49564 2010-11-15 14:53:00 -0800 createSVGTransformFromMatrix(undefined) => NULL ptr 2010-12-06 06:06:01 -0800 1 1 1 Unclassified WebKit SVG 528+ (Nightly build) PC Windows Vista RESOLVED FIXED http://code.google.com/p/chromium/issues/detail?id=63266 P1 Normal --- 1 skylined rwlbuis eric mdelaney7 rwlbuis webkit.review.bot zimmermann oldest_to_newest 309455 0 73932 skylined 2010-11-15 14:53:00 -0800 Created attachment 73932 Repro Repro: <script> document.createElementNS("http://www.w3.org/2000/svg", "pattern"). patternTransform.animVal.createSVGTransformFromMatrix(undefined); </script> id: chrome.dll!WebCore::SVGTransformListPropertyTearOff::createSVGTransformFromMatrix ReadAV@NULL (0fa2b124867b86a588efe302a0d5ce30) description: Attempt to read from unallocated NULL pointer+0xC in chrome.dll!WebCore::SVGTransformListPropertyTearOff::createSVGTransformFromMatrix stack: chrome.dll!WebCore::SVGTransformListPropertyTearOff::createSVGTransformFromMatrix chrome.dll!WebCore::SVGTransformListInternal::createSVGTransformFromMatrixCallback chrome.dll!v8::internal::HandleApiCallHelper<...> chrome.dll!v8::internal::Builtin_HandleApiCall chrome.dll!v8::internal::Invoke chrome.dll!v8::internal::Execution::Call ... 316994 1 rwlbuis 2010-12-03 13:11:40 -0800 Some remarks on the bug. - happens with Safari as well - spec does not indicate what to do AFAICS - tried with FF and Opera and both throw an exception possible solutions: 1 have something similar to StrictTypeChecking flag but make it also throw on null/undefined 2 replace the assert with if (!matrix) return 0 in SVGTransformListPropertyTearO.h, fixes the crash but is not what other implementations do. 3 hack the bindings to do something special for SVGTransformList? Sounds more hacky than 1. Waiting for feedback from the bindings experts :) Cheers, Rob. 317364 2 zimmermann 2010-12-05 04:48:41 -0800 Good repo, I was aware of the problem, but forgot to file a bug about it. The ASSERTION should turn in a throw. createSVGTransformFromMatrix has to take an ExceptionCode& parameter, that's then set to a TYPE_MISMATCH_ERR. Sth. like if (!matrix) { ec = TYPE_MISMATCH_ERR; return 0; } That should fix the problem. Just required adding "raises (DOMException)" to the createSVGTransformFromMatrix method in the SVGTransformList.idl. Rob, do you want to fix it? I'm busy this weekend.. 317365 3 rwlbuis 2010-12-05 04:52:12 -0800 Moin Niko, (In reply to comment #2) > Good repo, I was aware of the problem, but forgot to file a bug about it. > The ASSERTION should turn in a throw. > > createSVGTransformFromMatrix has to take an ExceptionCode& parameter, that's then set to a TYPE_MISMATCH_ERR. > > Sth. like > if (!matrix) { ec = TYPE_MISMATCH_ERR; return 0; } > > That should fix the problem. > Just required adding "raises (DOMException)" to the createSVGTransformFromMatrix method in the SVGTransformList.idl. > > Rob, do you want to fix it? I'm busy this weekend.. Yep I have some time and will have a go at it :) Cheers, Rob. 317386 4 75630 rwlbuis 2010-12-05 09:33:12 -0800 Created attachment 75630 Patch 317387 5 webkit.review.bot 2010-12-05 09:35:21 -0800 Attachment 75630 did not pass style-queue: Failed to run "['WebKitTools/Scripts/check-webkit-style', '--diff-files', u'LayoutTests/ChangeLog', u'LayoutTests/svg/dom/SVGTransformList-expected.txt', u'LayoutTests/svg/dom/script-tests/SVGTransformList.js', u'WebCore/ChangeLog', u'WebCore/svg/SVGTransformList.idl', u'WebCore/svg/properties/SVGTransformListPropertyTearOff.h']" exit_code: 1 WebCore/svg/properties/SVGTransformListPropertyTearOff.h:43: More than one command on the same line in if [whitespace/parens] [4] Total errors found: 1 in 6 files If any of these errors are false positives, please file a bug against check-webkit-style. 