nephele
/
haikuwebkit
1
0
Fork 0
Code Issues Releases Activity
haikuwebkit/LayoutTests/svg/custom/remove-event-listener-shado...

2 lines
6 B
Plaintext
Raw Permalink Normal View History

Crash happens when calling removeEventListener for an SVG element which has an instance inside a <defs> element of shadow tree https://bugs.webkit.org/show_bug.cgi?id=147290 Reviewed by Daniel Bates. Source/WebCore: When the shadow tree is built for a <use> element, all the SVG elements are allowed to be cloned in the shadow tree but later some of the elements are disallowed and removed. Make sure, when disallowing an element in the shadow tree, to reset the correspondingElement relationship between all the disallowed descendant SVG elements and all their original elements. Test: svg/custom/remove-event-listener-shadow-disallowed-element.svg *svg/SVGElement.cpp: (WebCore::SVGElement::setCorrespondingElement) * svg/SVGUseElement.cpp: (WebCore::removeDisallowedElementsFromSubtree): LayoutTests: Make sure we do not crash when when calling removeEventListener() for an element which is cloned under a disallowed parent inside the shadow tree of another <use> element. * svg/custom/remove-event-listener-shadow-disallowed-element-expected.txt: Added. * svg/custom/remove-event-listener-shadow-disallowed-element.svg: Added. Canonical link: https://commits.webkit.org/165459@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@187504 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2015-07-28 20:10:03 +00:00
Pass.