<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
<!DOCTYPE bugzilla SYSTEM "https://bugs.webkit.org/page.cgi?id=bugzilla.dtd">

<bugzilla version="5.0.4.1"
          urlbase="https://bugs.webkit.org/"
          
          maintainer="admin@webkit.org"
>

    <bug>
          <bug_id>30403</bug_id>
          
          <creation_ts>2009-10-15 13:08:56 -0700</creation_ts>
          <short_desc>REGRESSION(r49385): crashes in SVGImage due to static EmptyPluginHalterClient</short_desc>
          <delta_ts>2009-10-16 10:36:03 -0700</delta_ts>
          <reporter_accessible>1</reporter_accessible>
          <cclist_accessible>1</cclist_accessible>
          <classification_id>1</classification_id>
          <classification>Unclassified</classification>
          <product>WebKit</product>
          <component>SVG</component>
          <version>528+ (Nightly build)</version>
          <rep_platform>PC</rep_platform>
          <op_sys>OS X 10.5</op_sys>
          <bug_status>RESOLVED</bug_status>
          <resolution>FIXED</resolution>
          
          
          <bug_file_loc></bug_file_loc>
          <status_whiteboard></status_whiteboard>
          <keywords></keywords>
          <priority>P1</priority>
          <bug_severity>Normal</bug_severity>
          <target_milestone>---</target_milestone>
          <dependson>30119</dependson>
          
          <everconfirmed>1</everconfirmed>
          <reporter name="Dimitri Glazkov (Google)">dglazkov</reporter>
          <assigned_to name="Jon Honeycutt">jhoneycutt</assigned_to>
          <cc>commit-queue</cc>
    
    <cc>darin</cc>
    
    <cc>eric</cc>
    
    <cc>jhoneycutt</cc>
    
    <cc>mitz</cc>
    
    <cc>mrowe</cc>
          

      

      

      

          <comment_sort_order>oldest_to_newest</comment_sort_order>  
          <long_desc isprivate="0" >
    <commentid>154875</commentid>
    <comment_count>0</comment_count>
    <who name="Dimitri Glazkov (Google)">dglazkov</who>
    <bug_when>2009-10-15 13:08:56 -0700</bug_when>
    <thetext>After http://trac.webkit.org/changeset/49385, the PluginHalter started owning PluginHalterClient, which now makes it necessary for the EmptyPluginHalterClient instance in SVGImage to be non-static (since it can be deleted once PluginHalter is destroyed).

This was caught as a crash in build.chromium.org build bot, when this sequence of tests is run:

LayoutTests/svg/W3C-SVG-1.1/struct-image-01-t.svg
LayoutTests/svg/W3C-SVG-1.1/struct-image-03-t.svg
LayoutTests/svg/W3C-SVG-1.1/struct-image-04-t.svg
LayoutTests/svg/W3C-SVG-1.1/struct-image-05-b.svg
LayoutTests/svg/W3C-SVG-1.1/struct-image-06-t.svg
LayoutTests/svg/W3C-SVG-1.1/struct-image-07-t.svg
LayoutTests/svg/W3C-SVG-1.1/struct-image-08-t.svg
LayoutTests/svg/W3C-SVG-1.1/struct-image-09-t.svg
LayoutTests/svg/W3C-SVG-1.1/struct-image-10-t.svg
LayoutTests/svg/carto.net/scrollbar.svg
LayoutTests/svg/carto.net/selectionlist.svg

The crash occurs when the garbage collection attempts to discard CachedImage holding SVGImage. SVGImage destructor clears its fake page, which destroys PluginHalter and then PluginHalterClient. Doing so results in the static instance being destroyed.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>154877</commentid>
    <comment_count>1</comment_count>
      <attachid>41242</attachid>
    <who name="Dimitri Glazkov (Google)">dglazkov</who>
    <bug_when>2009-10-15 13:13:20 -0700</bug_when>
    <thetext>Created attachment 41242
SVGImage crash fix, v1.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>154878</commentid>
    <comment_count>2</comment_count>
    <who name="Dimitri Glazkov (Google)">dglazkov</who>
    <bug_when>2009-10-15 13:14:53 -0700</bug_when>
    <thetext>I attempted to write one layout test to trigger the crash, but so far had no luck.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>154880</commentid>
    <comment_count>3</comment_count>
    <who name="Dimitri Glazkov (Google)">dglazkov</who>
    <bug_when>2009-10-15 13:21:26 -0700</bug_when>
    <thetext>Adding mitz since he reviewed the http://trac.webkit.org/changeset/49385.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>154989</commentid>
    <comment_count>4</comment_count>
      <attachid>41242</attachid>
    <who name="Eric Seidel (no email)">eric</who>
    <bug_when>2009-10-15 20:58:46 -0700</bug_when>
    <thetext>Comment on attachment 41242
SVGImage crash fix, v1.

