37751 2010-04-17 02:32:48 -0700 Infinite recursion in WebCore::SVGPatternElement::buildPattern leads to stack exhaustion 2010-04-19 03:26:23 -0700 1 1 1 Unclassified WebKit SVG 528+ (Nightly build) All All RESOLVED DUPLICATE 32171 P2 Normal --- 0 tk.chromium webkit-unassigned krit oldest_to_newest 213594 0 tk.chromium 2010-04-17 02:32:48 -0700 Opening the attached SVG file causes infinite recursion in WebCore::SVGPatternElement::buildPattern, which leads to stack exhaustion. Code snippet: http://svn.webkit.org/repository/webkit/trunk/WebCore/svg/SVGPatternElement.cpp [..] void SVGPatternElement::buildPattern(const FloatRect& targetRect) const { [..] // Render subtree into ImageBuffer for (Node* n = attributes.patternContentElement()->firstChild(); n; n = n->nextSibling()) { if (!n->isSVGElement() || !static_cast<SVGElement*>(n)->isStyled() || !n->renderer()) continue; renderSubtreeToImage(patternImage.get(), n->renderer()); } [..] 213595 1 53595 tk.chromium 2010-04-17 02:33:59 -0700 Created attachment 53595 Testcase 213981 2 krit 2010-04-19 03:26:23 -0700 Thanks for the test case. *** This bug has been marked as a duplicate of bug 32171 *** 53595 2010-04-17 02:33:59 -0700 2010-04-17 02:33:59 -0700 Testcase testcase.xhtml application/xhtml+xml 346 tk.chromium PHN2ZyB2ZXJzaW9uPSIxLjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgeG1s bnM6eGxpbms9Imh0dHA6Ly93d3cudzMub3JnLzE5OTkveGxpbmsiPg0KIDxkZWZzPg0KICA8cGF0 dGVybiBpZD0idGVzdCIgeD0iMTAiIHk9IjEwIiB3aWR0aD0iMTAiIGhlaWdodD0iMTAiPg0KICAg PGVsbGlwc2UgY3g9IjEwIiBjeT0iMTAiIHJ4PSIxMCIgcnk9IjEwIiBmaWxsPSJ1cmwoI3Rlc3Qp IiAvPg0KICA8L3BhdHRlcm4+DQogPC9kZWZzPg0KIDxyZWN0IHg9IjEwIiB5PSIxMCIgd2lkdGg9 IjEwIiBoZWlnaHQ9IjEwIiByeD0iMTAiIHJ5PSIxMCIgZmlsbD0idXJsKCN0ZXN0KSIgLz4NCjwv c3ZnPg==