SVGUseElement's lifecycle management for its shadow tree might be wrong |
|||||
Issue descriptionSee https://bugs.chromium.org/p/chromium/issues/detail?id=630870#c20 (restricted) for the context.
,
Nov 28 2016
Let me raise the priority to P1. See https://bugs.chromium.org/p/chromium/issues/detail?id=667324#c9. Do SVG folks have a plan to work on this soon?
,
Nov 28 2016
If you could expand on what you'd consider the "right management", then maybe.
,
Nov 29 2016
Ah, that makes sense. :) Let me assign this issue to me tentatively, as my backlog item.
,
Nov 30 2016
,
Nov 30 2016
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/66a0e78c24b56758cd9733959f583e6e75fa2b66 commit 66a0e78c24b56758cd9733959f583e6e75fa2b66 Author: hayato <hayato@chromium.org> Date: Wed Nov 30 10:14:02 2016 Stop a SVG <use> element from modifying its UA shadow tree when it is removed Each element should not modify its UA shadow tree when being removed. That is like a *double-free* because a super class's |removedFrom()| handles that. BUG= 630870 , 637641 Review-Url: https://codereview.chromium.org/2537143004 Cr-Commit-Position: refs/heads/master@{#435205} [modify] https://crrev.com/66a0e78c24b56758cd9733959f583e6e75fa2b66/third_party/WebKit/Source/core/svg/SVGUseElement.cpp
,
Dec 1 2016
|
|||||
►
Sign in to add a comment |
|||||
Comment 1 by hayato@chromium.org
, Nov 28 2016