I would put a comment next to the code, explaining the ownership, and why it&apos;s non-static.

Something like:
// Create a new EmptyPluginHalterClient, because FooBar owns the client and will destroy it.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>154990</commentid>
    <comment_count>5</comment_count>
    <who name="Eric Seidel (no email)">eric</who>
    <bug_when>2009-10-15 20:59:02 -0700</bug_when>
    <thetext>mitz or whoever was involved in the original patch should really review this though.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>154994</commentid>
    <comment_count>6</comment_count>
    <who name="Jon Honeycutt">jhoneycutt</who>
    <bug_when>2009-10-15 21:17:45 -0700</bug_when>
    <thetext>Thanks for investigating this, Dimitri!

As Eric said on IRC, we should make PluginHalter / PluginHalterClient behave like the other controllers stored on Page, i.e., the PluginHalter should notify its client when it is being destroyed, and the client may then choose to clean itself up.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>154995</commentid>
    <comment_count>7</comment_count>
    <who name="Dimitri Glazkov (Google)">dglazkov</who>
    <bug_when>2009-10-15 21:25:27 -0700</bug_when>
    <thetext>Sounds good. To stop the crasheage while this is being refactored, perhaps we could check in mine or even a simpler patch that passes 0 as client?</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>155020</commentid>
    <comment_count>8</comment_count>
    <who name="Jon Honeycutt">jhoneycutt</who>
    <bug_when>2009-10-15 22:32:39 -0700</bug_when>
    <thetext>Yes, passing 0 here is a good idea.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>155090</commentid>
    <comment_count>9</comment_count>
      <attachid>41286</attachid>
    <who name="Dimitri Glazkov (Google)">dglazkov</who>
    <bug_when>2009-10-16 08:57:35 -0700</bug_when>
    <thetext>Created attachment 41286
SVGImage crash fix, v2.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>155091</commentid>
    <comment_count>10</comment_count>
      <attachid>41286</attachid>
    <who name="Dimitri Glazkov (Google)">dglazkov</who>
    <bug_when>2009-10-16 08:58:21 -0700</bug_when>
    <thetext>Comment on attachment 41286
SVGImage crash fix, v2.

ugh.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>155092</commentid>
    <comment_count>11</comment_count>
      <attachid>41287</attachid>
    <who name="Dimitri Glazkov (Google)">dglazkov</who>
    <bug_when>2009-10-16 08:59:10 -0700</bug_when>
    <thetext>Created attachment 41287
SVGImage crash fix, v2.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>155093</commentid>
    <comment_count>12</comment_count>
    <who name="Eric Seidel (no email)">eric</who>
    <bug_when>2009-10-16 08:59:56 -0700</bug_when>
    <thetext>Yes.  If you&apos;re used to git-send-bugzilla, bugzilla-tool post-commits&apos; behavior is confusing, I agree. :(</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>155094</commentid>
    <comment_count>13</comment_count>
      <attachid>41287</attachid>
    <who name="Eric Seidel (no email)">eric</who>
    <bug_when>2009-10-16 09:01:10 -0700</bug_when>
    <thetext>Comment on attachment 41287
SVGImage crash fix, v2.

This looks OK.  We still need a bug to fix the ownership semantics of PluginHalterClient I think.  Also, why do we even have EmptyPluginHalterClient defined if we don&apos;t use it here anymore?</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>155099</commentid>
    <comment_count>14</comment_count>
    <who name="Dimitri Glazkov (Google)">dglazkov</who>
    <bug_when>2009-10-16 09:04:59 -0700</bug_when>
    <thetext>Yup. That&apos;s why I changed the bug ownership to Jon. This is just a fix for the crash.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>155100</commentid>
    <comment_count>15</comment_count>
      <attachid>41287</attachid>
    <who name="Eric Seidel (no email)">eric</who>
    <bug_when>2009-10-16 09:06:54 -0700</bug_when>
    <thetext>Comment on attachment 41287
SVGImage crash fix, v2.

OK.  It&apos;s just a little strange of a state to leave the tree in. :)  But alright.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>155115</commentid>
    <comment_count>16</comment_count>
      <attachid>41287</attachid>
    <who name="Dimitri Glazkov (Google)">dglazkov</who>
    <bug_when>2009-10-16 09:56:25 -0700</bug_when>
    <thetext>Comment on attachment 41287
SVGImage crash fix, v2.

git svn rebase is taking foreeeeeveeeer.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>155127</commentid>
    <comment_count>17</comment_count>
      <attachid>41287</attachid>
    <who name="WebKit Commit Bot">commit-queue</who>
    <bug_when>2009-10-16 10:35:59 -0700</bug_when>
    <thetext>Comment on attachment 41287
SVGImage crash fix, v2.

