<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
<!DOCTYPE bugzilla SYSTEM "https://bugs.webkit.org/page.cgi?id=bugzilla.dtd">

<bugzilla version="5.0.4.1"
          urlbase="https://bugs.webkit.org/"
          
          maintainer="admin@webkit.org"
>

    <bug>
          <bug_id>29912</bug_id>
          
          <creation_ts>2009-09-29 22:34:33 -0700</creation_ts>
          <short_desc>Avoid zero division during SVGPaintServerPattern::setup()</short_desc>
          <delta_ts>2010-07-01 09:17:28 -0700</delta_ts>
          <reporter_accessible>1</reporter_accessible>
          <cclist_accessible>1</cclist_accessible>
          <classification_id>1</classification_id>
          <classification>Unclassified</classification>
          <product>WebKit</product>
          <component>SVG</component>
          <version>528+ (Nightly build)</version>
          <rep_platform>PC</rep_platform>
          <op_sys>All</op_sys>
          <bug_status>RESOLVED</bug_status>
          <resolution>FIXED</resolution>
          
          
          <bug_file_loc>http://crbug.com/14521</bug_file_loc>
          <status_whiteboard></status_whiteboard>
          <keywords></keywords>
          <priority>P2</priority>
          <bug_severity>Normal</bug_severity>
          <target_milestone>---</target_milestone>
          
          
          <everconfirmed>1</everconfirmed>
          <reporter name="Shiki Okasaka">shiki</reporter>
          <assigned_to name="Nobody">webkit-unassigned</assigned_to>
          <cc>abarth</cc>
    
    <cc>eric</cc>
    
    <cc>krit</cc>
    
    <cc>webkit.review.bot</cc>
    
    <cc>zimmermann</cc>
          

      

      

      

          <comment_sort_order>oldest_to_newest</comment_sort_order>  
          <long_desc isprivate="0" >
    <commentid>151166</commentid>
    <comment_count>0</comment_count>
      <attachid>40344</attachid>
    <who name="Shiki Okasaka">shiki</who>
    <bug_when>2009-09-29 22:34:33 -0700</bug_when>
    <thetext>Created attachment 40344
Proposed fix for a Chromium SVG crash

Fix a Chromium SVG crash when visiting
  http://upload.wikimedia.org/wikipedia/commons/c/c2/World_map_pol_2005_v02.svg
as reported by
  http://crbug.com/14521

The issue is tileRect is not empty with Skia when tileWidth or tileHeight becomes
zero, and the calculation of numY or numX causes a zero division.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>151943</commentid>
    <comment_count>1</comment_count>
    <who name="Eric Seidel (no email)">eric</who>
    <bug_when>2009-10-02 12:42:49 -0700</bug_when>
    <thetext>I&apos;m confused as to what you mean by &quot;tileRect is not empty with Skia&quot;.  Why is this needed?</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>152215</commentid>
    <comment_count>2</comment_count>
    <who name="Shiki Okasaka">shiki</who>
    <bug_when>2009-10-04 21:43:38 -0700</bug_when>
    <thetext>(In reply to comment #1)
&gt; I&apos;m confused as to what you mean by &quot;tileRect is not empty with Skia&quot;.  Why is
&gt; this needed?

It&apos;s due to Skia&apos;s BitmapPlatformDevice::create() implementation for Windows; it creates a 1x1 bitmap when either the requested width or height is zero.

http://src.chromium.org/viewvc/chrome/trunk/src/skia/ext/bitmap_platform_device_win.cc

The revised numY and numX calculations also seem to be more consistent with the following tile image drawing logic.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>152223</commentid>
    <comment_count>3</comment_count>
    <who name="Eric Seidel (no email)">eric</who>
    <bug_when>2009-10-04 22:29:25 -0700</bug_when>
    <thetext>OK, so why does BitmapPlatformDevice::create() do that? :)</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>152230</commentid>
    <comment_count>4</comment_count>
    <who name="Shiki Okasaka">shiki</who>
    <bug_when>2009-10-04 22:59:53 -0700</bug_when>
    <thetext>(In reply to comment #3)
&gt; OK, so why does BitmapPlatformDevice::create() do that? :)

It says,

  // CreateDIBSection appears to get unhappy if we create an empty bitmap, so
  // just create a minimal bitmap

If we fix this, it looks we also need to fix SkBitmap::copyTo(), etc., which cannot handle empty bitmaps.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>153041</commentid>
    <comment_count>5</comment_count>
    <who name="Dirk Schulze">krit</who>
    <bug_when>2009-10-07 08:07:53 -0700</bug_when>
    <thetext>It is a general bug. I see it on WebKitGtk too. Get Floating point exception.

