107324 2013-01-18 13:58:30 -0800 Asserts when textPath is used with no path 2013-01-22 08:54:21 -0800 1 1 1 Unclassified WebKit SVG 528+ (Nightly build) Unspecified Unspecified RESOLVED FIXED P2 Normal --- 1 schenney schenney d-r eric fmalita krit ojan.autocc pdr webkit.review.bot zimmermann oldest_to_newest 811017 0 schenney 2013-01-18 13:58:30 -0800 We assert in SVGTextLayoutEngine when the textPath element has no path associated with it: ASSERTION FAILED: ok ../../third_party/WebKit/Source/WebCore/rendering/svg/SVGTextLayoutEngine.cpp(562) : void WebCore::SVGTextLayoutEngine::layoutTextOnLineOrPath(WebCore::SVGInlineTextBox *, WebCore::RenderSVGInlineText *, const WebCore::RenderStyle *) Turns out that we totally fail to check for this case, which normally isn't a problem (this is not a security issue) because the text path just returns 0,0 or something for any point on the path when the path doesn't exist. Fix imminent. 811061 1 183550 schenney 2013-01-18 14:42:00 -0800 Created attachment 183550 Patch 811064 2 183550 eric 2013-01-18 14:48:36 -0800 Comment on attachment 183550 Patch So long as this early return leaves the rendering tree in an expected state, then this seems fine. 813071 3 schenney 2013-01-22 08:54:21 -0800 Committed r140429: <http://trac.webkit.org/changeset/140429> 183550 2013-01-18 14:42:00 -0800 2013-01-18 14:48:36 -0800 Patch bug-107324-20130118173859.patch text/plain 3662 schenney SW5kZXg6IFNvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2Vi Q29yZS9DaGFuZ2VMb2cJKHJldmlzaW9uIDE0MDIwNSkKKysrIFNvdXJjZS9XZWJDb3JlL0NoYW5n ZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDIwIEBACisyMDEzLTAxLTE4ICBTdGVwaGVu IENoZW5uZXkgIDxzY2hlbm5leUBjaHJvbWl1bS5vcmc+CisKKyAgICAgICAgQXNzZXJ0cyB3aGVu IHRleHRQYXRoIGlzIHVzZWQgd2l0aCBubyBwYXRoCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJr aXQub3JnL3Nob3dfYnVnLmNnaT9pZD0xMDczMjQKKworICAgICAgICBSZXZpZXdlZCBieSBOT0JP RFkgKE9PUFMhKS4KKworICAgICAgICBXZSBhc3NlcnQgd2hlbiB0aGVyZSBpcyBubyBwYXRoIGFz c29jaWF0ZWQgd2l0aCBhbiBTVkcgdGV4dCBwYXRoCisgICAgICAgIGVsZW1lbnQuIEluc3RlYWQs