[Webkit-unassigned] [Bug 121050] New: Assertion can fail when removing display: none SVG elements

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=121050

           Summary: Assertion can fail when removing display: none SVG
                    elements
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: Unspecified
        OS/Version: Unspecified
            Status: NEW
          Keywords: InRadar
          Severity: Normal
          Priority: P2
         Component: SVG
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: jpfau at apple.com
                CC: zimmermann at kde.org


Created an attachment (id=211088)
 --> (https://bugs.webkit.org/attachment.cgi?id=211088&action=review)
Repro

When there are two SVG elements in a display: none container, and the second SVG element refers to the first SVG element with a use element, an assertion may be thrown if children of the original SVG element are removed from the DOM. A simple repro is attached.

The failing assertion is (*it)->shadowTreeElement()->correspondingElement() in SVGElementInstance::invalidateAllInstancesOfElement(WebCore::SVGElement *).

<rdar://problem/14887645>

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.