25105 2009-04-08 17:45:08 -0700 isOutermostSVG() crashes with null deref 2009-04-09 16:03:22 -0700 1 1 1 Unclassified WebKit SVG 528+ (Nightly build) Mac OS X 10.5 RESOLVED FIXED P2 Normal --- 1 simon.fraser eric eric oldest_to_newest 116970 0 simon.fraser 2009-04-08 17:45:08 -0700 The testcase shows a bug in isOutermostSVG(), which cause a crash. 116971 1 29351 simon.fraser 2009-04-08 17:45:30 -0700 Created attachment 29351 Testcase 116972 2 simon.fraser 2009-04-08 17:55:02 -0700 Maybe fix: diff --git a/WebCore/svg/SVGSVGElement.cpp b/WebCore/svg/SVGSVGElement.cpp index e66a16e..fe09148 100644 --- a/WebCore/svg/SVGSVGElement.cpp +++ b/WebCore/svg/SVGSVGElement.cpp @@ -477,6 +477,10 @@ bool SVGSVGElement::hasRelativeValues() const bool SVGSVGElement::isOutermostSVG() const { + // Element may not be in the document. + if (!parentNode()) + return false; + // This is true whenever this is the outermost SVG, even if there are HTML elements outside it return !parentNode()->isSVGElement(); } 117002 3 eric 2009-04-09 01:50:37 -0700 Your fix looks good. 117018 4 eric 2009-04-09 03:46:50 -0700 Fixing. Will post shortly. 117020 5 eric 2009-04-09 03:55:26 -0700 I think we should return true instead of false. Will post patch later today. 117096 6 29378 eric 2009-04-09 15:48:54 -0700 Created attachment 29378 First stab @ fix LayoutTests/ChangeLog | 10 ++++++++++ .../detached-outermost-svg-crash-expected.txt | 1 + .../svg/custom/detached-outermost-svg-crash.html | 13 +++++++++++++ WebCore/ChangeLog | 10 ++++++++++ WebCore/svg/SVGSVGElement.cpp | 4 ++++ 5 files changed, 38 insertions(+), 0 deletions(-) 117099 7 eric 2009-04-09 16:03:22 -0700 Committing to http://svn.webkit.org/repository/webkit/trunk ... M LayoutTests/ChangeLog A LayoutTests/svg/custom/detached-outermost-svg-crash-expected.txt A LayoutTests/svg/custom/detached-outermost-svg-crash.html M WebCore/ChangeLog M WebCore/svg/SVGSVGElement.cpp Committed r42374 29351 2009-04-08 17:45:30 -0700 2009-04-08 17:45:30 -0700 Testcase svg-crash.xhtml application/xhtml+xml 815 simon.fraser PGh0bWwgeG1sbnM9Imh0dHA6Ly93d3cudzMub3JnLzE5OTkveGh0bWwiCiAgICAgIHhtbG5zOnN2 Zz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciCiAgICAgIHhtbDpsYW5nPSJlbiI+PGhlYWQ+ CjxtZXRhIG5hbWU9InZpZXdwb3J0IiBjb250ZW50PSJ3aWR0aCA9IDMyMCwgdXNlci1zY2FsYWJs ZT1ubyIgLz4KPHNjcmlwdCB0eXBlPSJ0ZXh0L2phdmFzY3JpcHQiPgpmdW5jdGlvbiBpbnRyb3Nw ZWN0KHgpIHsKCWlmICh0eXBlb2YoeCkgPT09ICJvYmplY3QiKSB7CQoJCWZvciAocHJvcCBpbiB4 KSB7CgkJCWludHJvc3BlY3QoeFtwcm9wXSk7CgkJfQogICAgfQp9CmZ1bmN0aW9uIGNyYXNoKCkg ewogICAgdmFyIG5ld2NvbnRlbnQgPSBkb2N1bWVudC5jcmVhdGVFbGVtZW50TlMoImh0dHA6Ly93 