IHRoaXMgcGF0Y2ggZGV0ZWN0cyB0aGUgY29uZGl0aW9uIGFuZCBzdG9wcyB0cnlpbmcgdG8KKyAg ICAgICAgbGF5b3V0IHRleHQgZm9yIHRoYXQgdGV4dFBhdGggIGVsZW1lbnQuCisKKyAgICAgICAg VGVzdDogc3ZnL3RleHQvdHBhdGgtd2l0aG91dC1wYXRoLnN2ZworCisgICAgICAgICogcmVuZGVy aW5nL3N2Zy9TVkdUZXh0TGF5b3V0RW5naW5lLmNwcDoKKyAgICAgICAgKFdlYkNvcmU6OlNWR1Rl eHRMYXlvdXRFbmdpbmU6OmJlZ2luVGV4dFBhdGhMYXlvdXQpOgorICAgICAgICAoV2ViQ29yZTo6 U1ZHVGV4dExheW91dEVuZ2luZTo6bGF5b3V0VGV4dE9uTGluZU9yUGF0aCk6CisKIDIwMTMtMDEt MTggIENocmlzIEhvcG1hbiAgPGNqaG9wbWFuQGdvb2dsZS5jb20+CiAKICAgICAgICAgRml4IHNj cm9sbFJlY3RUb1Zpc2libGUgaW4gdGhlIHByZXNlbmNlIG9mIHRyYW5zZm9ybXMKSW5kZXg6IFNv dXJjZS9XZWJDb3JlL3JlbmRlcmluZy9zdmcvU1ZHVGV4dExheW91dEVuZ2luZS5jcHAKPT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PQotLS0gU291cmNlL1dlYkNvcmUvcmVuZGVyaW5nL3N2Zy9TVkdUZXh0TGF5b3V0RW5naW5l LmNwcAkocmV2aXNpb24gMTQwMDI1KQorKysgU291cmNlL1dlYkNvcmUvcmVuZGVyaW5nL3N2Zy9T VkdUZXh0TGF5b3V0RW5naW5lLmNwcAkod29ya2luZyBjb3B5KQpAQCAtMTcxLDYgKzE3MSw4IEBA IHZvaWQgU1ZHVGV4dExheW91dEVuZ2luZTo6YmVnaW5UZXh0UGF0aEwKICAgICBSZW5kZXJTVkdU ZXh0UGF0aCogdGV4dFBhdGggPSB0b1JlbmRlclNWR1RleHRQYXRoKG9iamVjdCk7CiAKICAgICBt X3RleHRQYXRoID0gdGV4dFBhdGgtPmxheW91dFBhdGgoKTsKKyAgICBpZiAobV90ZXh0UGF0aC5p c0VtcHR5KCkpCisgICAgICAgIHJldHVybjsKICAgICBtX3RleHRQYXRoU3RhcnRPZmZzZXQgPSB0 ZXh0UGF0aC0+c3RhcnRPZmZzZXQoKTsKICAgICBtX3RleHRQYXRoTGVuZ3RoID0gbV90ZXh0UGF0 aC5sZW5ndGgoKTsKICAgICBpZiAobV90ZXh0UGF0aFN0YXJ0T2Zmc2V0ID4gMCAmJiBtX3RleHRQ YXRoU3RhcnRPZmZzZXQgPD0gMSkKQEAgLTQyMyw2ICs0MjUsOSBAQCB2b2lkIFNWR1RleHRMYXlv dXRFbmdpbmU6OmFkdmFuY2VUb05leHRWCiAKIHZvaWQgU1ZHVGV4dExheW91dEVuZ2luZTo6bGF5 b3V0VGV4dE9uTGluZU9yUGF0aChTVkdJbmxpbmVUZXh0Qm94KiB0ZXh0Qm94LCBSZW5kZXJTVkdJ bmxpbmVUZXh0KiB0ZXh0LCBjb25zdCBSZW5kZXJTdHlsZSogc3R5bGUpCiB7CisgICAgaWYgKG1f aW5QYXRoTGF5b3V0ICYmIG1fdGV4dFBhdGguaXNFbXB0eSgpKQorICAgICAgICByZXR1cm47CisK ICAgICBTVkdFbGVtZW50KiBsZW5ndGhDb250ZXh0ID0gc3RhdGljX2Nhc3Q8U1ZHRWxlbWVudCo+ KHRleHQtPnBhcmVudCgpLT5ub2RlKCkpOwogICAgIAogICAgIFJlbmRlck9iamVjdCogdGV4dFBh cmVudCA9IHRleHQtPnBhcmVudCgpOwpJbmRleDogTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCj09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT0KLS0tIExheW91dFRlc3RzL0NoYW5nZUxvZwkocmV2aXNpb24gMTQwMjA1KQorKysgTGF5 