Bug 5792 – Crasher on rendering-shapes from SVG 1.0 testsuite

• Status: RESOLVED
• Resolution: FIXED
• Component: DOM

[Rob Buis]

Using the latest Webkit cvs checkout (with svg enabled) and using
run-safari --svg the mentioned svg crashes safari on my system.

[Eric Seidel (no email)]

I too have seen a crash when browsing the 1.0 test suite:
http://www.w3.org/Graphics/SVG/Test/20011026/rendering-shape-BE-03-ps.html

I'm not yet sure why.

[Eric Seidel (no email)]

Yes, this is what I expected.  This is another example of the misterious libxml crash:

#0	??
#1	0x92c0b054 in xmlParseCharData
#2	0x92c26fb0 in xmlParseContent
#3	0x92c2a4f4 in xmlParseBalancedChunkMemory
#4	0x92c2313c in xmlParseReference
#5	0x92c28704 in xmlParseDocument
#6	0x92c0cc0c in xmlParseChunk
#7	0x0184d118 in khtml::parseQString at xml_tokenizer.cpp:188
#8	0x0184e67c in khtml::XMLTokenizer::finish at xml_tokenizer.cpp:646
#9	0x018123ec in DOM::DocumentImpl::finishParsing at dom_docimpl.cpp:1568
#10	0x016c1b88 in KHTMLPart::endIfNotLoading at khtml_part.cpp:1115
#11	0x016c1bdc in KHTMLPart::end at khtml_part.cpp:1103
#12	0x016a5dd8 in -[WebCoreBridge end] at WebCoreBridge.mm:521

It looks to me like a bug in libxml, but I'm not sure.

[Alexey Proskuryakov]

Created attachment 5505 [details]
test case

[Alexey Proskuryakov]

Apparently, something doesn't like entity declarations where content starts with a whitespace.

[Eric Seidel (no email)]

ap noted in IRC this might be: http://bugzilla.gnome.org/show_bug.cgi?id=172255  he has a workaround 
patch.

[Alexey Proskuryakov]

Created attachment 5507 [details]
proposed fix

Work around <http://bugzilla.gnome.org/show_bug.cgi?id=172255>.

[Eric Seidel (no email)]

Comment on attachment 5507 [details]
proposed fix

Beautiful.  r=me

[Lucas Forschler]

Mass moving XML DOM bugs to the "DOM" Component.