d3cudzMub3JnLzIwMDAvc3ZnIiwic3ZnOnN2ZyIpOwogICAgbmV3Y29udGVudC5zZXRBdHRyaWJ1 dGVOUygiaHR0cDovL3d3dy53My5vcmcvMjAwMC94bWxucy8iLCJ4bWxuczp4bGluayIsImh0dHA6 Ly93d3cudzMub3JnLzE5OTkveGxpbmsiKQogICAgbmV3Y29udGVudC5zZXRBdHRyaWJ1dGUoJ3dp ZHRoJywnOTAlJyk7CiAgICBuZXdjb250ZW50LnNldEF0dHJpYnV0ZSgnaGVpZ2h0JywyMDApOwoJ YWxlcnQoIndpbGwgY3Jhc2ggOSIpOwoJaW50cm9zcGVjdChuZXdjb250ZW50LDApOwoJYWxlcnQo InNvbWVob3cgZGlkbid0Iik7Cn0KPC9zY3JpcHQ+CjwvaGVhZD4KPGJvZHk+Cgo8Zm9ybT48aW5w dXQgdHlwZT0iYnV0dG9uIiBvbmNsaWNrPSJjcmFzaCgpOyIgdmFsdWU9IkNyYXNoIi8+PC9mb3Jt Pgo8L2JvZHk+CjwvaHRtbD4= 29378 2009-04-09 15:48:54 -0700 2009-04-09 15:50:45 -0700 First stab @ fix First-stab-fix.patch text/plain 3190 eric YzVjMmNlZmRiM2YxNDI3NWI2ZmViM2RlOGUxMWM3YTkwYTdkZWRmZgpkaWZmIC0tZ2l0IGEvTGF5 b3V0VGVzdHMvQ2hhbmdlTG9nIGIvTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCmluZGV4IDgwZWY2MWQu LmQ1NzBjOTYgMTAwNjQ0Ci0tLSBhL0xheW91dFRlc3RzL0NoYW5nZUxvZworKysgYi9MYXlvdXRU ZXN0cy9DaGFuZ2VMb2cKQEAgLTEsMyArMSwxMyBAQAorMjAwOS0wNC0wOSAgRXJpYyBTZWlkZWwg IDxlcmljQHdlYmtpdC5vcmc+CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISku CisKKyAgICAgICAgVGVzdCB0byBtYWtlIHN1cmUgd2UgZG9uJ3QgY3Jhc2ggd2hlbiBhY2Nlc3Np bmcKKyAgICAgICAgcHJvcGVydGllcyAobGlrZSB2aWV3cG9ydCkgb24gYSBkZXRhY2hlZCA8c3Zn PiBlbGVtZW50LgorCisgICAgICAgICogc3ZnL2N1c3RvbS9kZXRhY2hlZC1vdXRlcm1vc3Qtc3Zn LWNyYXNoLWV4cGVjdGVkLnR4dDogQWRkZWQuCisgICAgICAgICogc3ZnL2N1c3RvbS9kZXRhY2hl ZC1vdXRlcm1vc3Qtc3ZnLWNyYXNoLmh0bWw6IEFkZGVkLgorCiAyMDA5LTA0LTA4ICBTYW0gV2Vp bmlnICA8c2FtQHdlYmtpdC5vcmc+CiAKICAgICAgICAgUmV2aWV3ZWQgYnkgR2VvZmZyZXkgIkJp ZyBCb3kiIEdhcmVuLgpkaWZmIC0tZ2l0IGEvTGF5b3V0VGVzdHMvc3ZnL2N1c3RvbS9kZXRhY2hl ZC1vdXRlcm1vc3Qtc3ZnLWNyYXNoLWV4cGVjdGVkLnR4dCBiL0xheW91dFRlc3RzL3N2Zy9jdXN0 b20vZGV0YWNoZWQtb3V0ZXJtb3N0LXN2Zy1jcmFzaC1leHBlY3RlZC50eHQKbmV3IGZpbGUgbW9k ZSAxMDA2NDQKaW5kZXggMDAwMDAwMC4uNGFkMzgyMwotLS0gL2Rldi9udWxsCisrKyBiL0xheW91 dFRlc3RzL3N2Zy9jdXN0b20vZGV0YWNoZWQtb3V0ZXJtb3N0LXN2Zy1jcmFzaC1leHBlY3RlZC50 eHQKQEAgLTAsMCArMSBAQAorUEFTU0VEIC0tIHdlYmtpdCBkaWQgbm90IGNyYXNoIGluIFNWR1NW R0VsZW1lbnQ6OmlzT3V0ZXJtb3N0U1ZHKCkuIFNlZSBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9z aG93X2J1Zy5jZ2k/aWQ9MjUxMDUKZGlmZiAtLWdpdCBhL0xheW91dFRlc3RzL3N2Zy9jdXN0b20v ZGV0YWNoZWQtb3V0ZXJtb3N0LXN2Zy1jcmFzaC5odG1sIGIvTGF5b3V0VGVzdHMvc3ZnL2N1c3Rv bS9kZXRhY2hlZC1vdXRlcm1vc3Qtc3ZnLWNyYXNoLmh0bWwKbmV3IGZpbGUgbW9kZSAxMDA2NDQK aW5kZXggMDAwMDAwMC4uMDhiZTE2OAotLS0gL2Rldi9udWxsCisrKyBiL0xheW91dFRlc3RzL3N2 Zy9jdXN0b20vZGV0YWNoZWQtb3V0ZXJtb3N0LXN2Zy1jcmFzaC5odG1sCkBAIC0wLDAgKzEsMTMg