But this patch will definitely break a pixel-test, at least stroked-pattern-expected.svg. Even when we don&apos;t have a pixel-test bot :-(

I wonder if we have to draw a pattern at all, if tileWidth or tileHeight are 0. Since we don&apos;t have an image to draw.

tileHeight and tileWidth are the rounded results of patternBoundaries().width(), patternBoundaries().height(). In the case that one of the both boundaries are not 0 and &lt; .5, we might set tileHeight or tileWidth to 1.f. And make an early return if one of them is 0.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>155567</commentid>
    <comment_count>6</comment_count>
      <attachid>40344</attachid>
    <who name="Adam Barth">abarth</who>
    <bug_when>2009-10-18 22:41:03 -0700</bug_when>
    <thetext>Comment on attachment 40344
Proposed fix for a Chromium SVG crash

Please add a test.  I don&apos;t know whether the code change is correct.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>166940</commentid>
    <comment_count>7</comment_count>
      <attachid>43968</attachid>
    <who name="Dirk Schulze">krit</who>
    <bug_when>2009-11-27 13:30:28 -0800</bug_when>
    <thetext>Created attachment 43968
LayoutTest for SVG pattern crash

This patch includes a test case for the bug.

Luckily I was wrong and the previous patch did not break the mentioned test (stroked-pattern.svg) or the one of batik.

This crash is still a general issue and happens if the pattern size is smaller than the tile of the pattern and the attribute overview is set to visible. Also the pattern size must be smaller than 0.5 in any dimension.

I would suggest to review &quot;Proposed fix for a Chromium SVG crash&quot; again with this patch as Layouttest.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>166945</commentid>
    <comment_count>8</comment_count>
      <attachid>43968</attachid>
    <who name="Adam Barth">abarth</who>
    <bug_when>2009-11-27 14:11:41 -0800</bug_when>
    <thetext>Comment on attachment 43968
LayoutTest for SVG pattern crash

The test looks good.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>166946</commentid>
    <comment_count>9</comment_count>
      <attachid>40344</attachid>
    <who name="Adam Barth">abarth</who>
    <bug_when>2009-11-27 14:16:15 -0800</bug_when>
    <thetext>Comment on attachment 40344
Proposed fix for a Chromium SVG crash

&gt; I would suggest to review &quot;Proposed fix for a Chromium SVG crash&quot; again with
&gt; this patch as Layouttest.

Dirk, the patch seems fine with me with the test, but I&apos;m not an expert on SVG, so I&apos;ll defer to your review.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>167377</commentid>
    <comment_count>10</comment_count>
    <who name="Adam Barth">abarth</who>
    <bug_when>2009-11-30 12:47:22 -0800</bug_when>
    <thetext>style-queue ran check-webkit-style on attachment 40344 without any errors.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>167543</commentid>
    <comment_count>11</comment_count>
    <who name="Dirk Schulze">krit</who>
    <bug_when>2009-12-01 01:14:31 -0800</bug_when>
    <thetext>(In reply to comment #9)
&gt; (From update of attachment 40344 [details])
&gt; &gt; I would suggest to review &quot;Proposed fix for a Chromium SVG crash&quot; again with
&gt; &gt; this patch as Layouttest.
&gt; 
&gt; Dirk, the patch seems fine with me with the test, but I&apos;m not an expert on SVG,
&gt; so I&apos;ll defer to your review.

I&apos;m not a reviewer. But the patch of Shiki looks good to me. Just the changelog is a bit confusing. I don&apos;t see a refernce to Skia here. It&apos;s just a zero division bug in SVGPatternElement.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>168850</commentid>
    <comment_count>12</comment_count>
      <attachid>40344</attachid>
    <who name="Dirk Schulze">krit</who>
    <bug_when>2009-12-04 11:13:54 -0800</bug_when>
    <thetext>Comment on attachment 40344
Proposed fix for a Chromium SVG crash

The patch looks great.

&gt; Index: WebCore/ChangeLog
...
&gt; +
&gt; +        Fix a Chromium SVG crash when visiting
&gt; +        http://upload.wikimedia.org/wikipedia/commons/c/c2/World_map_pol_2005_v02.svg
&gt; +        as reported by
&gt; +        http://crbug.com/14521
&gt; +
&gt; +        The issue is tileRect is not empty with Skia when tileWidth or tileHeight becomes
&gt; +        zero, and the calculation of numY or numX causes a zero division.
&gt; +
&gt; +        * svg/graphics/SVGPaintServerPattern.cpp:
&gt; +        (WebCore::SVGPaintServerPattern::setup):

The discription doesn&apos;t adress the main problem: the zero division in SVGPaintServerPattern. I don&apos;t see a connection between the fix, the problem and the comment about Skia. Please add the topic of the bug and the link to the bug report at the beginning of the Changelog.

r- for the Changelog.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>169155</commentid>
    <comment_count>13</comment_count>
      <attachid>44376</attachid>
    <who name="Shiki Okasaka">shiki</who>
    <bug_when>2009-12-06 21:05:42 -0800</bug_when>
    <thetext>Created attachment 44376
Proposed patch (rev.2)

