[Webkit-unassigned] [Bug 147290] Crash happens when calling removeEventListener for an SVG element which has an instance inside a <defs> element of shadow tree

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=147290

--- Comment #2 from Alexey Proskuryakov <ap at webkit.org> ---
This stack shows an assertion failure, but sounds like there is also a crash in release mode - is that correct?

The attached test case doesn't crash in shipping Safari/WebKit for me.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.webkit.org/pipermail/webkit-unassigned/attachments/20150726/882d4d33/attachment.html>