[Webkit-unassigned] [Bug 121050] New: Assertion can fail when removing display: none SVG elements

bugzilla-daemon at webkit.org bugzilla-daemon at webkit.org
Mon Sep 9 14:45:50 PDT 2013


           Summary: Assertion can fail when removing display: none SVG
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: Unspecified
        OS/Version: Unspecified
            Status: NEW
          Keywords: InRadar
          Severity: Normal
          Priority: P2
         Component: SVG
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: jpfau at apple.com
                CC: zimmermann at kde.org

Created an attachment (id=211088)
 --> (https://bugs.webkit.org/attachment.cgi?id=211088&action=review)

When there are two SVG elements in a display: none container, and the second SVG element refers to the first SVG element with a use element, an assertion may be thrown if children of the original SVG element are removed from the DOM. A simple repro is attached.

The failing assertion is (*it)->shadowTreeElement()->correspondingElement() in SVGElementInstance::invalidateAllInstancesOfElement(WebCore::SVGElement *).


Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

More information about the webkit-unassigned mailing list