Thank you very much for reviewing this again. I have updated the ChangeLog as requested.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>169160</commentid>
    <comment_count>14</comment_count>
    <who name="WebKit Review Bot">webkit.review.bot</who>
    <bug_when>2009-12-06 21:10:36 -0800</bug_when>
    <thetext>style-queue ran check-webkit-style on attachment 44376 without any errors.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>169238</commentid>
    <comment_count>15</comment_count>
      <attachid>44376</attachid>
    <who name="Dirk Schulze">krit</who>
    <bug_when>2009-12-07 03:52:12 -0800</bug_when>
    <thetext>Comment on attachment 44376
Proposed patch (rev.2)

LGTM</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>169239</commentid>
    <comment_count>16</comment_count>
      <attachid>44376</attachid>
    <who name="WebKit Commit Bot">commit-queue</who>
    <bug_when>2009-12-07 03:55:26 -0800</bug_when>
    <thetext>Comment on attachment 44376
Proposed patch (rev.2)

Rejecting patch 44376 from review queue.

krit@webkit.org does not have reviewer permissions according to http://trac.webkit.org/browser/trunk/WebKitTools/Scripts/modules/committers.py.

- If you have reviewer rights please correct the error in WebKitTools/Scripts/modules/committers.py by adding yourself to the file (no review needed) and then set the reviewer flag again.

- If you do not have reviewer rights please read http://webkit.org/coding/contributing.html for instructions on how to use bugzilla flags.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>169241</commentid>
    <comment_count>17</comment_count>
      <attachid>44376</attachid>
    <who name="WebKit Commit Bot">commit-queue</who>
    <bug_when>2009-12-07 04:05:38 -0800</bug_when>
    <thetext>Comment on attachment 44376
Proposed patch (rev.2)

Rejecting patch 44376 from review queue.

krit@webkit.org does not have reviewer permissions according to http://trac.webkit.org/browser/trunk/WebKitTools/Scripts/modules/committers.py.

- If you have reviewer rights please correct the error in WebKitTools/Scripts/modules/committers.py by adding yourself to the file (no review needed) and then set the reviewer flag again.

- If you do not have reviewer rights please read http://webkit.org/coding/contributing.html for instructions on how to use bugzilla flags.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>169242</commentid>
    <comment_count>18</comment_count>
    <who name="Dirk Schulze">krit</who>
    <bug_when>2009-12-07 04:07:37 -0800</bug_when>
    <thetext>I have added myself to the list :-/. I&apos;ll try it later again :-)</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>169373</commentid>
    <comment_count>19</comment_count>
    <who name="Eric Seidel (no email)">eric</who>
    <bug_when>2009-12-07 10:37:51 -0800</bug_when>
    <thetext>Due to bug 30084.  I&quot;ll restart the bot shortly.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>169399</commentid>
    <comment_count>20</comment_count>
    <who name="Eric Seidel (no email)">eric</who>
    <bug_when>2009-12-07 11:32:08 -0800</bug_when>
    <thetext>I&apos;ve restarted the bot.  It should not respect your r+.  Sorry for the trouble.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>169420</commentid>
    <comment_count>21</comment_count>
      <attachid>44376</attachid>
    <who name="Dirk Schulze">krit</who>
    <bug_when>2009-12-07 12:21:46 -0800</bug_when>
    <thetext>Comment on attachment 44376
Proposed patch (rev.2)

Thanks Eric.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>169421</commentid>
    <comment_count>22</comment_count>
      <attachid>44376</attachid>
    <who name="WebKit Commit Bot">commit-queue</who>
    <bug_when>2009-12-07 12:22:42 -0800</bug_when>
    <thetext>Comment on attachment 44376
Proposed patch (rev.2)

Rejecting patch 44376 from review queue.

krit@webkit.org does not have reviewer permissions according to http://trac.webkit.org/browser/trunk/WebKitTools/Scripts/modules/committers.py.

- If you have reviewer rights please correct the error in WebKitTools/Scripts/modules/committers.py by adding yourself to the file (no review needed) and then set the reviewer flag again.

- If you do not have reviewer rights please read http://webkit.org/coding/contributing.html for instructions on how to use bugzilla flags.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>169423</commentid>
    <comment_count>23</comment_count>
      <attachid>44376</attachid>
    <who name="Dirk Schulze">krit</who>
    <bug_when>2009-12-07 12:23:51 -0800</bug_when>
    <thetext>Comment on attachment 44376
Proposed patch (rev.2)

