Merge 109345

Source/WebCore/svg/animation/SVGSMILElement.cpp

 /*
  * Copyright (C) 2008 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 197 matching lines @@
     }
 }
 
 void SVGSMILElement::removedFromDocument()
 {
     m_attributeName = anyQName();
     if (m_timeContainer) {
         m_timeContainer->unschedule(this);
         m_timeContainer = 0;
     }
-    if (m_targetElement) {
-        document()->accessSVGExtensions()->removeAnimationElementFromTarget(this, m_targetElement);
-        m_targetElement = 0;
-    }
     // Calling disconnectConditions() may kill us if there are syncbase conditions.
     // OK, but we don't want to die inside the call.
     RefPtr<SVGSMILElement> keepAlive(this);
     disconnectConditions();
+
+    // Clear target now, because disconnectConditions calls targetElement() which will recreate the target if we removed it sooner. 
+    if (m_targetElement) {
+        document()->accessSVGExtensions()->removeAnimationElementFromTarget(this, m_targetElement);
+        m_targetElement = 0;
+    }
+
     SVGElement::removedFromDocument();
 }
    
 SMILTime SVGSMILElement::parseOffsetValue(const String& data)
 {
     bool ok;
     double result = 0;
     String parse = data.stripWhiteSpace();
     if (parse.endsWith("h"))
         result = parse.left(parse.length() - 1).toDouble(&ok) * 60 * 60;
@@ skipping 817 matching lines @@
 
 void SVGSMILElement::beginByLinkActivation()
 {
     SMILTime elapsed = this->elapsed();
     addBeginTime(elapsed, elapsed);
 }
     
 }
 
 #endif