[Webkit-unassigned] [Bug 207920] Crash in SVGElement::removeEventListener with symbol element

Mon Mar 2 14:30:48 PST 2020

https://bugs.webkit.org/show_bug.cgi?id=207920

Ryosuke Niwa <rniwa at webkit.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |rniwa at webkit.org

--- Comment #3 from Ryosuke Niwa <rniwa at webkit.org> ---
Comment on attachment 391112
  --> https://bugs.webkit.org/attachment.cgi?id=391112
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=391112&action=review

> Source/WebCore/svg/SVGSVGElement.cpp:146
> -    if (!nearestViewportElement()) {
> +    if (!nearestViewportElement() && isConnected()) {

Can we also add a new test testing that resize event handler etc...
on a newly created SVG svg element won't be added to the window?

e.g. you can do something like this:

<!DOCTYPE html>
<html>
<body>
<script src="../../resources/js-test.js"></script>
<script>
description('This tests creating a disconnected SVG element with resize event handler. The event handler should not get dispatched unless the element is connected');
const iframe = document.createElement('iframe');
iframe.style.width = '100px';
iframe.style.height = '100px';
document.body.appendChild(iframe);
didFireResize = false;
iframe.contentWindow.requestAnimationFrame(() => {
    const svg = iframe.contentDocument.createElementNS('http://www.w3.org/2000/svg', 'svg');
    svg.setAttribute('onresize', 'top.didFireResize = true');
    iframe.style.width = '200px';
    iframe.contentWindow.requestAnimationFrame(() => {
        shouldBeFalse('didFireResize');
    });
});
</script>
</body>

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20200302/646694e8/attachment.htm>