<html>
<head>
<base href="https://bugs.webkit.org/" />
</head>
<body>
<p>
<div>
<b><a class="bz_bug_link
bz_status_NEW "
title="NEW - Crash happens when calling removeEventListener for an SVG element which has an instance inside a <defs> element of shadow tree"
href="https://bugs.webkit.org/show_bug.cgi?id=147290#c3">Comment # 3</a>
on <a class="bz_bug_link
bz_status_NEW "
title="NEW - Crash happens when calling removeEventListener for an SVG element which has an instance inside a <defs> element of shadow tree"
href="https://bugs.webkit.org/show_bug.cgi?id=147290">bug 147290</a>
from <span class="vcard"><a class="email" href="mailto:sabouhallawa@apple.com" title="Said Abou-Hallawa <sabouhallawa@apple.com>"> <span class="fn">Said Abou-Hallawa</span></a>
</span></b>
<pre>(In reply to <a href="show_bug.cgi?id=147290#c2">comment #2</a>)
<span class="quote">> This stack shows an assertion failure, but sounds like there is also a crash
> in release mode - is that correct?
>
> The attached test case doesn't crash in shipping Safari/WebKit for me.</span >
Yes the above is an assertion failure. Here is the crashing call stack which I got when opening the attached text case in the latest Safari
Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0 com.apple.WebCore 0x00007fff896746f4 WebCore::EventListenerMap::removeFirstEventListenerCreatedFromMarkup(WTF::AtomicString const&) + 20
1 com.apple.WebCore 0x00007fff89efdca2 WebCore::SVGElement::removeEventListener(WTF::AtomicString const&, WebCore::EventListener*, bool) + 290
2 com.apple.WebCore 0x00007fff89250578 WebCore::jsNodePrototypeFunctionRemoveEventListener(JSC::ExecState*) + 424
3 ??? 0x00003a8434e01028 0 + 64339497193512
4 com.apple.JavaScriptCore 0x00007fff8548a376 llint_entry + 22925
5 com.apple.JavaScriptCore 0x00007fff854847d9 vmEntryToJavaScript + 326
6 com.apple.JavaScriptCore 0x00007fff853b3419 JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*) + 169
7 com.apple.JavaScriptCore 0x00007fff84f884ad JSC::Interpreter::executeCall(JSC::ExecState*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 493
8 com.apple.JavaScriptCore 0x00007fff85125507 JSC::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&, WTF::NakedPtr<JSC::Exception>&) + 71
9 com.apple.WebCore 0x00007fff8924f41a WebCore::JSEventListener::handleEvent(WebCore::ScriptExecutionContext*, WebCore::Event*) + 1002
10 com.apple.WebCore 0x00007fff896778db WebCore::EventTarget::fireEventListeners(WebCore::Event*, WebCore::EventTargetData*, WTF::Vector<WebCore::RegisteredEventListener, 1ul, WTF::CrashOnOverflow, 16ul>&) + 635
11 com.apple.WebCore 0x00007fff8915a390 WebCore::EventTarget::fireEventListeners(WebCore::Event*) + 224
12 com.apple.WebCore 0x00007fff891b0414 WebCore::DOMWindow::dispatchEvent(WTF::PassRefPtr<WebCore::Event>, WTF::PassRefPtr<WebCore::EventTarget>) + 260
13 com.apple.WebCore 0x00007fff891c251b WebCore::DOMWindow::dispatchLoadEvent() + 347
14 com.apple.WebCore 0x00007fff89185dd4 WebCore::Document::implicitClose() + 324
15 com.apple.WebCore 0x00007fff89185853 WebCore::FrameLoader::checkCompleted() + 275
16 com.apple.WebCore 0x00007fff89184624 WebCore::FrameLoader::finishedParsing() + 100
17 com.apple.WebCore 0x00007fff891833c1 WebCore::Document::finishedParsing() + 417
18 com.apple.WebCore 0x00007fff8915b9aa WebCore::DocumentWriter::end() + 58
19 com.apple.WebCore 0x00007fff8914d55c WebCore::DocumentLoader::finishedLoading(double) + 268
20 com.apple.WebCore 0x00007fff891e8809 WebCore::CachedResource::checkNotify() + 153
21 com.apple.WebCore 0x00007fff894abe43 WebCore::CachedRawResource::finishLoading(WebCore::SharedBuffer*) + 227
22 com.apple.WebCore 0x00007fff891e86a1 WebCore::SubresourceLoader::didFinishLoading(double) + 1153
23 com.apple.WebKit 0x00007fff8ec57d0d WebKit::WebResourceLoader::didReceiveWebResourceLoaderMessage(IPC::Connection&, IPC::MessageDecoder&) + 561
24 com.apple.WebKit 0x00007fff8ea9b458 IPC::Connection::dispatchMessage(std::__1::unique_ptr<IPC::MessageDecoder, std::__1::default_delete<IPC::MessageDecoder> >) + 102
25 com.apple.WebKit 0x00007fff8ea9d984 IPC::Connection::dispatchOneMessage() + 114
26 com.apple.JavaScriptCore 0x00007fff85570b45 WTF::RunLoop::performWork() + 437
27 com.apple.JavaScriptCore 0x00007fff85571222 WTF::RunLoop::performWork(void*) + 34
28 com.apple.CoreFoundation 0x00007fff8adf8ac1 __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ + 17
29 com.apple.CoreFoundation 0x00007fff8adeb0bc __CFRunLoopDoSources0 + 556
30 com.apple.CoreFoundation 0x00007fff8adea5df __CFRunLoopRun + 927
31 com.apple.CoreFoundation 0x00007fff8ade9fd8 CFRunLoopRunSpecific + 296
32 com.apple.HIToolbox 0x00007fff8b6a86a1 RunCurrentEventLoopInMode + 235
33 com.apple.HIToolbox 0x00007fff8b6a8437 ReceiveNextEventCommon + 432
34 com.apple.HIToolbox 0x00007fff8b6a8277 _BlockUntilNextEventMatchingListInModeWithFilter + 71
35 com.apple.AppKit 0x00007fff8d6e106f _DPSNextEvent + 1076
36 com.apple.AppKit 0x00007fff8daae597 -[NSApplication _nextEventMatchingEventMask:untilDate:inMode:dequeue:] + 423
37 com.apple.AppKit 0x00007fff8d6d6efa -[NSApplication run] + 682
38 com.apple.AppKit 0x00007fff8d6590b2 NSApplicationMain + 1176
39 libxpc.dylib 0x00007fff91d08fa0 _xpc_objc_main + 793
40 libxpc.dylib 0x00007fff91d0a6ef xpc_main + 494
41 com.apple.WebKit.WebContent 0x0000000105b79b4a 0x105b79000 + 2890
42 libdyld.dylib 0x00007fff950075ad start + 1</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are the assignee for the bug.</li>
</ul>
</body>
</html>