Clearing flags on attachment: 41287

Committed r49685: &lt;http://trac.webkit.org/changeset/49685&gt;</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>155128</commentid>
    <comment_count>18</comment_count>
    <who name="WebKit Commit Bot">commit-queue</who>
    <bug_when>2009-10-16 10:36:03 -0700</bug_when>
    <thetext>All reviewed patches have been landed.  Closing bug.</thetext>
  </long_desc>
      
          <attachment
              isobsolete="1"
              ispatch="1"
              isprivate="0"
          >
            <attachid>41242</attachid>
            <date>2009-10-15 13:13:20 -0700</date>
            <delta_ts>2009-10-16 08:57:30 -0700</delta_ts>
            <desc>SVGImage crash fix, v1.</desc>
            <filename>bug-30403-20091015131318.patch</filename>
            <type>text/plain</type>
            <size>2635</size>
            <attacher name="Dimitri Glazkov (Google)">dglazkov</attacher>
            
              <data encoding="base64">ZGlmZiAtLWdpdCBhL1dlYkNvcmUvQ2hhbmdlTG9nIGIvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXgg
NWRmZjJhZS4uOWQwODM3OCAxMDA2NDQKLS0tIGEvV2ViQ29yZS9DaGFuZ2VMb2cKKysrIGIvV2Vi
Q29yZS9DaGFuZ2VMb2cKQEAgLTEsMyArMSwyOSBAQAorMjAwOS0xMC0xNSAgRGltaXRyaSBHbGF6
a292ICA8ZGdsYXprb3ZAY2hyb21pdW0ub3JnPgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9E
WSAoT09QUyEpLgorCisgICAgICAgIENoYW5nZSBFbXB0eVBsdWdpbkhhbHRlckNsaWVudCBpbiBT
VkdJbWFnZSB0byBiZSBub24tc3RhdGljLCB0bworICAgICAgICBtYXRjaCBjaGFuZ2VzIG1hZGUg
aHR0cDovL3RyYWMud2Via2l0Lm9yZy9jaGFuZ2VzZXQvNDkzODUuCisgICAgICAgIGh0dHBzOi8v
YnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0zMDQwMworCisgICAgICAgIFJ1biB0aGUg
Zm9sbG93aW5nIGxheW91dCB0ZXN0IHNlcXVlbmNlOgorICAgICAgICAgIExheW91dFRlc3RzL3N2
Zy9XM0MtU1ZHLTEuMS9zdHJ1Y3QtaW1hZ2UtMDEtdC5zdmcKKyAgICAgICAgICBMYXlvdXRUZXN0
cy9zdmcvVzNDLVNWRy0xLjEvc3RydWN0LWltYWdlLTAzLXQuc3ZnCisgICAgICAgICAgTGF5b3V0
VGVzdHMvc3ZnL1czQy1TVkctMS4xL3N0cnVjdC1pbWFnZS0wNC10LnN2ZworICAgICAgICAgIExh
eW91dFRlc3RzL3N2Zy9XM0MtU1ZHLTEuMS9zdHJ1Y3QtaW1hZ2UtMDUtYi5zdmcKKyAgICAgICAg
ICBMYXlvdXRUZXN0cy9zdmcvVzNDLVNWRy0xLjEvc3RydWN0LWltYWdlLTA2LXQuc3ZnCisgICAg
ICAgICAgTGF5b3V0VGVzdHMvc3ZnL1czQy1TVkctMS4xL3N0cnVjdC1pbWFnZS0wNy10LnN2Zwor
ICAgICAgICAgIExheW91dFRlc3RzL3N2Zy9XM0MtU1ZHLTEuMS9zdHJ1Y3QtaW1hZ2UtMDgtdC5z
