[Webkit-unassigned] [Bug 207920] Crash in SVGElement::removeEventListener with symbol element

bugzilla-daemon at webkit.org bugzilla-daemon at webkit.org
Mon Mar 2 14:30:48 PST 2020


Ryosuke Niwa <rniwa at webkit.org> changed:

           What    |Removed                     |Added
                 CC|                            |rniwa at webkit.org

--- Comment #3 from Ryosuke Niwa <rniwa at webkit.org> ---
Comment on attachment 391112
  --> https://bugs.webkit.org/attachment.cgi?id=391112

View in context: https://bugs.webkit.org/attachment.cgi?id=391112&action=review

> Source/WebCore/svg/SVGSVGElement.cpp:146
> -    if (!nearestViewportElement()) {
> +    if (!nearestViewportElement() && isConnected()) {

Can we also add a new test testing that resize event handler etc...
on a newly created SVG svg element won't be added to the window?

e.g. you can do something like this:

<!DOCTYPE html>
<script src="../../resources/js-test.js"></script>
description('This tests creating a disconnected SVG element with resize event handler. The event handler should not get dispatched unless the element is connected');
const iframe = document.createElement('iframe');
iframe.style.width = '100px';
iframe.style.height = '100px';
didFireResize = false;
iframe.contentWindow.requestAnimationFrame(() => {
    const svg = iframe.contentDocument.createElementNS('http://www.w3.org/2000/svg', 'svg');
    svg.setAttribute('onresize', 'top.didFireResize = true');
    iframe.style.width = '200px';
    iframe.contentWindow.requestAnimationFrame(() => {

You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20200302/646694e8/attachment.htm>

More information about the webkit-unassigned mailing list