Changeset 247826 in webkit

Timestamp:

Jul 25, 2019 10:56:45 AM (5 years ago)

Author:

commit-queue@webkit.org

Message:

REGRESSION (r244995): Assertion failure when addEventListener to an SVGElement which has an. instance in shadow tree
​https://bugs.webkit.org/show_bug.cgi?id=200083

Patch by Said Abou-Hallawa <​sabouhallawa@apple.com> on 2019-07-25
Reviewed by Ryosuke Niwa.

Source/WebCore:

When adding an event listener to an SVGElement, the same event listener
has to be add to all the instances of SVGElement in the shadow tree. See
SVGElement::addEventListener().

In r244995, an assertion was added to ensure if the event listener is
attached to an event target, the new event target has be the same as the
attached one. This assertion isn't correct for the event targets which
were copied from the targetElement sub tree of an SVGUseElement to the
shadow tree.

Test: svg/custom/add-event-listener-shadow-tree-element.html

• bindings/js/JSLazyEventListener.cpp:

(WebCore::isCloneInShadowTreeOfSVGUseElement):
(WebCore::JSLazyEventListener::checkValidityForEventTarget):

LayoutTests:

• svg/custom/add-event-listener-shadow-tree-element-expected.txt: Added.
• svg/custom/add-event-listener-shadow-tree-element.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/svg/custom/add-event-listener-shadow-tree-element-expected.txt (added)
• LayoutTests/svg/custom/add-event-listener-shadow-tree-element.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/bindings/js/JSLazyEventListener.cpp (modified) (3 diffs)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2019-07-25  Said Abou-Hallawa  <sabouhallawa@apple.com>
+
+        REGRESSION (r244995): Assertion failure when addEventListener to an SVGElement which has an. instance in shadow tree
+        https://bugs.webkit.org/show_bug.cgi?id=200083
+
+        Reviewed by Ryosuke Niwa.
+
+        * svg/custom/add-event-listener-shadow-tree-element-expected.txt: Added.
+        * svg/custom/add-event-listener-shadow-tree-element.html: Added.
+
 2019-07-25  Truitt Savell  <tsavell@apple.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2019-07-25  Said Abou-Hallawa  <sabouhallawa@apple.com>
+
+        REGRESSION (r244995): Assertion failure when addEventListener to an SVGElement which has an. instance in shadow tree
+        https://bugs.webkit.org/show_bug.cgi?id=200083
+
+        Reviewed by Ryosuke Niwa.
+
+        When adding an event listener to an SVGElement, the same event listener
+        has to be add to all the instances of SVGElement in the shadow tree. See
+        SVGElement::addEventListener().
+
+        In r244995, an assertion was added to ensure if the event listener is
+        attached to an event target, the new event target has be the same as the
+        attached one. This assertion isn't correct for the event targets which 
+        were copied from the targetElement sub tree of an SVGUseElement to the
+        shadow tree.
+
+        Test: svg/custom/add-event-listener-shadow-tree-element.html
+
+        * bindings/js/JSLazyEventListener.cpp:
+        (WebCore::isCloneInShadowTreeOfSVGUseElement):
+        (WebCore::JSLazyEventListener::checkValidityForEventTarget):
+
 2019-07-25  Truitt Savell  <tsavell@apple.com>
 

trunk/Source/WebCore/bindings/js/JSLazyEventListener.cpp

@@ -27 +27 @@
 #include "JSNode.h"
 #include "QualifiedName.h"
+#include "SVGElement.h"
 #include "ScriptController.h"
 #include <JavaScriptCore/CatchScope.h>
@@ -81 +82 @@
 
 #if !ASSERT_DISABLED
+static inline bool isCloneInShadowTreeOfSVGUseElement(Node& originalNode, EventTarget& eventTarget)
+{
+    if (!eventTarget.isNode())
+        return false;
+
+    auto& node = downcast<Node>(eventTarget);
+    if (!is<SVGElement>(node))
+        return false;
+
+    auto& element = downcast<SVGElement>(node);
+    if (!element.correspondingElement())
+        return false;
+
+    ASSERT(element.isInShadowTree());
+    return &originalNode == element.correspondingElement();
+}
+
 // This is to help find the underlying cause of <rdar://problem/24314027>.
 void JSLazyEventListener::checkValidityForEventTarget(EventTarget& eventTarget)
@@ -86 +104 @@
     if (eventTarget.isNode()) {
         ASSERT(m_originalNode);
-        ASSERT(static_cast<EventTarget*>(m_originalNode.get()) == &eventTarget);
+        ASSERT(static_cast<EventTarget*>(m_originalNode.get()) == &eventTarget || isCloneInShadowTreeOfSVGUseElement(*m_originalNode, eventTarget));
     } else
         ASSERT(!m_originalNode);