Add connected-paranoia in SVGElement::UpdateRelativeLengthsInformation

third_party/WebKit/Source/core/svg/SVGElement.cpp

Index: third_party/WebKit/Source/core/svg/SVGElement.cpp
diff --git a/third_party/WebKit/Source/core/svg/SVGElement.cpp b/third_party/WebKit/Source/core/svg/SVGElement.cpp
index 25d8d4eecd93064456a649e57529cb6d98aad994..4517279f61bbf79946d5aefc1eefbe4637465718 100644
--- a/third_party/WebKit/Source/core/svg/SVGElement.cpp
+++ b/third_party/WebKit/Source/core/svg/SVGElement.cpp
@@ -535,10 +535,17 @@ void SVGElement::UpdateRelativeLengthsInformation(
     SVGElement* client_element) {
   DCHECK(client_element);
 
+  // Through an unfortunate chain of events, we can end up calling this while a

[fs, 2017/04/13 13:11:10]

My plan for a way to better address this is crbug.com/709437.

+  // subtree is being removed, and before the subtree has been properly
+  // "disconnected". Hence check the entire ancestor chain to avoid propagating
+  // relative length clients up into ancestors that have already been
+  // disconnected.
   // If we're not yet in a document, this function will be called again from
   // insertedInto(). Do nothing now.
-  if (!isConnected())
-    return;
+  for (Node& current_node : NodeTraversal::InclusiveAncestorsOf(*this)) {
+    if (!current_node.isConnected())
+      return;
+  }
 
   // An element wants to notify us that its own relative lengths state changed.
   // Register it in the relative length map, and register us in the parent