Do not call an event listener on a cloned node in svg <use>'s UA shadow tree
SVG <use> element tries to clone a user-provided subtree into its UA shadow tree.
This approach allows a user to access a cloned node in UA's shadow tree if a node
has an event listener.
e.g.
<svg>
<g id="a">
<image href="" onerror="window.nodes.push(event.target);">
</g>
<use href="#a">
</svg>
As a result, we will leak a node in <use>'s UA shadow tree.
Given the current implementation of <use>, we have to shrink an event path so
it does not include a node in <use>'s UA shadow tree.
A <use> element itself still receives an event if an event is a composed event.
This CL also reverts the most parts of https://codereview.chromium.org/312423002
because it is no longer valid in the latest SVG spec, and stop copying event
listeners from a referenced node into a cloned node because it is no longer
necessary.
BUG=630870
Review-Url: https://codereview.chromium.org/2186823002
Cr-Commit-Position: refs/heads/master@{#409455}
20 files changed