dmcKKyAgICAgICAgICBMYXlvdXRUZXN0cy9zdmcvVzNDLVNWRy0xLjEvc3RydWN0LWltYWdlLTA5
LXQuc3ZnCisgICAgICAgICAgTGF5b3V0VGVzdHMvc3ZnL1czQy1TVkctMS4xL3N0cnVjdC1pbWFn
ZS0xMC10LnN2ZworICAgICAgICAgIExheW91dFRlc3RzL3N2Zy9jYXJ0by5uZXQvc2Nyb2xsYmFy
LnN2ZworICAgICAgICAgIExheW91dFRlc3RzL3N2Zy9jYXJ0by5uZXQvc2VsZWN0aW9ubGlzdC5z
dmcKKworICAgICAgICBzZWxlY3Rpb25saXN0LnN2ZyBzaG91bGQgbm90IGNyYXNoLgorCisgICAg
ICAgICogc3ZnL2dyYXBoaWNzL1NWR0ltYWdlLmNwcDoKKyAgICAgICAgKFdlYkNvcmU6OlNWR0lt
YWdlOjpkYXRhQ2hhbmdlZCk6IE1hZGUgRW1wdHlQbHVnaW5IYWx0ZXJDbGllbnQgbm9uLXN0YXRp
Yy4KKwogMjAwOS0xMC0wMSAgWW9uZyBMaSAgPHlvbmcubGlAdG9yY2htb2JpbGUuY29tPgogCiAg
ICAgICAgIFJldmlld2VkIGJ5IEFkZWxlIFBldGVyc29uLgpkaWZmIC0tZ2l0IGEvV2ViQ29yZS9z
dmcvZ3JhcGhpY3MvU1ZHSW1hZ2UuY3BwIGIvV2ViQ29yZS9zdmcvZ3JhcGhpY3MvU1ZHSW1hZ2Uu
Y3BwCmluZGV4IGRjNjM1ODIuLjFiMGM1OGYgMTAwNjQ0Ci0tLSBhL1dlYkNvcmUvc3ZnL2dyYXBo
aWNzL1NWR0ltYWdlLmNwcAorKysgYi9XZWJDb3JlL3N2Zy9ncmFwaGljcy9TVkdJbWFnZS5jcHAK
QEAgLTIzOSwxNCArMjM5LDEzIEBAIGJvb2wgU1ZHSW1hZ2U6OmRhdGFDaGFuZ2VkKGJvb2wgYWxs
RGF0YVJlY2VpdmVkKQogICAgICAgICBzdGF0aWMgRHJhZ0NsaWVudCogZHVtbXlEcmFnQ2xpZW50
ID0gMDsKICNlbmRpZgogICAgICAgICBzdGF0aWMgSW5zcGVjdG9yQ2xpZW50KiBkdW1teUluc3Bl
Y3RvckNsaWVudCA9IG5ldyBFbXB0eUluc3BlY3RvckNsaWVudDsKLSAgICAgICAgc3RhdGljIFBs
dWdpbkhhbHRlckNsaWVudCogZHVtbXlQbHVnaW5IYWx0ZXJDbGllbnQgPSBuZXcgRW1wdHlQbHVn
aW5IYWx0ZXJDbGllbnQ7CiAKICAgICAgICAgbV9jaHJvbWVDbGllbnQuc2V0KG5ldyBTVkdJbWFn
ZUNocm9tZUNsaWVudCh0aGlzKSk7CiAgICAgICAgIAogICAgICAgICAvLyBGSVhNRTogSWYgdGhp
cyBTVkcgZW5kcyB1cCBsb2FkaW5nIGl0c2VsZiwgd2UgbWlnaHQgbGVhayB0aGUgd29ybGQuCiAg
ICAgICAgIC8vIFRoZSBjb21tZW50IHNhaWQgdGhhdCB0aGUgQ2FjaGUgY29kZSBkb2VzIG5vdCBr
bm93IGFib3V0IENhY2hlZEltYWdlcwogICAgICAgICAvLyBob2xkaW5nIEZyYW1lcyBhbmQgd29u
J3Qga25vdyB0byBicmVhayB0aGUgY3ljbGUuIEJ1dCAKLSAgICAgICAgbV9wYWdlLnNldChuZXcg
UGFnZShtX2Nocm9tZUNsaWVudC5nZXQoKSwgZHVtbXlDb250ZXh0TWVudUNsaWVudCwgZHVtbXlF
ZGl0b3JDbGllbnQsIGR1bW15RHJhZ0NsaWVudCwgZHVtbXlJbnNwZWN0b3JDbGllbnQsIGR1bW15
UGx1Z2luSGFsdGVyQ2xpZW50KSk7CisgICAgICAgIG1fcGFnZS5zZXQobmV3IFBhZ2UobV9jaHJv
bWVDbGllbnQuZ2V0KCksIGR1bW15Q29udGV4dE1lbnVDbGllbnQsIGR1bW15RWRpdG9yQ2xpZW50
LCBkdW1teURyYWdDbGllbnQsIGR1bW15SW5zcGVjdG9yQ2xpZW50LCBuZXcgRW1wdHlQbHVnaW5I
YWx0ZXJDbGllbnQpKTsKICAgICAgICAgbV9wYWdlLT5zZXR0aW5ncygpLT5zZXRKYXZhU2NyaXB0
RW5hYmxlZChmYWxzZSk7CiAgICAgICAgIG1fcGFnZS0+c2V0dGluZ3MoKS0+c2V0UGx1Z2luc0Vu
YWJsZWQoZmFsc2UpOw==
</data>

