Summary: | chrome.dll!WebCore::SVGTRefElement::updateReferencedText ReadAV@NULL (e85cb8e140071fa7790cad215b0109dc) | ||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|
Product: | WebKit | Reporter: | Berend-Jan Wever <skylined> | ||||||||
Component: | SVG | Assignee: | Nobody <webkit-unassigned> | ||||||||
Status: | RESOLVED FIXED | ||||||||||
Severity: | Normal | CC: | eric, fmalita, rwlbuis, webkit.review.bot, zimmermann | ||||||||
Priority: | P1 | ||||||||||
Version: | 528+ (Nightly build) | ||||||||||
Hardware: | PC | ||||||||||
OS: | Windows Vista | ||||||||||
Attachments: |
|
Description
Berend-Jan Wever
2011-12-19 05:48:46 PST
The DOMSubtreeModifiedEvent listener is still active on the target's parent after the target is removed. We need to catch the target removal event and deactivate any associated listeners. I have a first-pass at this following up. Additionally: * on target removal, mark the tref as resource-pending again, to reattach if the same id is added at a later time (I believe this is desirable) * move the DOMSubtreeModifiedEvent to the target element itself to keep things simple (I think we're only interested in catching updates to the target element, and the event appears to be dispatched to it too - hope I'm not missing something here) Created attachment 121727 [details]
Patch
Created attachment 122019 [details]
Reduced test.
Created attachment 127225 [details]
Patch
Updated after the recent shadow tree changes.
Comment on attachment 127225 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=127225&action=review Looks just great! r=me. > Source/WebCore/svg/SVGTRefElement.cpp:185 > + Node* container = shadowRootList()->oldestShadowRoot()->firstChild(); oldestShadowRoot, and shadowRootList are guaranteed non-null? If yes, there's nothing hold back a cq+. (In reply to comment #5) > > Source/WebCore/svg/SVGTRefElement.cpp:185 > > + Node* container = shadowRootList()->oldestShadowRoot()->firstChild(); > > oldestShadowRoot, and shadowRootList are guaranteed non-null? Yes, SVGTRefElement::create() calls createShadowSubtree() which initializes the shadow root plumbing. > If yes, there's nothing hold back a cq+. Thanks! Comment on attachment 127225 [details]
Patch
r=me.
Comment on attachment 127225 [details] Patch Clearing flags on attachment: 127225 Committed r108082: <http://trac.webkit.org/changeset/108082> All reviewed patches have been landed. Closing bug. |