Bug 121050

Summary: Assertion can fail when removing display: none SVG elements
Product: WebKit Reporter: Vicki Pfau <jeffrey+webkit>
Component: SVGAssignee: Nobody <webkit-unassigned>
Severity: Normal CC: sabouhallawa, zimmermann
Priority: P2 Keywords: InRadar
Version: 528+ (Nightly build)   
Hardware: Unspecified   
OS: Unspecified   
Description Flags
Repro none

Description Vicki Pfau 2013-09-09 14:45:04 PDT
Created attachment 211088 [details]

When there are two SVG elements in a display: none container, and the second SVG element refers to the first SVG element with a use element, an assertion may be thrown if children of the original SVG element are removed from the DOM. A simple repro is attached.

The failing assertion is (*it)->shadowTreeElement()->correspondingElement() in SVGElementInstance::invalidateAllInstancesOfElement(WebCore::SVGElement *).

Comment 1 Said Abou-Hallawa 2015-04-22 14:43:28 PDT
The SVGElementInstance was removed completely from the source tree: https://bugs.webkit.org/show_bug.cgi?id=140602. And I confirmed that the repro test case opens in WebKit with no problem.

*** This bug has been marked as a duplicate of bug 140602 ***