          </attachment>
          <attachment
              isobsolete="1"
              ispatch="1"
              isprivate="0"
          >
            <attachid>41286</attachid>
            <date>2009-10-16 08:57:35 -0700</date>
            <delta_ts>2009-10-16 08:58:21 -0700</delta_ts>
            <desc>SVGImage crash fix, v2.</desc>
            <filename>bug-30403-20091016085730.patch</filename>
            <type>text/plain</type>
            <size>3103</size>
            <attacher name="Dimitri Glazkov (Google)">dglazkov</attacher>
            
              <data encoding="base64">ZGlmZiAtLWdpdCBhL0xheW91dFRlc3RzL0NoYW5nZUxvZyBiL0xheW91dFRlc3RzL0NoYW5nZUxv
ZwppbmRleCAxYTAxNWZhLi42MjE0MDQ0IDEwMDY0NAotLS0gYS9MYXlvdXRUZXN0cy9DaGFuZ2VM
b2cKKysrIGIvTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCkBAIC0xLDMgKzEsMTUgQEAKKzIwMDktMTAt
MDIgIFlvbmcgTGkgIDx5b25nLmxpQHRvcmNobW9iaWxlLmNvbT4KKworICAgICAgICBSZXZpZXdl
ZCBieSBOT0JPRFkgQWRlbGUgUGV0ZXJzb24uCisKKyAgICAgICAgQWRkZWQgYSB0ZXN0IGNhc2Ug
dGhhdCBsb2FkcyBhbiBpbnZhbGlkIGltYWdlIHRvIG1ha2Ugc3VyZQorICAgICAgICB3ZSBkb24n
dCBjcmFzaCBpbiB0aGlzIHNpdHVhdGlvbi4KKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5v
cmcvc2hvd19idWcuY2dpP2lkPTI5OTgwCisKKyAgICAgICAgKiBmYXN0L2ltYWdlcy9pbWFnZS1p
bnZhbGlkLWRhdGEtZXhwZWN0ZWQudHh0OiBBZGRlZC4KKyAgICAgICAgKiBmYXN0L2ltYWdlcy9p
bWFnZS1pbnZhbGlkLWRhdGEuaHRtbDogQWRkZWQuCisgICAgICAgICogZmFzdC9pbWFnZXMvcmVz
b3VyY2VzL2ludmFsaWQuanBnOiBBZGRlZC4KKwogMjAwOS0xMC0wOSAgU3RlcGhlbiBXaGl0ZSAg
PHNlbm9yYmxhbmNvQGNocm9taXVtLm9yZz4KIAogICAgICAgICBSZXZpZXdlZCBieSBFcmljIFNl
aWRlbC4KZGlmZiAtLWdpdCBhL0xheW91dFRlc3RzL2Zhc3QvaW1hZ2VzL2ltYWdlLWludmFsaWQt
ZGF0YS1leHBlY3RlZC50eHQgYi9MYXlvdXRUZXN0cy9mYXN0L2ltYWdlcy9pbWFnZS1pbnZhbGlk
LWRhdGEtZXhwZWN0ZWQudHh0Cm5ldyBmaWxlIG1vZGUgMTAwNjQ0CmluZGV4IDAwMDAwMDAuLmE0
ZTI0Y2MKLS0tIC9kZXYvbnVsbAorKysgYi9MYXlvdXRUZXN0cy9mYXN0L2ltYWdlcy9pbWFnZS1p
bnZhbGlkLWRhdGEtZXhwZWN0ZWQudHh0CkBAIC0wLDAgKzEsMyBAQAorVGhpcyBpcyB0ZXN0IGZv
ciBhbiBpbWFnZSB3aXRoIGludmFsaWQgZGF0YS4gTm8gY3Jhc2ggbWVhbnMgdGVzdCBQQVNTLgor
CisKZGlmZiAtLWdpdCBhL0xheW91dFRlc3RzL2Zhc3QvaW1hZ2VzL2ltYWdlLWludmFsaWQtZGF0
YS5odG1sIGIvTGF5b3V0VGVzdHMvZmFzdC9pbWFnZXMvaW1hZ2UtaW52YWxpZC1kYXRhLmh0bWwK
bmV3IGZpbGUgbW9kZSAxMDA2NDQKaW5kZXggMDAwMDAwMC4uNTMxM2I4ZQotLS0gL2Rldi9udWxs
CisrKyBiL0xheW91dFRlc3RzL2Zhc3QvaW1hZ2VzL2ltYWdlLWludmFsaWQtZGF0YS5odG1sCkBA
IC0wLDAgKzEsMTUgQEAKKzxodG1sPgorPGhlYWQ+CisgICAgPHNjcmlwdCB0eXBlPSJ0ZXh0L2ph
