.isEmpty())
+        buildSVGPathSegListFromByteStream(ownerType->m_pathByteStream.get(), ownerType, ownerType->m_pathSegList.value, UnalteredParsing);
 
     return SVGAnimatedProperty::lookupOrCreateWrapper<SVGPathElement, SVGAnimatedPathSegListPropertyTearOff, SVGPathSegList>
            (ownerType, dPropertyInfo(), ownerType->m_pathSegList.value);
 }
 
+void SVGPathElement::animatedPropertyWillBeDeleted()
+{
+    // m_pathSegList.shouldSynchronize is set to true when the 'd' wrapper for m_pathSegList
+    // is created and cached. We need to reset it back to false when this wrapper is deleted
+    // so we can be sure if shouldSynchronize is true, SVGAnimatedProperty::lookupWrapper()
+    // will return a valid cached 'd' wrapper for the m_pathSegList.
+    m_pathSegList.shouldSynchronize = false;
+}
+
 void SVGPathElement::synchronizeD(SVGElement* contextElement)
 {
     ASSERT(contextElement);
@@ -340,26 +354,26 @@ void SVGPathElement::synchronizeD(SVGElement* contextElement)
     ownerType->m_pathSegList.synchronize(ownerType, dPropertyInfo()->attributeName, ownerType->m_pathSegList.value.valueAsString());
 }
 
-SVGPathSegListPropertyTearOff* SVGPathElement::pathSegList()
+RefPtr<SVGPathSegListPropertyTearOff> SVGPathElement::pathSegList()
 {
     m_pathSegList.shouldSynchronize = true;
-    return static_cast<SVGPathSegListPropertyTearOff*>(static_pointer_cast<SVGAnimatedPathSegListPropertyTearOff>(lookupOrCreateDWrapper(this))->baseVal());
+    return static_cast<SVGPathSegListPropertyTearOff*>(static_pointer_cast<SVGAnimatedPathSegListPropertyTearOff>(lookupOrCreateDWrapper(this))->baseVal().get());
 }
 
-SVGPathSegListPropertyTearOff* SVGPathElement::normalizedPathSegList()
+RefPtr<SVGPathSegListPropertyTearOff> SVGPathElement::normalizedPathSegList()
 {
     // FIXME: https://bugs.webkit.org/show_bug.cgi?id=15412 - Implement normalized path segment lists!
     return 0;
 }
 
-SVGPathSegListPropertyTearOff* SVGPathElement::animatedPathSegList()
+RefPtr<SVGPathSegListPropertyTearOff> SVGPathElement::animatedPathSegList()
 {
     m_pathSegList.shouldSynchronize = true;
     m_isAnimValObserved = true;
-    return static_cast<SVGPathSegListPropertyTearOff*>(static_pointer_cast<SVGAnimatedPathSegListPropertyTearOff>(lookupOrCreateDWrapper(this))->animVal());
+    return static_cast<SVGPathSegListPropertyTearOff*>(static_pointer_cast<SVGAnimatedPathSegListPropertyTearOff>(lookupOrCreateDWrapper(this))->animVal().get());
 }
 
-SVGPathSegListPropertyTearOff* SVGPathElement::animatedNormalizedPathSegList()
+RefPtr<SVGPathSegListPropertyTearOff> SVGPathElement::animatedNormalizedPathSegList()
 {
     // FIXME: https://bugs.webkit.org/show_bug.cgi?id=15412 - Implement normalized path segment lists!
     return 0;