search

LadybirdBrowser / ladybird

Truly independent web browser
https://ladybird.org
BSD 2-Clause "Simplified" License
19.5k stars 790 forks source link

SVG: Stack overflow when multiple `<use>` elements refer to the same parent #861

Open AtkinsSJ opened 1 month ago

AtkinsSJ commented 1 month ago

Found with domato.

<svg id="svg">
    <use xlink:href="#svg" />
    <use xlink:href="#svg" />
</svg>

I think this last paragraph in 5.5.1. The use-element shadow tree is relevant:

When a ‘use’ references another element which is another ‘use’ or whose content contains a ‘use’ element, then the shadow DOM cloning approach described above is recursive. However, a set of references that directly or indirectly reference a element to create a circular dependency is an invalid circular reference. The ‘use’ element or element instance whose shadow tree would create the circular reference is in error and must not be rendered by the user agent.

shannonbooth commented 1 month ago

For some reason I can't seem to reproduce this any longer

AtkinsSJ commented 3 weeks ago

I still can. Note that it doesn't show up as a "web content has crashed" message - the WebContent process just dies in a way that the UI doesn't notice. If you try right-clicking the page nothing happens.

That's a whole separate issue...