gecko-dev/dom/svg/crashtests/1486488.html
Emilio Cobos Álvarez a1f03332c2 Bug 1486488 - Don't assume that SVGAnimationElement has a parent on bind. r=dholbert
This is a regression from bug 1450250, which removed a if (!GetCx()) early
return in this function.

That early return was wrong, both because it prevented elements that were in
shadow trees from targeting other elements, but also because that check was not
present in AfterSetAttr, which means that dynamic updates to the attribute would
work.

Pass the SVGAnimationElement itself to resolve references. That's what we do for
attribute mutations, and also it's the same behavior we have, since the ID
lookup IDTracker does only depends on containing shadow root and containing
document, and that's invariant between a kid and it's DOM parent.

Some other code has been updated to take references instead of pointers so the
null-safety of those methods is explicit.

Differential Revision: https://phabricator.services.mozilla.com/D4349

--HG--
extra : moz-landing-system : lando
2018-08-28 09:06:08 +00:00

12 lines
218 B
HTML

<script>
function start() {
document.replaceChild(id_0, document.childNodes[0]);
}
</script>
<body onload="start()">
<svg>
<animate id="id_0" begin="s" />
<ellipse id="id_1" />
</svg>
</body>