I think I&apos;ll land it manually now :-)</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>169427</commentid>
    <comment_count>24</comment_count>
    <who name="Dirk Schulze">krit</who>
    <bug_when>2009-12-07 12:33:04 -0800</bug_when>
    <thetext>landed in r51789. Closing bug now.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>169516</commentid>
    <comment_count>25</comment_count>
    <who name="Eric Seidel (no email)">eric</who>
    <bug_when>2009-12-07 16:12:16 -0800</bug_when>
    <thetext>Sorry for the trouble.  Turns out I was running an old copy of the commit-queue even after I thought I had updated it.  Fixed now.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>169576</commentid>
    <comment_count>26</comment_count>
    <who name="Nikolas Zimmermann">zimmermann</who>
    <bug_when>2009-12-07 18:30:21 -0800</bug_when>
    <thetext>Reopen bug. Had to revert the patch, as it caused crashes on all win build slaves. Reverted in revision 51823. Dirk, can you please have a look?</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>169640</commentid>
    <comment_count>27</comment_count>
    <who name="Dirk Schulze">krit</who>
    <bug_when>2009-12-08 04:04:36 -0800</bug_when>
    <thetext>(In reply to comment #26)
&gt; Reopen bug. Had to revert the patch, as it caused crashes on all win build
&gt; slaves. Reverted in revision 51823. Dirk, can you please have a look?
Sorry, I checked the buildbots, but didn&apos;t noticed the crash on windows.

I don&apos;t know why the test fails on windows. I doubt, that 1/0.1 is a zero division on windows. I looked at the svg pattern code again. We create a ImageBuffer with the size of 0x0 pixel, this is contraproductiv and maybe cause the crash on either ImageBuffer or platform pattern. 
We need a backtrace from windows webkit with this patch.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>175393</commentid>
    <comment_count>28</comment_count>
    <who name="Eric Seidel (no email)">eric</who>
    <bug_when>2009-12-28 22:15:17 -0800</bug_when>
    <thetext>I&apos;m confused as to the status of this patch.  Should the patches be r-&apos;d?  It sounds like since they were reverted they should be.  Right now this is r+&apos;d (and thus in the pending-commit list), but seems unactionable.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>175610</commentid>
    <comment_count>29</comment_count>
    <who name="Eric Seidel (no email)">eric</who>
    <bug_when>2009-12-29 09:51:23 -0800</bug_when>
    <thetext>Looks like http://trac.webkit.org/changeset/51823 reverted both of these patches.  I&apos;m going to mark them both r- as a result.  To resolve this bug we&apos;ll need to have a fixed (combined) patch posted.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>175612</commentid>
    <comment_count>30</comment_count>
      <attachid>43968</attachid>
    <who name="Eric Seidel (no email)">eric</who>
    <bug_when>2009-12-29 09:52:42 -0800</bug_when>
    <thetext>Comment on attachment 43968
LayoutTest for SVG pattern crash

Marking r- since this was rolled out.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>175613</commentid>
    <comment_count>31</comment_count>
      <attachid>44376</attachid>
    <who name="Eric Seidel (no email)">eric</who>
    <bug_when>2009-12-29 09:53:14 -0800</bug_when>
    <thetext>Comment on attachment 44376
Proposed patch (rev.2)

Marking r- since this was rolled out.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>245379</commentid>
    <comment_count>32</comment_count>
    <who name="Dirk Schulze">krit</who>
    <bug_when>2010-07-01 09:17:28 -0700</bug_when>
    <thetext>Fixed in trunk. Closing bug.</thetext>
  </long_desc>
      
          <attachment
              isobsolete="1"
              ispatch="1"
              isprivate="0"
          >
            <attachid>40344</attachid>
            <date>2009-09-29 22:34:33 -0700</date>
            <delta_ts>2009-12-06 21:05:42 -0800</delta_ts>
            <desc>Proposed fix for a Chromium SVG crash</desc>
            <filename>crbug14521.patch</filename>
            <type>text/plain</type>
            <size>1715</size>
            <attacher name="Shiki Okasaka">shiki</attacher>
            