QEAKKzxzY3JpcHQ+CitpZiAod2luZG93LmxheW91dFRlc3RDb250cm9sbGVyKQorICAgIGxheW91 dFRlc3RDb250cm9sbGVyLmR1bXBBc1RleHQoKTsKKwordmFyIHN2ZyA9IGRvY3VtZW50LmNyZWF0 ZUVsZW1lbnROUygiaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciLCAic3ZnIik7Citmb3IgKHBy b3AgaW4gc3ZnKSB7CisgICAgLy8gQWNjZXNzIGFsbCB0aGUgcHJvcGVydGllcyBvbiB0aGUgPHN2 Zz4gZWxlbWVudAorICAgIC8vIGF0IGxlYXN0IG9uZSBvZiB0aGVtIChsaWtlIHZpZXdwb3J0KSB3 aWxsIGNhbGwgU1ZHU1ZHRWxlbWVudDo6aXNPdXRlcm1vc3RTVkcoKQorICAgIC8vIGFuZCB3aWxs IHRyaWdnZXIgdGhlIGNyYXNoIHNlZW4gaW4gaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19i dWcuY2dpP2lkPTI1MTA1CisgICAgc3ZnW3Byb3BdOworfQorPC9zY3JpcHQ+Cis8ZGl2PlBBU1NF RCAtLSB3ZWJraXQgZGlkIG5vdCBjcmFzaCBpbiBTVkdTVkdFbGVtZW50Ojppc091dGVybW9zdFNW RygpLiAgU2VlIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0yNTEwNTwv ZGl2PgpkaWZmIC0tZ2l0IGEvV2ViQ29yZS9DaGFuZ2VMb2cgYi9XZWJDb3JlL0NoYW5nZUxvZwpp bmRleCA1ZGMyMjA3Li5iNzMxZTQyIDEwMDY0NAotLS0gYS9XZWJDb3JlL0NoYW5nZUxvZworKysg Yi9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDEzIEBACisyMDA5LTA0LTA5ICBFcmljIFNl aWRlbCAgPGVyaWNAd2Via2l0Lm9yZz4KKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9P UFMhKS4KKworICAgICAgICBDcmFzaCB3aGVuIGFjY2Vzc2luZyBzdmcudmlld3BvcnQgb24gYSBk ZXRhY2hlZCBTVkdTVkdFbGVtZW50CisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3No b3dfYnVnLmNnaT9pZD0yNTEwNQorCisgICAgICAgICogc3ZnL1NWR1NWR0VsZW1lbnQuY3BwOgor ICAgICAgICAoV2ViQ29yZTo6U1ZHU1ZHRWxlbWVudDo6aXNPdXRlcm1vc3RTVkcpOiByZXR1cm4g InRydWUiIHRoYXQgd2UgYXJlIHRoZSAib3V0ZXJtb3N0IiBTVkcgZWxlbWVudCBpZiB3ZSBoYXZl IG5vIHBhcmVudC4gIChUaGUgc3BlYyBpcyB1bmNsZWFyIGFzIHRvIHdoYXQgYmVoYXZpb3Igd2Ug c2hvdWxkIGhhdmUgaW4gdGhpcyBjYXNlLCBhbmQgSSBkb3VidCBhbnlvbmUgY2FyZXMgZm9yIG5v dykuCisKIDIwMDktMDQtMDkgIFNpbW9uIEZyYXNlciAgPHNpbW9uLmZyYXNlckBhcHBsZS5jb20+ CiAKICAgICAgICAgUmV2aWV3ZWQgYnkgQW50dGkgS29pdmlzdG8KZGlmZiAtLWdpdCBhL1dlYkNv cmUvc3ZnL1NWR1NWR0VsZW1lbnQuY3BwIGIvV2ViQ29yZS9zdmcvU1ZHU1ZHRWxlbWVudC5jcHAK aW5kZXggZTY2YTE2ZS4uNjc4OTdjZiAxMDA2NDQKLS0tIGEvV2ViQ29yZS9zdmcvU1ZHU1ZHRWxl bWVudC5jcHAKKysrIGIvV2ViQ29yZS9zdmcvU1ZHU1ZHRWxlbWVudC5jcHAKQEAgLTQ3Nyw2ICs0 NzcsMTAgQEAgYm9vbCBTVkdTVkdFbGVtZW50OjpoYXNSZWxhdGl2ZVZhbHVlcygpIGNvbnN0CiAK IGJvb2wgU1ZHU1ZHRWxlbWVudDo6aXNPdXRlcm1vc3RTVkcoKSBjb25zdAogeworICAgIC8vIEVs ZW1lbnQgbWF5IG5vdCBiZSBpbiB0aGUgZG9jdW1lbnQsIHByZXRlbmQgd2UncmUgb3V0ZXJtb3N0 IGZvciB2aWV3cG9ydCgpLCBnZXRDVE0oKSwgZXRjLgorICAgIGlmICghcGFyZW50Tm9kZSgpKQor ICAgICAgICByZXR1cm4gdHJ1ZTsKKwogICAgIC8vIFRoaXMgaXMgdHJ1ZSB3aGVuZXZlciB0aGlz IGlzIHRoZSBvdXRlcm1vc3QgU1ZHLCBldmVuIGlmIHRoZXJlIGFyZSBIVE1MIGVsZW1lbnRzIG91 dHNpZGUgaXQKICAgICByZXR1cm4gIXBhcmVudE5vZGUoKS0+aXNTVkdFbGVtZW50KCk7CiB9Cg==