Stop a SVG <use> element from modifying its UA shadow tree when it is removed

Stop a SVG <use> element from modifying its UA shadow tree when it is removed

Each element should not modify its UA shadow tree when being removed.
That is like a *double-free* because a super class's |removedFrom()| handles that.

BUG=630870, 637641
Committed: https://crrev.com/66a0e78c24b56758cd9733959f583e6e75fa2b66
Cr-Commit-Position: refs/heads/master@{#435205}

[hayato, 2016-11-30 07:10:24]

The CQ bit was checked by hayato@chromium.org to run a CQ dry run

[hayato, 2016-11-30 07:10:49]

Description was changed from

==========
Stop a SVG <use> element from modifying its UA Shadow tree in removedFrom().

BUG=637641
==========

to

==========
Stop a SVG <use> element from modifying its UA Shadow tree in removedFrom()

BUG=637641
==========

[commit-bot: I haz the power, 2016-11-30 07:11:07]

Dry run: CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[hayato, 2016-11-30 07:19:37]

Description was changed from

==========
Stop a SVG <use> element from modifying its UA Shadow tree in removedFrom()

BUG=637641
==========

to

==========
Stop a SVG <use> element from modifying its UA shadow tree when it is removed

Each element should not modify its UA shadow tree when being removed.
That is like a *double-free* because a super class's removedFrom handles that.

BUG=637641
==========

[hayato, 2016-11-30 07:20:08]

Description was changed from

==========
Stop a SVG <use> element from modifying its UA shadow tree when it is removed

Each element should not modify its UA shadow tree when being removed.
That is like a *double-free* because a super class's removedFrom handles that.

BUG=637641
==========

to

==========
Stop a SVG <use> element from modifying its UA shadow tree when it is removed

Each element should not modify its UA shadow tree when being removed.
That is like a *double-free* because a super class's |removedFrom()| handles
that.

BUG=637641
==========

[hayato, 2016-11-30 07:27:57]

hayato@chromium.org changed reviewers:
+ fs@opera.com, tkent@chromium.org

[hayato, 2016-11-30 07:27:57]

PTAL

[tkent, 2016-11-30 07:43:19]

I don't have enough context.  Is this a behaivor change? Or just removing
redundant work?

[hayato, 2016-11-30 08:03:25]

No behavior change. This removes redundant work, which caused a XSS security
bug.

See https://bugs.chromium.org/p/chromium/issues/detail?id=630870 for details.

[hayato, 2016-11-30 08:05:02]

Description was changed from

==========
Stop a SVG <use> element from modifying its UA shadow tree when it is removed

Each element should not modify its UA shadow tree when being removed.
That is like a *double-free* because a super class's |removedFrom()| handles
that.

BUG=637641
==========

to

==========
Stop a SVG <use> element from modifying its UA shadow tree when it is removed

Each element should not modify its UA shadow tree when being removed.
That is like a *double-free* because a super class's |removedFrom()| handles
that.

BUG=630870,637641
==========

[tkent, 2016-11-30 08:14:00]

lgtm

[hayato, 2016-11-30 08:48:40]

The CQ bit was unchecked by hayato@chromium.org

[hayato, 2016-11-30 08:48:43]

The CQ bit was checked by hayato@chromium.org

[commit-bot: I haz the power, 2016-11-30 08:49:02]

CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2016-11-30 10:14:05]

CQ is committing da patch.

Bot data: {"patchset_id": 1, "attempt_start_ts": 1480495723711340, "parent_rev":
"fef3784ca53dc769e85b1d78a8af5be5e8ebfb6d", "commit_rev":
"77b2a4891db6524edb7f9f23bd1924de6270b272"}

[commit-bot: I haz the power, 2016-11-30 10:14:35]

Committed patchset #1 (id:1)

[commit-bot: I haz the power, 2016-11-30 10:17:26]

Description was changed from

==========
Stop a SVG <use> element from modifying its UA shadow tree when it is removed

Each element should not modify its UA shadow tree when being removed.
That is like a *double-free* because a super class's |removedFrom()| handles
that.

BUG=630870,637641
==========

to

==========
Stop a SVG <use> element from modifying its UA shadow tree when it is removed

Each element should not modify its UA shadow tree when being removed.
That is like a *double-free* because a super class's |removedFrom()| handles
that.

BUG=630870,637641

Committed: https://crrev.com/66a0e78c24b56758cd9733959f583e6e75fa2b66
Cr-Commit-Position: refs/heads/master@{#435205}
==========

[commit-bot: I haz the power, 2016-11-30 10:17:27]

Patchset 1 (id:??) landed as
https://crrev.com/66a0e78c24b56758cd9733959f583e6e75fa2b66
Cr-Commit-Position: refs/heads/master@{#435205}