              <data encoding="base64">SW5kZXg6IFdlYkNvcmUvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFdlYkNvcmUvQ2hhbmdlTG9n
CShyZXZpc2lvbiA0ODkxOSkKKysrIFdlYkNvcmUvQ2hhbmdlTG9nCSh3b3JraW5nIGNvcHkpCkBA
IC0xLDMgKzEsMTggQEAKKzIwMDktMDktMjkgIFNoaWtpIE9rYXNha2EgIDxzaGlraUBnb29nbGUu
Y29tPgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIEZp
eCBhIENocm9taXVtIFNWRyBjcmFzaCB3aGVuIHZpc2l0aW5nCisgICAgICAgIGh0dHA6Ly91cGxv
YWQud2lraW1lZGlhLm9yZy93aWtpcGVkaWEvY29tbW9ucy9jL2MyL1dvcmxkX21hcF9wb2xfMjAw
NV92MDIuc3ZnCisgICAgICAgIGFzIHJlcG9ydGVkIGJ5CisgICAgICAgIGh0dHA6Ly9jcmJ1Zy5j
b20vMTQ1MjEKKworICAgICAgICBUaGUgaXNzdWUgaXMgdGlsZVJlY3QgaXMgbm90IGVtcHR5IHdp
dGggU2tpYSB3aGVuIHRpbGVXaWR0aCBvciB0aWxlSGVpZ2h0IGJlY29tZXMKKyAgICAgICAgemVy
bywgYW5kIHRoZSBjYWxjdWxhdGlvbiBvZiBudW1ZIG9yIG51bVggY2F1c2VzIGEgemVybyBkaXZp
c2lvbi4KKworICAgICAgICAqIHN2Zy9ncmFwaGljcy9TVkdQYWludFNlcnZlclBhdHRlcm4uY3Bw
OgorICAgICAgICAoV2ViQ29yZTo6U1ZHUGFpbnRTZXJ2ZXJQYXR0ZXJuOjpzZXR1cCk6CisKIDIw
MDktMDktMjkgIERhdmUgSHlhdHQgIDxoeWF0dEBhcHBsZS5jb20+CiAKICAgICAgICAgUmV2aWV3
ZWQgYnkgSm9uIEhvbmV5Y3V0dC4KSW5kZXg6IFdlYkNvcmUvc3ZnL2dyYXBoaWNzL1NWR1BhaW50
U2VydmVyUGF0dGVybi5jcHAKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gV2ViQ29yZS9zdmcvZ3JhcGhpY3MvU1ZH
UGFpbnRTZXJ2ZXJQYXR0ZXJuLmNwcAkocmV2aXNpb24gNDg5MTkpCisrKyBXZWJDb3JlL3N2Zy9n
cmFwaGljcy9TVkdQYWludFNlcnZlclBhdHRlcm4uY3BwCSh3b3JraW5nIGNvcHkpCkBAIC0xMjIs
OCArMTIyLDggQEAgYm9vbCBTVkdQYWludFNlcnZlclBhdHRlcm46OnNldHVwKEdyYXBoaQogICAK
ICAgICAgICAgR3JhcGhpY3NDb250ZXh0KiB0aWxlSW1hZ2VDb250ZXh0ID0gdGlsZUltYWdlLT5j
b250ZXh0KCk7CiAKLSAgICAgICAgaW50IG51bVkgPSBzdGF0aWNfY2FzdDxpbnQ+KGNlaWxmKHRp
bGVSZWN0LmhlaWdodCgpIC8gdGlsZUhlaWdodCkpICsgMTsKLSAgICAgICAgaW50IG51bVggPSBz
dGF0aWNfY2FzdDxpbnQ+KGNlaWxmKHRpbGVSZWN0LndpZHRoKCkgLyB0aWxlV2lkdGgpKSArIDE7
CisgICAgICAgIGludCBudW1ZID0gc3RhdGljX2Nhc3Q8aW50PihjZWlsZih0aWxlUmVjdC5oZWln
aHQoKSAvIHBhdHRlcm5Cb3VuZGFyaWVzKCkuaGVpZ2h0KCkpKSArIDE7CisgICAgICAgIGludCBu
dW1YID0gc3RhdGljX2Nhc3Q8aW50PihjZWlsZih0aWxlUmVjdC53aWR0aCgpIC8gcGF0dGVybkJv
dW5kYXJpZXMoKS53aWR0aCgpKSkgKyAxOwogCiAgICAgICAgIHRpbGVJbWFnZUNvbnRleHQtPnNh
dmUoKTsKICAgICAgICAgdGlsZUltYWdlQ29udGV4dC0+dHJhbnNsYXRlKC1wYXR0ZXJuQm91bmRh
cmllcygpLndpZHRoKCkgKiBudW1YLCAtcGF0dGVybkJvdW5kYXJpZXMoKS5oZWlnaHQoKSAqIG51
bVkpOwo=
</data>
<flag name="review"
          id="21559"
          type_id="1"
          status="-"
          setter="krit"
    />
          </attachment>
          <attachment
              isobsolete="0"
              ispatch="1"
              isprivate="0"
          >
            <attachid>43968</attachid>
            <date>2009-11-27 13:30:28 -0800</date>
            <delta_ts>2010-06-10 20:01:10 -0700</delta_ts>
            <desc>LayoutTest for SVG pattern crash</desc>
            <filename>pattern-fix.patch</filename>
            <type>text/plain</type>
            <size>3304</size>
            <attacher name="Dirk Schulze">krit</attacher>
            