b3V0VGVzdHMvQ2hhbmdlTG9nCSh3b3JraW5nIGNvcHkpCkBAIC0xLDMgKzEsMTUgQEAKKzIwMTMt MDEtMTggIFN0ZXBoZW4gQ2hlbm5leSAgPHNjaGVubmV5QGNocm9taXVtLm9yZz4KKworICAgICAg ICBBc3NlcnRzIHdoZW4gdGV4dFBhdGggaXMgdXNlZCB3aXRoIG5vIHBhdGgKKyAgICAgICAgaHR0 cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTEwNzMyNAorCisgICAgICAgIFJl dmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIFRlc3Qgd2lsbCBhc3NlcnQgaW4g ZGVidWcgd2l0aG91dCB0aGlzIHBhdGNoLgorCisgICAgICAgICogc3ZnL3RleHQvdHBhdGgtd2l0 aG91dC1wYXRoLWV4cGVjdGVkLnR4dDogQWRkZWQuCisgICAgICAgICogc3ZnL3RleHQvdHBhdGgt d2l0aG91dC1wYXRoLnN2ZzogQWRkZWQuCisKIDIwMTMtMDEtMTggIENocmlzIEhvcG1hbiAgPGNq aG9wbWFuQGdvb2dsZS5jb20+CiAKICAgICAgICAgRml4IHNjcm9sbFJlY3RUb1Zpc2libGUgaW4g dGhlIHByZXNlbmNlIG9mIHRyYW5zZm9ybXMKSW5kZXg6IExheW91dFRlc3RzL3N2Zy90ZXh0L3Rw YXRoLXdpdGhvdXQtcGF0aC1leHBlY3RlZC50eHQKPT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gTGF5b3V0VGVzdHMv c3ZnL3RleHQvdHBhdGgtd2l0aG91dC1wYXRoLWV4cGVjdGVkLnR4dAkocmV2aXNpb24gMCkKKysr IExheW91dFRlc3RzL3N2Zy90ZXh0L3RwYXRoLXdpdGhvdXQtcGF0aC1leHBlY3RlZC50eHQJKHJl dmlzaW9uIDApCkBAIC0wLDAgKzEsMiBAQAorWAorVGVzdCBQYXNzZXMgaWYgeW91IGdldCBhbiBY LCBhbmQgbm8gY3Jhc2gKSW5kZXg6IExheW91dFRlc3RzL3N2Zy90ZXh0L3RwYXRoLXdpdGhvdXQt cGF0aC5zdmcKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PQotLS0gTGF5b3V0VGVzdHMvc3ZnL3RleHQvdHBhdGgtd2l0aG91 dC1wYXRoLnN2ZwkocmV2aXNpb24gMCkKKysrIExheW91dFRlc3RzL3N2Zy90ZXh0L3RwYXRoLXdp dGhvdXQtcGF0aC5zdmcJKHJldmlzaW9uIDApCkBAIC0wLDAgKzEsMTUgQEAKKzxzdmcgeG1sbnM9 Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvc3ZnIj4KKyAgICA8c2NyaXB0PgorICAgIAlpZiAod2lu ZG93LnRlc3RSdW5uZXIpCisgICAgCSAgICB0ZXN0UnVubmVyLmR1bXBBc1RleHQoKTsKKyAgICA8 L3NjcmlwdD4KKyAgICA8ZyB0cmFuc2Zvcm09InRyYW5zbGF0ZSgyNSwyNSkiPgorCSAgICA8dGV4 dCBmb250LXNpemU9IjIwIj4KKwkJCTx0ZXh0UGF0aCB0ZXh0LWFuY2hvcj0ibWlkZGxlIj4KKwkJ CQk8dHNwYW4+WDwvdHNwYW4+CisJCQk8L3RleHRQYXRoPgorCQk8L3RleHQ+CisJCTx0ZXh0IHk9 IjI1Ij5UZXN0IFBhc3NlcyBpZiB5b3UgZ2V0IGFuIFgsIGFuZCBubyBjcmFzaDwvdGV4dD4KKwk8 L2c+Cis8L3N2Zz4KKwo=