angler-fishThe Vulnerability History Project

Avoid transiently creating disallowed elements when building <use> trees

      When building a shadow tree for a <use>, a direct reference to a
&quotdisallowed&quot element would cause the element to first be inserted before
buildShadowTree() noticed it's disallowed and returns false, so it's
removed again.
This transient mutation could take place while computing an animation
update, if a CSS property was being animated and the layout tree/style
was dirty.
Avoid the insert-remove sequence by checking if the initial target is
disallowed up-front. This matches how it's done in the general subtree
building case inside buildShadowTree().

BUG=478549

Review URL: https://codereview.chromium.org/1105873002

git-svn-id: svn://svn.chromium.org/blink/trunk@194421 bbb929c8-8fbe-4397-9dbb-9b2b20218538
    
commit e0cccdf7c7f1a7e666b65c59b336d47bfe5a53b8
-1
-35
+1 -1
expand_less