              <data encoding="base64">SW5kZXg6IExheW91dFRlc3RzL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBMYXlvdXRUZXN0cy9D
aGFuZ2VMb2cJKHJldmlzaW9uIDUxNDQ0KQorKysgTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCSh3b3Jr
aW5nIGNvcHkpCkBAIC0xLDMgKzEsMTcgQEAKKzIwMDktMTEtMjcgIERpcmsgU2NodWx6ZSAgPGty
aXRAd2Via2l0Lm9yZz4KKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKwor
ICAgICAgICBJZiB0aGUgdGlsZSBvZiBhIHBhdHRlcm4gaXMgYmlnZ2VyIHRoYW4gdGhlIHBhdHRl
cm4gYW5kIHRoZQorICAgICAgICBwYXR0ZXJuIHNpemUgaXMgPCAwLjUsIHRoZSBTVkdQYWludFNl
cnZlciBwcm9kdWNlZCBhIGRpdmlzaW9uCisgICAgICAgIGJ5IHplcm8uIFRoaXMgYWxzbyBvbmx5
IGhhcHBlbnMsIGlmIHRoZSBhdHRyaWJ1dGUgb3ZlcmZsb3cgaXMKKyAgICAgICAgc2V0IHRvIHZp
c2libGUuCisgICAgICAgIFRoaXMgaXMgYSB0ZXN0IHdpdGggYSBwYXR0ZXJuIHNpemUgb2YgMC4x
IGFuZCBhIHRpbGUgc2l6ZSBvZiAxLiAKKworICAgICAgICAqIHN2Zy9jdXN0b20vc2NyaXB0LXRl
c3RzL3NtYWxsLXBhdHRlcm4uanM6IEFkZGVkLgorICAgICAgICAqIHN2Zy9jdXN0b20vc21hbGwt
cGF0dGVybi1leHBlY3RlZC50eHQ6IEFkZGVkLgorICAgICAgICAqIHN2Zy9jdXN0b20vc21hbGwt
cGF0dGVybi5odG1sOiBBZGRlZC4KKwogMjAwOS0xMS0yNyAgS2VubmV0aCBSdXNzZWxsICA8a2Jy
QGdvb2dsZS5jb20+CiAKICAgICAgICAgUmV2aWV3ZWQgYnkgRXJpYyBTZWlkZWwuCkluZGV4OiBM
YXlvdXRUZXN0cy9zdmcvY3VzdG9tL3NtYWxsLXBhdHRlcm4tZXhwZWN0ZWQudHh0Cj09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT0KLS0tIExheW91dFRlc3RzL3N2Zy9jdXN0b20vc21hbGwtcGF0dGVybi1leHBlY3RlZC50eHQJ
KHJldmlzaW9uIDApCisrKyBMYXlvdXRUZXN0cy9zdmcvY3VzdG9tL3NtYWxsLXBhdHRlcm4tZXhw
ZWN0ZWQudHh0CShyZXZpc2lvbiAwKQpAQCAtMCwwICsxLDkgQEAKK1BhdHRlcm5zIHNob3VsZG4n
dCBjcmFzaCBmb3Igc2l6ZSA8IDAuNSAuCisKK09uIHN1Y2Nlc3MsIHlvdSB3aWxsIHNlZSBhIHNl
cmllcyBvZiAiUEFTUyIgbWVzc2FnZXMsIGZvbGxvd2VkIGJ5ICJURVNUIENPTVBMRVRFIi4KKwor
CitQQVNTIHN1Y2Nlc3NmdWxseVBhcnNlZCBpcyB0cnVlCisKK1RFU1QgQ09NUExFVEUKKwpJbmRl
eDogTGF5b3V0VGVzdHMvc3ZnL2N1c3RvbS9zbWFsbC1wYXR0ZXJuLmh0bWwKPT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQot
LS0gTGF5b3V0VGVzdHMvc3ZnL2N1c3RvbS9zbWFsbC1wYXR0ZXJuLmh0bWwJKHJldmlzaW9uIDAp
CisrKyBMYXlvdXRUZXN0cy9zdmcvY3VzdG9tL3NtYWxsLXBhdHRlcm4uaHRtbAkocmV2aXNpb24g
MCkKQEAgLTAsMCArMSwxMyBAQAorPCFET0NUWVBFIEhUTUwgUFVCTElDICItLy9JRVRGLy9EVEQg
SFRNTC8vRU4iPgorPGh0bWw+Cis8aGVhZD4KKzxsaW5rIHJlbD0ic3R5bGVzaGVldCIgaHJlZj0i
Li4vLi4vZmFzdC9qcy9yZXNvdXJjZXMvanMtdGVzdC1zdHlsZS5jc3MiPgorPHNjcmlwdCBzcmM9
Ii4uLy4uL2Zhc3QvanMvcmVzb3VyY2VzL2pzLXRlc3QtcHJlLmpzIj48L3NjcmlwdD4KKzwvaGVh
ZD4KKzxib2R5PgorPHAgaWQ9ImRlc2NyaXB0aW9uIj48L3A+Cis8ZGl2IGlkPSJjb25zb2xlIj48
L2Rpdj4KKzxzY3JpcHQgc3JjPSJzY3JpcHQtdGVzdHMvc21hbGwtcGF0dGVybi5qcyI+PC9zY3Jp
cHQ+Cis8c2NyaXB0IHNyYz0iLi4vLi4vZmFzdC9qcy9yZXNvdXJjZXMvanMtdGVzdC1wb3N0Lmpz
Ij48L3NjcmlwdD4KKzwvYm9keT4KKzwvaHRtbD4KSW5kZXg6IExheW91dFRlc3RzL3N2Zy9jdXN0
