12981 2007-03-06 07:32:21 -0800 REGRESSION (r18975-r18999): Reproducible crash with <use> 2007-03-06 15:54:29 -0800 1 1 1 Unclassified WebKit SVG 523.x (Safari 3) Mac OS X 10.4 RESOLVED FIXED HasReduction, Regression P1 Critical --- 1 mitz zimmermann zimmermann oldest_to_newest 20404 0 mitz 2007-03-06 07:32:21 -0800 The attached SVG crashes WebKit. Backtrace: Command: Safari Path: /Applications/Safari.app/Contents/MacOS/Safari Parent: WindowServer [61] Version: ??? (19977) PID: 9191 Thread: 0 Exception: EXC_BAD_ACCESS (0x0001) Codes: KERN_PROTECTION_FAILURE (0x0002) at 0x0000000c Thread 0 Crashed: 0 com.apple.WebCore 0x014ce2a4 WTF::HashMap<WebCore::String, WTF::HashSet<WebCore::SVGStyledElement*, WTF::PtrHash<WebCore::SVGStyledElement*>, WTF::HashTraits<WebCore::SVGStyledElement*> >*, WTF::StrHash<WebCore::String>, WTF::HashTraits<WebCore::String>, WTF::HashTraits<WTF::HashSet<WebCore::SVGStyledElement*, WTF::PtrHash<WebCore::SVGStyledElement*>, WTF::HashTraits<WebCore::SVGStyledElement*> >*> >::add(WebCore::String const&, WTF::HashSet<WebCore::SVGStyledElement*, WTF::PtrHash<WebCore::SVGStyledElement*>, WTF::HashTraits<WebCore::SVGStyledElement*> >* const&) + 68 1 com.apple.WebCore 0x0119ec90 WebCore::SVGDocumentExtensions::addPendingResource(WebCore::AtomicString const&, WebCore::SVGStyledElement*) + 192 2 com.apple.WebCore 0x01097404 WebCore::SVGUseElement::insertedIntoDocument() + 324 3 com.apple.WebCore 0x010d662c WebCore::ContainerNode::addChild(WTF::PassRefPtr<WebCore::Node>) + 220 4 com.apple.WebCore 0x0102cf84 WebCore::XMLTokenizer::startElementNs(unsigned char const*, unsigned char const*, unsigned char const*, int, unsigned char const**, int, int, unsigned char const**) + 3268 5 libxml2.2.dylib 0x92ca2480 xmlParseStartTag + 8228 6 libxml2.2.dylib 0x92ca42ec xmlParseDocument + 3368 7 libxml2.2.dylib 0x92c88c0c xmlParseChunk + 424 8 com.apple.WebCore 0x01028e84 WebCore::XMLTokenizer::write(WebCore::SegmentedString const&, bool) + 260 9 com.apple.WebCore 0x013cabc8 WebCore::FrameLoader::write(char const*, int, bool) + 856 10 com.apple.WebCore 0x010dfbb8 -[WebCoreFrameBridge receivedData:textEncodingName:] + 408 11 com.apple.WebKit 0x00327eec -[WebHTMLRepresentation receivedData:withDataSource:] + 156 12 com.apple.WebKit 0x003234b8 -[WebDataSource(WebInternal) _receivedData:] + 88 13 com.apple.WebKit 0x00378318 WebFrameLoaderClient::committedLoad(WebCore::DocumentLoader*, char const*, int) + 120 14 com.apple.WebCore 0x013deeac WebCore::DocumentLoader::commitLoad(char const*, int) + 92 15 com.apple.WebCore 0x013e6670 WebCore::ResourceLoader::didReceiveData(char const*, int, long long, bool) + 80 16 com.apple.WebCore 0x013e3244 WebCore::MainResourceLoader::didReceiveData(char const*, int, long long, bool) + 52 17 com.apple.WebCore 0x013ba11c -[WebCoreResourceHandleAsDelegate connection:didReceiveData:lengthReceived:] + 156 18 com.apple.Foundation 0x929935d4 -[NSURLConnection(NSURLConnectionInternal) _sendDidReceiveDataCallback] + 564 19 com.apple.Foundation 0x92991a74 -[NSURLConnection(NSURLConnectionInternal) _sendCallbacks] + 488 20 com.apple.Foundation 0x92991810 _sendCallbacks + 156 21 com.apple.CoreFoundation 0x907dd4cc __CFRunLoopDoSources0 + 384 22 com.apple.CoreFoundation 0x907dc9fc __CFRunLoopRun + 452 23 com.apple.CoreFoundation 0x907dc47c CFRunLoopRunSpecific + 268 24 com.apple.Foundation 0x92970164 -[NSRunLoop runMode:beforeDate:] + 172 25 com.apple.Foundation 0x929b4e20 -[NSRunLoop runUntilDate:] + 80 26 com.apple.AppKit 0x9396b36c NSCoreDragReceiveProc + 916 27 com.apple.HIServices 0x91854de8 DoDropMessage + 96 28 com.apple.HIServices 0x9185628c CoreDragMessageHandler + 1332 29 com.apple.CoreFoundation 0x90824104 __CFMessagePortPerform + 304 30 com.apple.CoreFoundation 0x907ea734 __CFRunLoopDoSource1 + 152 31 com.apple.CoreFoundation 0x907dce4c __CFRunLoopRun + 1556 32 com.apple.CoreFoundation 0x907dc47c CFRunLoopRunSpecific + 268 33 com.apple.HIToolbox 0x93208740 RunCurrentEventLoopInMode + 264 34 com.apple.HIToolbox 0x93207dd4 ReceiveNextEventCommon + 380 35 com.apple.HIToolbox 0x93207c40 BlockUntilNextEventMatchingListInMode + 96 36 com.apple.AppKit 0x9370cae4 _DPSNextEvent + 384 37 com.apple.AppKit 0x9370c7a8 -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] + 116 38 com.apple.Safari 0x00006740 0x1000 + 22336 39 com.apple.AppKit 0x93708cec -[NSApplication run] + 472 40 com.apple.AppKit 0x937f987c NSApplicationMain + 452 41 com.apple.Safari 0x0005c77c 0x1000 + 374652 42 com.apple.Safari 0x0005c624 0x1000 + 374308 20405 1 13489 mitz 2007-03-06 07:33:07 -0800 Created attachment 13489 Reduction (will crash) 20318 2 zimmermann 2007-03-06 15:54:29 -0800 Bug fixed. Landed in r19989. 13489 2007-03-06 07:33:07 -0800 2007-03-06 07:33:07 -0800 Reduction (will crash) 12981 reduction.svg image/svg+xml 225 mitz PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiIHN0YW5kYWxvbmU9Im5vIj8+Cjwh RE9DVFlQRSBzdmcgUFVCTElDICItLy9XM0MvL0RURCBTVkcgMS4xLy9FTiIgImh0dHA6Ly93d3cu dzMub3JnL0dyYXBoaWNzL1NWRy8xLjEvRFREL3N2ZzExLmR0ZCI+CjxzdmcgeG1sbnM9Imh0dHA6 Ly93d3cudzMub3JnLzIwMDAvc3ZnIiA+CiAgICA8dXNlIGZvbz0iYmFyIiAvPgo8L3N2Zz4K