dmFzY3JpcHQiPgorICAgICAgICBpZiAod2luZG93LmxheW91dFRlc3RDb250cm9sbGVyKQorICAg
ICAgICAgICAgbGF5b3V0VGVzdENvbnRyb2xsZXIuZHVtcEFzVGV4dCgpOworICAgIDwvc2NyaXB0
PgorPC9oZWFkPgorPGJvZHk+CisgICAgPHA+CisgICAgICAgIFRoaXMgaXMgdGVzdCBmb3IgYW4g
aW1hZ2Ugd2l0aCBpbnZhbGlkIGRhdGEuIE5vIGNyYXNoIG1lYW5zIHRlc3QgUEFTUy4KKyAgICA8
L3A+CisgICAgPGhyPgorICAgIDxpbWcgc3JjPSJyZXNvdXJjZXMvaW52YWxpZC5qcGciPjwvaW1n
PgorPC9ib2R5PgorPC9odG1sPgpkaWZmIC0tZ2l0IGEvTGF5b3V0VGVzdHMvZmFzdC9pbWFnZXMv
cmVzb3VyY2VzL2ludmFsaWQuanBnIGIvTGF5b3V0VGVzdHMvZmFzdC9pbWFnZXMvcmVzb3VyY2Vz
L2ludmFsaWQuanBnCm5ldyBmaWxlIG1vZGUgMTAwNjQ0CmluZGV4IDAwMDAwMDAuLmU1YjU1ODgK
LS0tIC9kZXYvbnVsbAorKysgYi9MYXlvdXRUZXN0cy9mYXN0L2ltYWdlcy9yZXNvdXJjZXMvaW52
YWxpZC5qcGcKQEAgLTAsMCArMSBAQAorPz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/
Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/PwpcIE5vIG5ld2xpbmUgYXQgZW5kIG9mIGZpbGUKZGlm
ZiAtLWdpdCBhL1dlYkNvcmUvQ2hhbmdlTG9nIGIvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggMzVl
ZDBhYi4uNWRmZjJhZSAxMDA2NDQKLS0tIGEvV2ViQ29yZS9DaGFuZ2VMb2cKKysrIGIvV2ViQ29y
ZS9DaGFuZ2VMb2cKQEAgLTEsMyArMSwxMyBAQAorMjAwOS0xMC0wMSAgWW9uZyBMaSAgPHlvbmcu
bGlAdG9yY2htb2JpbGUuY29tPgorCisgICAgICAgIFJldmlld2VkIGJ5IEFkZWxlIFBldGVyc29u
LgorCisgICAgICAgIEZpeCBjcmFzaCB3aGVuIGxvYWRpbmcgaW52YWxpZCBpbWFnZSBkYXRhCisg
ICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0yOTk4MAorCisg
ICAgICAgICogcmVuZGVyaW5nL1JlbmRlckltYWdlLmNwcDoKKyAgICAgICAgKFdlYkNvcmU6OlJl
bmRlckltYWdlOjpzZXRJbWFnZVNpemVGb3JBbHRUZXh0KToKKwogMjAwOS0xMC0wOSAgU3RlcGhl
biBXaGl0ZSAgPHNlbm9yYmxhbmNvQGNocm9taXVtLm9yZz4KIAogICAgICAgICBSZXZpZXdlZCBi
eSBFcmljIFNlaWRlbC4KZGlmZiAtLWdpdCBhL1dlYkNvcmUvcmVuZGVyaW5nL1JlbmRlckltYWdl
LmNwcCBiL1dlYkNvcmUvcmVuZGVyaW5nL1JlbmRlckltYWdlLmNwcAppbmRleCA1MWMzMDczLi40
MjA2YjFjIDEwMDY0NAotLS0gYS9XZWJDb3JlL3JlbmRlcmluZy9SZW5kZXJJbWFnZS5jcHAKKysr
IGIvV2ViQ29yZS9yZW5kZXJpbmcvUmVuZGVySW1hZ2UuY3BwCkBAIC0yMjcsNyArMjI3LDcgQEAg
Ym9vbCBSZW5kZXJJbWFnZTo6c2V0SW1hZ2VTaXplRm9yQWx0VGV4dChDYWNoZWRJbWFnZSogbmV3
SW1hZ2UgLyogPSAwICovKQogICAgICAgICBpbWFnZUhlaWdodCA9IHBhZGRpbmdIZWlnaHQ7CiAg
ICAgfQogICAKLSAgICBpZiAobmV3SW1hZ2UpIHsKKyAgICBpZiAobmV3SW1hZ2UgJiYgbmV3SW1h
Z2UtPmltYWdlKCkpIHsKICAgICAgICAgLy8gaW1hZ2VTaXplKCkgcmV0dXJucyAwIGZvciB0aGUg
ZXJyb3IgaW1hZ2UuICBXZSBuZWVkIHRoZSB0cnVlIHNpemUgb2YgdGhlCiAgICAgICAgIC8vIGVy
cm9yIGltYWdlLCBzbyB3ZSBoYXZlIHRvIGdldCBpdCBieSBncmFiYmluZyBpbWFnZSgpIGRpcmVj
dGx5LgogICAgICAgICBpbWFnZVdpZHRoICs9IG5ld0ltYWdlLT5pbWFnZSgpLT53aWR0aCgpICog
c3R5bGUoKS0+ZWZmZWN0aXZlWm9vbSgpOw==
</data>