b20vc2NyaXB0LXRlc3RzL3NtYWxsLXBhdHRlcm4uanMKPT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gTGF5b3V0VGVz
dHMvc3ZnL2N1c3RvbS9zY3JpcHQtdGVzdHMvc21hbGwtcGF0dGVybi5qcwkocmV2aXNpb24gMCkK
KysrIExheW91dFRlc3RzL3N2Zy9jdXN0b20vc2NyaXB0LXRlc3RzL3NtYWxsLXBhdHRlcm4uanMJ
KHJldmlzaW9uIDApCkBAIC0wLDAgKzEsMjggQEAKK2Rlc2NyaXB0aW9uKCJQYXR0ZXJucyBzaG91
bGRuJ3QgY3Jhc2ggZm9yIHNpemUgPCAwLjUgLiIpOworCit2YXIgc3ZnID0gZG9jdW1lbnQuY3Jl
YXRlRWxlbWVudE5TKCJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIsICJzdmciKTsKK2RvY3Vt
ZW50LmRvY3VtZW50RWxlbWVudC5pbnNlcnRCZWZvcmUoc3ZnLCBkb2N1bWVudC5kb2N1bWVudEVs
ZW1lbnQuZmlyc3RDaGlsZCk7CisKK3ZhciBwYXR0ZXJuID0gZG9jdW1lbnQuY3JlYXRlRWxlbWVu
dE5TKCJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIsICJwYXR0ZXJuIik7CitwYXR0ZXJuLnNl
dEF0dHJpYnV0ZSgiaWQiLCAicGF0dGVybiIpOworcGF0dGVybi5zZXRBdHRyaWJ1dGUoIndpZHRo
IiwgIjAuMSIpOworcGF0dGVybi5zZXRBdHRyaWJ1dGUoImhlaWdodCIsICIwLjEiKTsKK3BhdHRl
cm4uc2V0QXR0cmlidXRlKCJvdmVyZmxvdyIsICJ2aXNpYmxlIik7CitwYXR0ZXJuLnNldEF0dHJp
YnV0ZSgicGF0dGVyblVuaXRzIiwgInVzZXJTcGFjZU9uVXNlIik7CisKK3ZhciBwYXR0ZXJuUmVj
dCA9IGRvY3VtZW50LmNyZWF0ZUVsZW1lbnROUygiaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmci
LCAicmVjdCIpOworcGF0dGVyblJlY3Quc2V0QXR0cmlidXRlKCJ3aWR0aCIsICIxIik7CitwYXR0
ZXJuUmVjdC5zZXRBdHRyaWJ1dGUoImhlaWdodCIsICIxIik7CitwYXR0ZXJuUmVjdC5zZXRBdHRy
aWJ1dGUoImZpbGwiLCAiZ3JlZW4iKTsKK3BhdHRlcm4uYXBwZW5kQ2hpbGQocGF0dGVyblJlY3Qp
OworCitzdmcuYXBwZW5kQ2hpbGQocGF0dGVybik7CisKK3ZhciByZWN0ID0gZG9jdW1lbnQuY3Jl
YXRlRWxlbWVudE5TKCJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIsICJyZWN0Iik7CityZWN0
LnNldEF0dHJpYnV0ZSgid2lkdGgiLCAiMSIpOworcmVjdC5zZXRBdHRyaWJ1dGUoImhlaWdodCIs
ICIxIik7CityZWN0LnNldEF0dHJpYnV0ZSgiZmlsbCIsICJ1cmwoI3BhdHRlcm4pIik7CisKK3N2
Zy5hcHBlbmRDaGlsZChyZWN0KTsKKwordmFyIHN1Y2Nlc3NmdWxseVBhcnNlZCA9IHRydWU7Cg==
</data>
<flag name="review"
          id="25718"
          type_id="1"
          status="-"
          setter="eric"
    />
    <flag name="commit-queue"
          id="25719"
          type_id="3"
          status="-"
          setter="krit"
    />
          </attachment>
          <attachment
              isobsolete="0"
              ispatch="1"
              isprivate="0"
          >
            <attachid>44376</attachid>
            <date>2009-12-06 21:05:42 -0800</date>
            <delta_ts>2009-12-29 09:53:13 -0800</delta_ts>
            <desc>Proposed patch (rev.2)</desc>
            <filename>bug29912.patch</filename>
            <type>text/plain</type>
            <size>1719</size>
            <attacher name="Shiki Okasaka">shiki</attacher>
            
