Bug 121050

Summary:

Assertion can fail when removing display: none SVG elements

Product:

WebKit

Reporter:

Vicki Pfau <jeffrey+webkit>

Component:

SVG

Assignee:

Nobody <webkit-unassigned>

Status:

RESOLVED DUPLICATE

Severity:

Normal

CC:

sabouhallawa, zimmermann

Priority:

Keywords:

InRadar

Version:

528+ (Nightly build)

Hardware:

Unspecified

OS:

Unspecified

Attachments:

Description	Flags
Repro	none

Description Vicki Pfau 2013-09-09 14:45:04 PDT

Created attachment 211088 [details]
Repro

When there are two SVG elements in a display: none container, and the second SVG element refers to the first SVG element with a use element, an assertion may be thrown if children of the original SVG element are removed from the DOM. A simple repro is attached.

The failing assertion is (*it)->shadowTreeElement()->correspondingElement() in SVGElementInstance::invalidateAllInstancesOfElement(WebCore::SVGElement *).

<rdar://problem/14887645>

Comment 1 Said Abou-Hallawa 2015-04-22 14:43:28 PDT

The SVGElementInstance was removed completely from the source tree: https://bugs.webkit.org/show_bug.cgi?id=140602. And I confirmed that the repro test case opens in WebKit with no problem.

*** This bug has been marked as a duplicate of bug 140602 ***