          </attachment>
          <attachment
              isobsolete="0"
              ispatch="1"
              isprivate="0"
          >
            <attachid>41287</attachid>
            <date>2009-10-16 08:59:10 -0700</date>
            <delta_ts>2009-10-16 10:35:59 -0700</delta_ts>
            <desc>SVGImage crash fix, v2.</desc>
            <filename>bug-30403-20091016085905.patch</filename>
            <type>text/plain</type>
            <size>2609</size>
            <attacher name="Dimitri Glazkov (Google)">dglazkov</attacher>
            
              <data encoding="base64">ZGlmZiAtLWdpdCBhL1dlYkNvcmUvQ2hhbmdlTG9nIGIvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXgg
NWRmZjJhZS4uOWQwODM3OCAxMDA2NDQKLS0tIGEvV2ViQ29yZS9DaGFuZ2VMb2cKKysrIGIvV2Vi
Q29yZS9DaGFuZ2VMb2cKQEAgLTEsMyArMSwyOSBAQAorMjAwOS0xMC0xNSAgRGltaXRyaSBHbGF6
a292ICA8ZGdsYXprb3ZAY2hyb21pdW0ub3JnPgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9E
WSAoT09QUyEpLgorCisgICAgICAgIENoYW5nZSBFbXB0eVBsdWdpbkhhbHRlckNsaWVudCBpbiBT
VkdJbWFnZSB0byBiZSBub24tc3RhdGljLCB0bworICAgICAgICBtYXRjaCBjaGFuZ2VzIG1hZGUg
aHR0cDovL3RyYWMud2Via2l0Lm9yZy9jaGFuZ2VzZXQvNDkzODUuCisgICAgICAgIGh0dHBzOi8v
YnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0zMDQwMworCisgICAgICAgIFJ1biB0aGUg
Zm9sbG93aW5nIGxheW91dCB0ZXN0IHNlcXVlbmNlOgorICAgICAgICAgIExheW91dFRlc3RzL3N2
Zy9XM0MtU1ZHLTEuMS9zdHJ1Y3QtaW1hZ2UtMDEtdC5zdmcKKyAgICAgICAgICBMYXlvdXRUZXN0
cy9zdmcvVzNDLVNWRy0xLjEvc3RydWN0LWltYWdlLTAzLXQuc3ZnCisgICAgICAgICAgTGF5b3V0
VGVzdHMvc3ZnL1czQy1TVkctMS4xL3N0cnVjdC1pbWFnZS0wNC10LnN2ZworICAgICAgICAgIExh
eW91dFRlc3RzL3N2Zy9XM0MtU1ZHLTEuMS9zdHJ1Y3QtaW1hZ2UtMDUtYi5zdmcKKyAgICAgICAg
ICBMYXlvdXRUZXN0cy9zdmcvVzNDLVNWRy0xLjEvc3RydWN0LWltYWdlLTA2LXQuc3ZnCisgICAg
ICAgICAgTGF5b3V0VGVzdHMvc3ZnL1czQy1TVkctMS4xL3N0cnVjdC1pbWFnZS0wNy10LnN2Zwor
ICAgICAgICAgIExheW91dFRlc3RzL3N2Zy9XM0MtU1ZHLTEuMS9zdHJ1Y3QtaW1hZ2UtMDgtdC5z
dmcKKyAgICAgICAgICBMYXlvdXRUZXN0cy9zdmcvVzNDLVNWRy0xLjEvc3RydWN0LWltYWdlLTA5
LXQuc3ZnCisgICAgICAgICAgTGF5b3V0VGVzdHMvc3ZnL1czQy1TVkctMS4xL3N0cnVjdC1pbWFn
ZS0xMC10LnN2ZworICAgICAgICAgIExheW91dFRlc3RzL3N2Zy9jYXJ0by5uZXQvc2Nyb2xsYmFy