              <data encoding="base64">SW5kZXg6IFdlYkNvcmUvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFdlYkNvcmUvQ2hhbmdlTG9n
CShyZXZpc2lvbiA1MTc0NSkKKysrIFdlYkNvcmUvQ2hhbmdlTG9nCSh3b3JraW5nIGNvcHkpCkBA
IC0xLDMgKzEsMTcgQEAKKzIwMDktMTItMDYgIFNoaWtpIE9rYXNha2EgIDxzaGlraUBnb29nbGUu
Y29tPgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIEF2
b2lkIHplcm8gZGl2aXNpb24gZHVyaW5nIFNWR1BhaW50U2VydmVyUGF0dGVybjo6c2V0dXAoKQor
ICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9Mjk5MTIKKwor
ICAgICAgICBGaXggemVybyBkaXZpc2lvbiBidWdzIGluIFNWR1BhaW50U2VydmVyUGF0dGVybjo6
c2V0dXAoKSB0aGF0IG9jY3VycmVkCisgICAgICAgIGlmIHRoZSB0aWxlIG9mIGEgcGF0dGVybiB3
YXMgYmlnZ2VyIHRoYW4gdGhlIHBhdHRlcm4gYW5kIHRoZSBwYXR0ZXJuCisgICAgICAgIHNpemUg
d2FzIDwgMC41LCBhbmQgaWYgdGhlIGF0dHJpYnV0ZSBvdmVyZmxvdyB3YXMgc2V0IHRvIHZpc2li
bGUuCisKKyAgICAgICAgKiBzdmcvZ3JhcGhpY3MvU1ZHUGFpbnRTZXJ2ZXJQYXR0ZXJuLmNwcDoK
KyAgICAgICAgKFdlYkNvcmU6OlNWR1BhaW50U2VydmVyUGF0dGVybjo6c2V0dXApOgorCiAyMDA5
LTEyLTA2ICBPbGl2ZXIgSHVudCAgPG9saXZlckBhcHBsZS5jb20+CiAKICAgICAgICAgUmV2aWV3
ZWQgYnkgTWFjaWVqIFN0YWNob3dpYWsuCkluZGV4OiBXZWJDb3JlL3N2Zy9ncmFwaGljcy9TVkdQ
YWludFNlcnZlclBhdHRlcm4uY3BwCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFdlYkNvcmUvc3ZnL2dyYXBoaWNz
L1NWR1BhaW50U2VydmVyUGF0dGVybi5jcHAJKHJldmlzaW9uIDUxNzQ0KQorKysgV2ViQ29yZS9z
dmcvZ3JhcGhpY3MvU1ZHUGFpbnRTZXJ2ZXJQYXR0ZXJuLmNwcAkod29ya2luZyBjb3B5KQpAQCAt
MTIyLDggKzEyMiw4IEBAIGJvb2wgU1ZHUGFpbnRTZXJ2ZXJQYXR0ZXJuOjpzZXR1cChHcmFwaGkK
ICAgCiAgICAgICAgIEdyYXBoaWNzQ29udGV4dCogdGlsZUltYWdlQ29udGV4dCA9IHRpbGVJbWFn
ZS0+Y29udGV4dCgpOwogCi0gICAgICAgIGludCBudW1ZID0gc3RhdGljX2Nhc3Q8aW50PihjZWls
Zih0aWxlUmVjdC5oZWlnaHQoKSAvIHRpbGVIZWlnaHQpKSArIDE7Ci0gICAgICAgIGludCBudW1Y
ID0gc3RhdGljX2Nhc3Q8aW50PihjZWlsZih0aWxlUmVjdC53aWR0aCgpIC8gdGlsZVdpZHRoKSkg
KyAxOworICAgICAgICBpbnQgbnVtWSA9IHN0YXRpY19jYXN0PGludD4oY2VpbGYodGlsZVJlY3Qu
aGVpZ2h0KCkgLyBwYXR0ZXJuQm91bmRhcmllcygpLmhlaWdodCgpKSkgKyAxOworICAgICAgICBp
bnQgbnVtWCA9IHN0YXRpY19jYXN0PGludD4oY2VpbGYodGlsZVJlY3Qud2lkdGgoKSAvIHBhdHRl
cm5Cb3VuZGFyaWVzKCkud2lkdGgoKSkpICsgMTsKIAogICAgICAgICB0aWxlSW1hZ2VDb250ZXh0
LT5zYXZlKCk7CiAgICAgICAgIHRpbGVJbWFnZUNvbnRleHQtPnRyYW5zbGF0ZSgtcGF0dGVybkJv
dW5kYXJpZXMoKS53aWR0aCgpICogbnVtWCwgLXBhdHRlcm5Cb3VuZGFyaWVzKCkuaGVpZ2h0KCkg
KiBudW1ZKTsK
</data>
<flag name="review"
          id="26212"
          type_id="1"
          status="-"
          setter="eric"
    />
    <flag name="commit-queue"
          id="26237"
          type_id="3"
          status="-"
          setter="krit"
    />
          </attachment>
      

    </bug>

</bugzilla>