Do not call an event listener on a cloned node in svg <use>'s UA shadow tree

third_party/WebKit/Source/core/events/EventPath.cpp

 /*
  * Copyright (C) 2013 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Neither the name of Google Inc. nor the names of its
@@ skipping 17 matching lines @@
 
 #include "core/EventNames.h"
 #include "core/dom/Document.h"
 #include "core/dom/Touch.h"
 #include "core/dom/TouchList.h"
 #include "core/dom/shadow/InsertionPoint.h"
 #include "core/dom/shadow/ShadowRoot.h"
 #include "core/events/TouchEvent.h"
 #include "core/events/TouchEventContext.h"
 #include "core/html/HTMLSlotElement.h"
+#include "core/svg/SVGUseElement.h"
 
 namespace blink {
 
 EventTarget* EventPath::eventTargetRespectingTargetRules(Node& referenceNode)
 {
     if (referenceNode.isPseudoElement()) {
         ASSERT(referenceNode.parentNode());
         return referenceNode.parentNode();
     }
 
@@ skipping 21 matching lines @@
 void EventPath::initializeWith(Node& node, Event* event)
 {
     m_node = &node;
     m_event = event;
     m_windowEventContext = nullptr;
     m_nodeEventContexts.clear();
     m_treeScopeEventContexts.clear();
     initialize();
 }
 
-static inline bool eventPathShouldBeEmptyFor(Node& node)
+static inline bool eventPathShouldBeEmptyFor(Node& node, Event* event)
 {
-    return node.isPseudoElement() && !node.parentElement();
+    if (node.isPseudoElement() && !node.parentElement())
+        return true;
+
+    // Do not dispatch non-composed events in SVG use trees.
+    if (node.isSVGElement()) {
+        if (toSVGElement(node).inUseShadowTree() && event && !event->composed())
+            return true;
+    }
+
+    return false;
 }
 
 void EventPath::initialize()
 {
-    if (eventPathShouldBeEmptyFor(*m_node))
+    if (eventPathShouldBeEmptyFor(*m_node, m_event))
         return;
+
     calculatePath();
     calculateAdjustedTargets();
     calculateTreeOrderAndSetNearestAncestorClosedTree();
 }
 
 void EventPath::calculatePath()
 {
     ASSERT(m_node);
     ASSERT(m_nodeEventContexts.isEmpty());
     m_node->updateDistribution();
 
     // For performance and memory usage reasons we want to store the
     // path using as few bytes as possible and with as few allocations
     // as possible which is why we gather the data on the stack before
     // storing it in a perfectly sized m_nodeEventContexts Vector.
     HeapVector<Member<Node>, 64> nodesInPath;
     Node* current = m_node;
+
+    // Exclude nodes in SVG <use>'s shadow tree from event path.
+    // See crbug.com/630870
+    while (current->isSVGElement()) {
+        SVGUseElement* correspondingUseElement = toSVGElement(current)->correspondingUseElement();
+        if (!correspondingUseElement)
+            break;
+        current = correspondingUseElement;
+    }
+
     nodesInPath.append(current);
     while (current) {
         if (m_event && current->keepEventInNode(m_event))
             break;
         HeapVector<Member<InsertionPoint>, 8> insertionPoints;
         collectDestinationInsertionPoints(*current, insertionPoints);
         if (!insertionPoints.isEmpty()) {
             for (const auto& insertionPoint : insertionPoints) {
                 if (insertionPoint->isShadowInsertionPoint()) {
                     ShadowRoot* containingShadowRoot = insertionPoint->containingShadowRoot();
@@ skipping 247 matching lines @@
 DEFINE_TRACE(EventPath)
 {
     visitor->trace(m_nodeEventContexts);
     visitor->trace(m_node);
     visitor->trace(m_event);
     visitor->trace(m_treeScopeEventContexts);
     visitor->trace(m_windowEventContext);
 }
 
 } // namespace blink