199426 2019-07-02 17:57:37 -0700 Assertion fires when setting the event of an SVG element which is referenced by a <use> element 2019-07-02 17:59:50 -0700 1 1 1 Unclassified WebKit SVG WebKit Nightly Build Unspecified Unspecified NEW InRadar P2 Normal --- 1 sabouhallawa webkit-unassigned webkit-bug-importer zimmermann oldest_to_newest 1549793 0 sabouhallawa 2019-07-02 17:57:37 -0700 Open the following test case in WebKit. <svg> <tspan id="text"/> <use xlink:href="#text"/> </svg> <script> setTimeout( function() { var text = document.getElementById("text"); text.setAttribute("onfocusout", "onfocusout"); }, 0); </script> Result: The following assertion fires: #0 0x000000011300b5e0 in ::WTFCrash() #1 0x0000000118bd32db in WTFCrashWithInfo(int, char const*, char const*, int) #2 0x000000011ac58b0c in WebCore::JSLazyEventListener::checkValidityForEventTarget(WebCore::EventTarget&) #3 0x000000011b28a1b9 in WebCore::EventTarget::addEventListener(WTF::AtomString const&, WTF::Ref<WebCore::EventListener, WTF::DumbPtrTraits<WebCore::EventListener> >&&, WebCore::EventTarget::AddEventListenerOptions const&) #4 0x000000011b2fcea0 in WebCore::tryAddEventListener(WebCore::Node*, WTF::AtomString const&, WTF::Ref<WebCore::EventListener, WTF::DumbPtrTraits<WebCore::EventListener> >&&, WebCore::EventTarget::AddEventListenerOptions const&) #5 0x000000011b2fce38 in WebCore::Node::addEventListener(WTF::AtomString const&, WTF::Ref<WebCore::EventListener, WTF::DumbPtrTraits<WebCore::EventListener> >&&, WebCore::EventTarget::AddEventListenerOptions const&) #6 0x000000011c9717a0 in WebCore::SVGElement::addEventListener(WTF::AtomString const&, WTF::Ref<WebCore::EventListener, WTF::DumbPtrTraits<WebCore::EventListener> >&&, WebCore::EventTarget::AddEventListenerOptions const&) #7 0x000000011b28ae2b in WebCore::EventTarget::setAttributeEventListener(WTF::AtomString const&, WTF::RefPtr<WebCore::EventListener, WTF::DumbPtrTraits<WebCore::EventListener> >&&, WebCore::DOMWrapperWorld&) #8 0x000000011b240e86 in WebCore::Element::setAttributeEventListener(WTF::AtomString const&, WebCore::QualifiedName const&, WTF::AtomString const&) #9 0x000000011c9713c5 in WebCore::SVGElement::parseAttribute(WebCore::QualifiedName const&, WTF::AtomString const&) #10 0x000000011cac7e40 in WebCore::SVGGraphicsElement::parseAttribute(WebCore::QualifiedName const&, WTF::AtomString const&) #11 0x000000011cbe8d37 in WebCore::SVGTextContentElement::parseAttribute(WebCore::QualifiedName const&, WTF::AtomString const&) #12 0x000000011cbe5ad5 in WebCore::SVGTextPositioningElement::parseAttribute(WebCore::QualifiedName const&, WTF::AtomString const&) #13 0x000000011b23baa8 in WebCore::Element::attributeChanged(WebCore::QualifiedName const&, WTF::AtomString const&, WTF::AtomString const&, WebCore::Element::AttributeModificationReason) #14 0x000000011b39778f in WebCore::StyledElement::attributeChanged(WebCore::QualifiedName const&, WTF::AtomString const&, WTF::AtomString const&, WebCore::Element::AttributeModificationReason) #15 0x000000011c9720fb in WebCore::SVGElement::attributeChanged(WebCore::QualifiedName const&, WTF::AtomString const&, WTF::AtomString const&, WebCore::Element::AttributeModificationReason) #16 0x000000011b2429df in WebCore::Element::didAddAttribute(WebCore::QualifiedName const&, WTF::AtomString const&) #17 0x000000011b242923 in WebCore::Element::addAttributeInternal(WebCore::QualifiedName const&, WTF::AtomString const&, WebCore::Element::SynchronizationOfLazyAttribute) #18 0x000000011b23b241 in WebCore::Element::setAttributeInternal(unsigned int, WebCore::QualifiedName const&, WTF::AtomString const&, WebCore::Element::SynchronizationOfLazyAttribute) #19 0x000000011b23b4fd in WebCore::Element::setAttribute(WTF::AtomString const&, WTF::AtomString const&) 1549794 1 373374 sabouhallawa 2019-07-02 17:58:24 -0700 Created attachment 373374 test case 1549795 2 sabouhallawa 2019-07-02 17:59:50 -0700 <rdar://problem/52424891> 373374 2019-07-02 17:58:24 -0700 2019-07-02 17:58:24 -0700 test case test-case.html text/html 232 sabouhallawa PHN2Zz4KICAgIDx0c3BhbiBpZD0idGV4dCIvPgogICAgPHVzZSB4bGluazpocmVmPSIjdGV4dCIv Pgo8L3N2Zz4KPHNjcmlwdD4KICAgIHNldFRpbWVvdXQoIGZ1bmN0aW9uKCkgewogICAgICAgIHZh ciB0ZXh0ID0gZG9jdW1lbnQuZ2V0RWxlbWVudEJ5SWQoInRleHQiKTsKICAgICAgICB0ZXh0LnNl dEF0dHJpYnV0ZSgib25mb2N1c291dCIsICJvbmZvY3Vzb3V0Iik7CiAgICB9LCAwKTsKPC9zY3Jp cHQ+Cg==