Bug 121050

Summary: Assertion can fail when removing display: none SVG elements
Product: WebKit Reporter: Vicki Pfau <jeffrey+webkit>
Component: SVGAssignee: Nobody <webkit-unassigned>
Status: RESOLVED DUPLICATE    
Severity: Normal CC: sabouhallawa, zimmermann
Priority: P2 Keywords: InRadar
Version: 528+ (Nightly build)   
Hardware: Unspecified   
OS: Unspecified   
Attachments:
Description Flags
Repro none

Vicki Pfau
Reported 2013-09-09 14:45:04 PDT
Created attachment 211088 [details] Repro When there are two SVG elements in a display: none container, and the second SVG element refers to the first SVG element with a use element, an assertion may be thrown if children of the original SVG element are removed from the DOM. A simple repro is attached. The failing assertion is (*it)->shadowTreeElement()->correspondingElement() in SVGElementInstance::invalidateAllInstancesOfElement(WebCore::SVGElement *). <rdar://problem/14887645>
Attachments
Repro (362 bytes, text/html)
2013-09-09 14:45 PDT, Vicki Pfau 		no flags
Details
View All Add attachment proposed patch, testcase, etc.
Said Abou-Hallawa
Comment 1 2015-04-22 14:43:28 PDT
The SVGElementInstance was removed completely from the source tree: https://bugs.webkit.org/show_bug.cgi?id=140602. And I confirmed that the repro test case opens in WebKit with no problem. *** This bug has been marked as a duplicate of bug 140602 ***
Note You need to log in before you can comment on or make changes to this bug.