Do not call an event listener on a cloned node in svg <use>'s UA shadow tree

third_party/WebKit/Source/core/events/EventPath.cpp

 /*
  * Copyright (C) 2013 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Neither the name of Google Inc. nor the names of its
@@ skipping 17 matching lines @@
 
 #include "core/EventNames.h"
 #include "core/dom/Document.h"
 #include "core/dom/Touch.h"
 #include "core/dom/TouchList.h"
 #include "core/dom/shadow/InsertionPoint.h"
 #include "core/dom/shadow/ShadowRoot.h"
 #include "core/events/TouchEvent.h"
 #include "core/events/TouchEventContext.h"
 #include "core/html/HTMLSlotElement.h"
+#include "core/svg/SVGUseElement.h"
 
 namespace blink {
 
 EventTarget* EventPath::eventTargetRespectingTargetRules(Node& referenceNode)
 {
     if (referenceNode.isPseudoElement()) {
         ASSERT(referenceNode.parentNode());
         return referenceNode.parentNode();
     }
 
@@ skipping 21 matching lines @@
 void EventPath::initializeWith(Node& node, Event* event)
 {
     m_node = &node;
     m_event = event;
     m_windowEventContext = nullptr;
     m_nodeEventContexts.clear();
     m_treeScopeEventContexts.clear();
     initialize();
 }
 
-static inline bool eventPathShouldBeEmptyFor(Node& node)
+static inline bool isInSVGUseShadowTree(Node& node)
 {
-    return node.isPseudoElement() && !node.parentElement();
+    if (ShadowRoot* root = node.containingShadowRoot())
+        return root->type() == ShadowRootType::UserAgent && isSVGUseElement(root->host());
+    return false;
+}
+
+static inline bool eventPathShouldBeEmptyFor(Node& node, Event* event)
+{
+    return (node.isPseudoElement() && !node.parentElement()) || (isInSVGUseShadowTree(node) && event && !event->composed());

[pdr., 2016/07/30 04:02:42]

WDYT of breaking these two complex cases apart as if statements?

if (node.isPseudoElement() && !node.parentElement())
    return true;

// Exclude non-composed events from SVG use trees.
if (node.isSVGElement()) {
    if (toSVGElement(node).inUseShadowTree() && event && !event->composed())
        return true;
}

return false;

[hayato, 2016/08/01 03:44:10]

Sounds nice. Done

 }
 
 void EventPath::initialize()
 {
-    if (eventPathShouldBeEmptyFor(*m_node))
+    if (eventPathShouldBeEmptyFor(*m_node, m_event))
         return;
+
     calculatePath();
     calculateAdjustedTargets();
     calculateTreeOrderAndSetNearestAncestorClosedTree();
 }
 
 void EventPath::calculatePath()

[pdr., 2016/07/30 04:02:42]

I'm not very familiar with the event apis. Can you think of any ways other than
the event path that node information be exposed? For example, do we need to
worry about the event's currentTarget or srcElement?

I wonder if we could add a DCHECK in a central place to catch leaking of user
agent shadow tree nodes (svg or otherwise)?

 {
     ASSERT(m_node);
     ASSERT(m_nodeEventContexts.isEmpty());
     m_node->updateDistribution();
 
     // For performance and memory usage reasons we want to store the
     // path using as few bytes as possible and with as few allocations
     // as possible which is why we gather the data on the stack before
     // storing it in a perfectly sized m_nodeEventContexts Vector.
     HeapVector<Member<Node>, 64> nodesInPath;
     Node* current = m_node;
+
+    // Exclude nodes in SVG <use>'s shadow tree from event path.
+    // See crbug.com/630870
+    while (isInSVGUseShadowTree(*current))

[pdr., 2016/07/30 04:02:42]

I think this can be rewritten using existing apis to avoid having to add
isInSVGUseShadowTree:
while (current->isSVGElement()) {
    SVGUseElement* correspondingUseElement =
toSVGElement(current)->correspondingUseElement();
    if (!correspondingUseElement)
        break;
    current = correspondingUseElement;
}

[hayato, 2016/08/01 03:44:10]

Thanks! Done.

+        current = &current->containingShadowRoot()->host();
+
     nodesInPath.append(current);
     while (current) {
         if (m_event && current->keepEventInNode(m_event))
             break;
         HeapVector<Member<InsertionPoint>, 8> insertionPoints;
         collectDestinationInsertionPoints(*current, insertionPoints);
         if (!insertionPoints.isEmpty()) {
             for (const auto& insertionPoint : insertionPoints) {
                 if (insertionPoint->isShadowInsertionPoint()) {
                     ShadowRoot* containingShadowRoot = insertionPoint->containingShadowRoot();
@@ skipping 247 matching lines @@
 DEFINE_TRACE(EventPath)
 {
     visitor->trace(m_nodeEventContexts);
     visitor->trace(m_node);
     visitor->trace(m_event);
     visitor->trace(m_treeScopeEventContexts);
     visitor->trace(m_windowEventContext);
 }
 
 } // namespace blink