ASSERT fires when removing a disallowed clone from the shadow tree without reseting...
authorsaid@apple.com <said@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Mon, 15 Apr 2019 18:54:21 +0000 (18:54 +0000)
committersaid@apple.com <said@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Mon, 15 Apr 2019 18:54:21 +0000 (18:54 +0000)
commit746af021889e0a2b39d3c2051fcbfbbc585f3270
tree127024ab56eda5b9245995cf0debd676f1ce0327
parent9ad58e71ed2c8e3e4ca9f848e4f1d298e0ba1ff3
ASSERT fires when removing a disallowed clone from the shadow tree without reseting its corresponding element
https://bugs.webkit.org/show_bug.cgi?id=196895

Reviewed by Darin Adler.

Source/WebCore:

When cloning elements to the shadow tree of an SVGUseElement, the
corresponding element links are set from the clones to the originals.
Later some of the elements may be disallowed to exist in the shadow tree.
For example the SVGPatternElement is disallowed and has to be removed
even after cloning. The problem is the corresponding elements are not
reset to null. Usually this is not a problem because the removed elements
will be deleted and the destructor of SVGElement will reset the corresponding
element links. However in some cases, the cloned element is referenced
from another SVGElement, for example the target of a SVGTRefElement. In
this case the clone won't be deleted but it will be linked to the original
and the event listeners won't be copied from the original. When the
original is deleted, its event listeners have to be removed. The event
listeners of the clones also ave to be removed. But because the event
listeners of the original were not copied when cloning, the assertion in
SVGElement::removeEventListener() fires.

Test: svg/custom/use-disallowed-element-clear-corresponding-element.html

* svg/SVGUseElement.cpp:
(WebCore::disassociateAndRemoveClones):

LayoutTests:

* svg/custom/use-disallowed-element-clear-corresponding-element-expected.txt: Added.
* svg/custom/use-disallowed-element-clear-corresponding-element.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@244276 268f45cc-cd09-0410-ab3c-d52691b4dbfc
LayoutTests/ChangeLog
LayoutTests/svg/custom/use-disallowed-element-clear-corresponding-element-expected.txt [new file with mode: 0644]
LayoutTests/svg/custom/use-disallowed-element-clear-corresponding-element.html [new file with mode: 0644]
Source/WebCore/ChangeLog
Source/WebCore/svg/SVGUseElement.cpp