haikuwebkit/LayoutTests/svg/dom/update-svg-use-shadow-tree-...

24 lines
689 B
HTML
Raw Permalink Normal View History

Assert failure in isCloneInShadowTreeOfSVGUseElement https://bugs.webkit.org/show_bug.cgi?id=224174 Reviewed by Darin Adler and Antti Koivisto. Source/WebCore: The bug was caused by two related but distinct issues: 1. An element can have an instance that had been removed from a use element's shadow tree but not yet deleted. Because SVGElement clears its correspondingElement in its destructor, when addEventListener is called on such an element, it can try to add an event listener on this instance which is in the process of getting disposed. 2. DOM mutation events can be fired on the corresponding element of an instance inside a use element’s shadow tree with EventQueueScope in the stack when the event is schedueld via Node::dispatchScopedEvent, e.g. because use element's shadow tree was updated during a style update at the beginning of document.execComand. Because SVGUseElement::cloneTarget constructs the shadow tree by cloning the original tree while it's disconnected from the document, Node::dispatchSubtreeModifiedEvent sees isInShadowTree() to be false and happily tries to dispach DOMSubtreeModified event using Node::dispatchScopedEvent. This works fine when the event is dispatched synchronously since these elements had never been exposed to any scripts yet and they are still disconnected so no scripts have had an opportunity to attach an event listener. But when EventQueueScope in the stack, Node::dispatchScopedEvent will queue up the event and fire it later when those instance elements had been inserted into use element's shadow tree. This patch addresses (1) by severing correspondingElement relationship as soon as an instance is removed from its use element's shadow tree, and (2) by not dispatching a scheduled mutation event if the target is inside a shadow tree. Note that this patch also addresses (2) for a regular shadow tree attached by author scripts. Tests: fast/shadow-dom/mutation-event-in-shadow-tree.html svg/dom/mutate-symbol-subtree-referenced-by-use-during-execCommand.html svg/dom/update-svg-use-shadow-tree-with-execCommand.html * dom/ScopedEventQueue.cpp: (WebCore::ScopedEventQueue::dispatchEvent const): * svg/SVGElement.cpp: (WebCore::SVGElement::~SVGElement): (WebCore::SVGElement::removedFromAncestor): (WebCore::SVGElement::addEventListener): (WebCore::SVGElement::removeEventListener): LayoutTests: Added tests for mutating nodes which is later inserted into a shadow tree during execCommand as well as forcing a SVG use element to update its shadow tree by mutating the corresponding element tree during execCommand. * fast/shadow-dom/mutation-event-in-shadow-tree-expected.txt: Added. * fast/shadow-dom/mutation-event-in-shadow-tree.html: Added. * svg/dom/mutate-symbol-subtree-referenced-by-use-during-execCommand-expected.txt: Added. * svg/dom/mutate-symbol-subtree-referenced-by-use-during-execCommand.html: Added. * svg/dom/update-svg-use-shadow-tree-with-execCommand-expected.txt: Added. * svg/dom/update-svg-use-shadow-tree-with-execCommand.html: Added. Canonical link: https://commits.webkit.org/236199@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@275543 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2021-04-06 19:51:49 +00:00
<!DOCTYPE html>
<html>
<body>
<svg><symbol id="symbol1"><g id="g"><tspan id="tspan"/></symbol><use id="use" href="#symbol1" /></svg>
<script src="../../resources/js-test.js"></script>
<script>
description(`This tests updating the SVG use element's shadow tree inside a event queue scope.<br>
WebKit should not dispach any mutation events`);
g.setAttribute("stroke", "blue");
let subtreeModifiedFired = false;
g.addEventListener("DOMSubtreeModified", () => subtreeModifiedFired = true, {once: true});
shouldBeFalse('subtreeModifiedFired');
evalAndLog('document.execCommand("usecss", false)');
shouldBeFalse('subtreeModifiedFired');
successfullyParsed = true;
</script>
</body>
</html>