108485 2013-01-31 07:50:00 -0800 Assertion faulire in SVGAnimatedType::valueAsString() 2013-07-30 05:53:35 -0700 1 1 1 Unclassified WebKit SVG 528+ (Nightly build) Unspecified Unspecified RESOLVED DUPLICATE 118744 P2 Normal --- 116980 1 rhodovan.u-szeged webkit-unassigned fmalita pdr schenney zherczeg zimmermann oldest_to_newest 821524 0 rhodovan.u-szeged 2013-01-31 07:50:00 -0800 During SVG fuzzing I've got the following ASSERT_NOT_REACHED assertion faulire: Program received signal SIGSEGV, Segmentation fault. 0x00007ffff59d0f6a in WebCore::SVGAnimatedType::valueAsString (this=0xa69ff0) at /home/reni/repos/webkit2/Source/WebCore/svg/SVGAnimatedType.cpp:268 268 ASSERT_NOT_REACHED(); Test: <svg xmlns="http://www.w3.org/2000/svg"> <circle> <animateTransform attributeName="transform" attributeType="CSS"></animateTransform> </circle> </svg> The problem is that the type of the SVGAnimatedType object is AnimatedTransformList what doesn't need valueAsString() support theoretically. 912802 1 rhodovan.u-szeged 2013-07-30 05:53:35 -0700 *** This bug has been marked as a duplicate of bug 118744 ***