[Webkit-unassigned] [Bug 224174] Assert failure in isCloneInShadowTreeOfSVGUseElement

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=224174

--- Comment #1 from Ryosuke Niwa <rniwa at webkit.org> ---
There are two problems here.
1. addEventListener is called on a SVG instance that had already been disconnected from use element’s shadow tree but not yet deleted so its correspondingElement hasn’t been cleared yet.
2. DOM mutation events are fired on the corresponding elements of instances inside use element’s shadow tree when there is an EventQueueScope in the stack as in the case of document.execComand. This is because when the instants are cloned and inserted under its parent, isInShadowTree() is false since the nodes had not been inserted into the shadow tree at that moment.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20210405/555a4396/attachment.htm>