Bug 1828473 [wpt PR 39571] - Handle detached documents in SVGLengthCo…

…ntext, a=testonly Automatic update from web-platform-tests Handle detached documents in SVGLengthContext The StyleResolver gets torn down when the Document it is associated to is detached/shutdown. Check for this in ComputedStyleForLengthResolving(), and return null if so. Restore null-checks in callers. Bug: 1433491 Change-Id: I1f6b934e20f52aba1ebd486a1030e6ec1a34e0bb Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4432192 Commit-Queue: Fredrik Söderquist <fs@opera.com> Reviewed-by: Stephen Chenney <schenney@chromium.org> Cr-Commit-Position: refs/heads/main@{#1131267} -- wpt-commits: 0a8be219fcbcc9b38ad1645203f63df4555146d2 wpt-pr: 39571
mozilla · Apr 19, 2023 · dfda088 · dfda088
1 parent 35384ac
commit dfda088
Showing 1 changed file with 11 additions and 0 deletions.
diff --git a/...form/tests/svg/types/scripted/svglength-value-access-when-in-detached-document-crash.html b/...form/tests/svg/types/scripted/svglength-value-access-when-in-detached-document-crash.html
@@ -0,0 +1,11 @@
+<!doctype html>
+<title>Attempting to resolve a font-relative (em) SVGLength in a detached document does not crash</title>
+<iframe></iframe>
+<script>
+  const rect = document.createElementNS("http://www.w3.org/2000/svg", "rect");
+  rect.setAttribute("height", "16em");
+  const iframe = document.querySelector('iframe');
+  iframe.contentDocument.documentElement.appendChild(rect);
+  iframe.remove();
+  rect.height.baseVal.value;
+</script>