121050 2013-09-09 14:45:04 -0700 Assertion can fail when removing display: none SVG elements 2015-04-22 14:43:28 -0700 1 1 1 Unclassified WebKit SVG 528+ (Nightly build) Unspecified Unspecified RESOLVED DUPLICATE 140602 InRadar P2 Normal --- 1 jeffrey+webkit webkit-unassigned sabouhallawa zimmermann oldest_to_newest 926914 0 211088 jeffrey+webkit 2013-09-09 14:45:04 -0700 Created attachment 211088 Repro When there are two SVG elements in a display: none container, and the second SVG element refers to the first SVG element with a use element, an assertion may be thrown if children of the original SVG element are removed from the DOM. A simple repro is attached. The failing assertion is (*it)->shadowTreeElement()->correspondingElement() in SVGElementInstance::invalidateAllInstancesOfElement(WebCore::SVGElement *). <rdar://problem/14887645> 1087596 1 sabouhallawa 2015-04-22 14:43:28 -0700 The SVGElementInstance was removed completely from the source tree: https://bugs.webkit.org/show_bug.cgi?id=140602. And I confirmed that the repro test case opens in WebKit with no problem. *** This bug has been marked as a duplicate of bug 140602 *** 211088 2013-09-09 14:45:04 -0700 2013-09-09 14:45:04 -0700 Repro svg-remove-display-none.html text/html 362 jeffrey+webkit PCFET0NUWVBFIGh0bWw+PGh0bWw+Cjxib2R5IHN0eWxlPSJkaXNwbGF5OiBub25lIj4KCTxzdmcg dmVyc2lvbj0iMS4xIiBpZD0iczEiPgoJCTxyZWN0IGlkPSJyMSIgLz4KCQk8cmVjdCBpZD0icjIi IC8+Cgk8L3N2Zz4KCgk8c3ZnIHZlcnNpb249IjEuMSI+CgkJPHVzZSB4bGluazpocmVmPSIjczEi IC8+Cgk8L3N2Zz4KCTxzY3JpcHQ+CgkJcjEgPSBkb2N1bWVudC5nZXRFbGVtZW50QnlJZCgncjEn KTsKCQlyMS5wYXJlbnROb2RlLnJlbW92ZUNoaWxkKHIxKTsKCQlyMiA9IGRvY3VtZW50LmdldEVs ZW1lbnRCeUlkKCdyMicpOwoJCXIyLnBhcmVudE5vZGUucmVtb3ZlQ2hpbGQocjIpOwoJPC9zY3Jp cHQ+CjwvYm9keT4KPC9odG1sPgo=