Add connected-paranoia in SVGElement::UpdateRelativeLengthsInformation

third_party/WebKit/Source/core/svg/SVGElement.cpp

 /*
  * Copyright (C) 2004, 2005, 2006, 2007, 2008 Nikolas Zimmermann
  * <zimmermann@kde.org>
  * Copyright (C) 2004, 2005, 2006, 2008 Rob Buis <buis@kde.org>
  * Copyright (C) 2008 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Alp Toker <alp@atoker.com>
  * Copyright (C) 2009 Cameron McCormack <cam@mcc.id.au>
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ skipping 517 matching lines @@
   }
 
   return property_name_to_id_map->at(attr_name.LocalName().Impl());
 }
 
 void SVGElement::UpdateRelativeLengthsInformation(
     bool client_has_relative_lengths,
     SVGElement* client_element) {
   DCHECK(client_element);
 
+  // Through an unfortunate chain of events, we can end up calling this while a

[fs, 2017/04/13 13:11:10]

My plan for a way to better address this is crbug.com/709437.

+  // subtree is being removed, and before the subtree has been properly
+  // "disconnected". Hence check the entire ancestor chain to avoid propagating
+  // relative length clients up into ancestors that have already been
+  // disconnected.
   // If we're not yet in a document, this function will be called again from
   // insertedInto(). Do nothing now.
-  if (!isConnected())
-    return;
+  for (Node& current_node : NodeTraversal::InclusiveAncestorsOf(*this)) {
+    if (!current_node.isConnected())
+      return;
+  }
 
   // An element wants to notify us that its own relative lengths state changed.
   // Register it in the relative length map, and register us in the parent
   // relative length map.  Register the parent in the grandparents map, etc.
   // Repeat procedure until the root of the SVG tree.
   for (Node& current_node : NodeTraversal::InclusiveAncestorsOf(*this)) {
     if (!current_node.IsSVGElement())
       break;
     SVGElement& current_element = ToSVGElement(current_node);
 #if DCHECK_IS_ON()
@@ skipping 780 matching lines @@
   visitor->Trace(class_name_);
   Element::Trace(visitor);
 }
 
 const AtomicString& SVGElement::EventParameterName() {
   DEFINE_STATIC_LOCAL(const AtomicString, evt_string, ("evt"));
   return evt_string;
 }
 
 }  // namespace blink