LnN2ZworICAgICAgICAgIExheW91dFRlc3RzL3N2Zy9jYXJ0by5uZXQvc2VsZWN0aW9ubGlzdC5z
dmcKKworICAgICAgICBzZWxlY3Rpb25saXN0LnN2ZyBzaG91bGQgbm90IGNyYXNoLgorCisgICAg
ICAgICogc3ZnL2dyYXBoaWNzL1NWR0ltYWdlLmNwcDoKKyAgICAgICAgKFdlYkNvcmU6OlNWR0lt
YWdlOjpkYXRhQ2hhbmdlZCk6IE1hZGUgRW1wdHlQbHVnaW5IYWx0ZXJDbGllbnQgbm9uLXN0YXRp
Yy4KKwogMjAwOS0xMC0wMSAgWW9uZyBMaSAgPHlvbmcubGlAdG9yY2htb2JpbGUuY29tPgogCiAg
ICAgICAgIFJldmlld2VkIGJ5IEFkZWxlIFBldGVyc29uLgpkaWZmIC0tZ2l0IGEvV2ViQ29yZS9z
dmcvZ3JhcGhpY3MvU1ZHSW1hZ2UuY3BwIGIvV2ViQ29yZS9zdmcvZ3JhcGhpY3MvU1ZHSW1hZ2Uu
Y3BwCmluZGV4IGRjNjM1ODIuLjBhNTA2ZjggMTAwNjQ0Ci0tLSBhL1dlYkNvcmUvc3ZnL2dyYXBo
aWNzL1NWR0ltYWdlLmNwcAorKysgYi9XZWJDb3JlL3N2Zy9ncmFwaGljcy9TVkdJbWFnZS5jcHAK
QEAgLTIzOSwxNCArMjM5LDEzIEBAIGJvb2wgU1ZHSW1hZ2U6OmRhdGFDaGFuZ2VkKGJvb2wgYWxs
RGF0YVJlY2VpdmVkKQogICAgICAgICBzdGF0aWMgRHJhZ0NsaWVudCogZHVtbXlEcmFnQ2xpZW50
ID0gMDsKICNlbmRpZgogICAgICAgICBzdGF0aWMgSW5zcGVjdG9yQ2xpZW50KiBkdW1teUluc3Bl
Y3RvckNsaWVudCA9IG5ldyBFbXB0eUluc3BlY3RvckNsaWVudDsKLSAgICAgICAgc3RhdGljIFBs
dWdpbkhhbHRlckNsaWVudCogZHVtbXlQbHVnaW5IYWx0ZXJDbGllbnQgPSBuZXcgRW1wdHlQbHVn
aW5IYWx0ZXJDbGllbnQ7CiAKICAgICAgICAgbV9jaHJvbWVDbGllbnQuc2V0KG5ldyBTVkdJbWFn
ZUNocm9tZUNsaWVudCh0aGlzKSk7CiAgICAgICAgIAogICAgICAgICAvLyBGSVhNRTogSWYgdGhp
cyBTVkcgZW5kcyB1cCBsb2FkaW5nIGl0c2VsZiwgd2UgbWlnaHQgbGVhayB0aGUgd29ybGQuCiAg
ICAgICAgIC8vIFRoZSBjb21tZW50IHNhaWQgdGhhdCB0aGUgQ2FjaGUgY29kZSBkb2VzIG5vdCBr
bm93IGFib3V0IENhY2hlZEltYWdlcwogICAgICAgICAvLyBob2xkaW5nIEZyYW1lcyBhbmQgd29u
J3Qga25vdyB0byBicmVhayB0aGUgY3ljbGUuIEJ1dCAKLSAgICAgICAgbV9wYWdlLnNldChuZXcg
UGFnZShtX2Nocm9tZUNsaWVudC5nZXQoKSwgZHVtbXlDb250ZXh0TWVudUNsaWVudCwgZHVtbXlF
ZGl0b3JDbGllbnQsIGR1bW15RHJhZ0NsaWVudCwgZHVtbXlJbnNwZWN0b3JDbGllbnQsIGR1bW15
UGx1Z2luSGFsdGVyQ2xpZW50KSk7CisgICAgICAgIG1fcGFnZS5zZXQobmV3IFBhZ2UobV9jaHJv
bWVDbGllbnQuZ2V0KCksIGR1bW15Q29udGV4dE1lbnVDbGllbnQsIGR1bW15RWRpdG9yQ2xpZW50
LCBkdW1teURyYWdDbGllbnQsIGR1bW15SW5zcGVjdG9yQ2xpZW50LCAwKSk7CiAgICAgICAgIG1f
cGFnZS0+c2V0dGluZ3MoKS0+c2V0SmF2YVNjcmlwdEVuYWJsZWQoZmFsc2UpOwogICAgICAgICBt
X3BhZ2UtPnNldHRpbmdzKCktPnNldFBsdWdpbnNFbmFibGVkKGZhbHNlKTs=
</data>

          </attachment>
      

    </bug>

</bugzilla>