317400 6 75630 zimmermann 2010-12-05 11:54:30 -0800 Comment on attachment 75630 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=75630&action=review Excellent, please fix the style issues before landing, r=me. > WebCore/svg/properties/SVGTransformListPropertyTearOff.h:43 > + if (!matrix) { ec = TYPE_MISMATCH_ERR; return 0; } Each new statement should go into its own line. 317407 7 rwlbuis 2010-12-05 12:41:46 -0800 Landed in r73345. Also notified chromium. 317579 8 skylined 2010-12-06 06:06:01 -0800 Thanks! 73932 2010-11-15 14:53:00 -0800 2010-11-15 14:53:00 -0800 Repro repro.html text/html 153 skylined PHNjcmlwdD4KZG9jdW1lbnQuY3JlYXRlRWxlbWVudE5TKCJodHRwOi8vd3d3LnczLm9yZy8yMDAw L3N2ZyIsICJwYXR0ZXJuIikuCiAgcGF0dGVyblRyYW5zZm9ybS5hbmltVmFsLmNyZWF0ZVNWR1Ry YW5zZm9ybUZyb21NYXRyaXgodW5kZWZpbmVkKTsKPC9zY3JpcHQ+ 75630 2010-12-05 09:33:12 -0800 2010-12-05 11:54:30 -0800 Patch bug-49564-20101205183838.patch text/plain 5069 rwlbuis ZGlmZiAtLWdpdCBhL0xheW91dFRlc3RzL0NoYW5nZUxvZyBiL0xheW91dFRlc3RzL0NoYW5nZUxv ZwppbmRleCAwZDY1OTFlYjM4YmRlMjQ1Zjg2N2NmM2NiMzI0MWRjNTViMzI0YmFmLi42ZDJhMWY3 NGY4YTNkMjg0OTdlMWEzYzFkM2Q4NGVkMmFhZmYxMjE4IDEwMDY0NAotLS0gYS9MYXlvdXRUZXN0 cy9DaGFuZ2VMb2cKKysrIGIvTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCkBAIC0xLDMgKzEsMTYgQEAK KzIwMTAtMTItMDUgIFJvYiBCdWlzICA8cndsYnVpc0BnbWFpbC5jb20+CisKKyAgICAgICAgUmV2 aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgY3JlYXRlU1ZHVHJhbnNmb3JtRnJv bU1hdHJpeCh1bmRlZmluZWQpID0+IE5VTEwgcHRyCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJr aXQub3JnL3Nob3dfYnVnLmNnaT9pZD00OTU2NAorCisgICAgICAgIEV4dGVuZCBleGlzdGluZyB0 ZXN0IHRvIG1ha2Ugc3VyZSB1bmRlZmluZWQgb3IgbnVsbCBhcyBwYXJhbWV0ZXIKKyAgICAgICAg dGhyb3cgYW4gZXhjZXB0aW9uLgorCisgICAgICAgICogc3ZnL2RvbS9TVkdUcmFuc2Zvcm1MaXN0 LWV4cGVjdGVkLnR4dDoKKyAgICAgICAgKiBzdmcvZG9tL3NjcmlwdC10ZXN0cy9TVkdUcmFuc2Zv cm1MaXN0LmpzOgorCiAyMDEwLTEyLTAzICBEaW1pdHJpIEdsYXprb3YgIDxkZ2xhemtvdkBjaHJv bWl1bS5vcmc+CiAKICAgICAgICAgUmV2aWV3ZWQgYnkgRGFyaW4gQWRsZXIuCmRpZmYgLS1naXQg YS9MYXlvdXRUZXN0cy9zdmcvZG9tL1NWR1RyYW5zZm9ybUxpc3QtZXhwZWN0ZWQudHh0IGIvTGF5 b3V0VGVzdHMvc3ZnL2RvbS9TVkdUcmFuc2Zvcm1MaXN0LWV4cGVjdGVkLnR4dAppbmRleCBjYTMz OGY0YjBhMDVkZWUyNWZhODkzZjVmYjA3ZDAwZjFhZTY5YTAxLi4wMTU3YWFhZDg1ZjA1NGNkYTM1 YzhmZDdmYTZhNDA5ZWFhODk3YjgxIDEwMDY0NAotLS0gYS9MYXlvdXRUZXN0cy9zdmcvZG9tL1NW R1RyYW5zZm9ybUxpc3QtZXhwZWN0ZWQudHh0CisrKyBiL0xheW91dFRlc3RzL3N2Zy9kb20vU1ZH VHJhbnNmb3JtTGlzdC1leHBlY3RlZC50eHQKQEAgLTExLDYgKzExLDggQEAgUEFTUyB0cmFuc2Zv cm0uY3JlYXRlU1ZHVHJhbnNmb3JtRnJvbU1hdHJpeChzdmdFbGVtZW50KSB0aHJldyBleGNlcHRp b24gVHlwZUVycm8KIFBBU1MgdHJhbnNmb3JtLmNyZWF0ZVNWR1RyYW5zZm9ybUZyb21NYXRyaXgo J2FTdHJpbmcnKSB0aHJldyBleGNlcHRpb24gVHlwZUVycm9yOiBUeXBlIGVycm9yLgogUEFTUyB0 cmFuc2Zvcm0uY3JlYXRlU1ZHVHJhbnNmb3JtRnJvbU1hdHJpeCgxKSB0aHJldyBleGNlcHRpb24g VHlwZUVycm9yOiBUeXBlIGVycm9yLgogUEFTUyB0cmFuc2Zvcm0uY3JlYXRlU1ZHVHJhbnNmb3Jt RnJvbU1hdHJpeCh0cnVlKSB0aHJldyBleGNlcHRpb24gVHlwZUVycm9yOiBUeXBlIGVycm9yLgor UEFTUyB0cmFuc2Zvcm0uY3JlYXRlU1ZHVHJhbnNmb3JtRnJvbU1hdHJpeCh1bmRlZmluZWQpIHRo cmV3IGV4Y2VwdGlvbiBFcnJvcjogVFlQRV9NSVNNQVRDSF9FUlI6IERPTSBFeGNlcHRpb24gMTcu CitQQVNTIHRyYW5zZm9ybS5jcmVhdGVTVkdUcmFuc2Zvcm1Gcm9tTWF0cml4KG51bGwpIHRocmV3 IGV4Y2VwdGlvbiBFcnJvcjogVFlQRV9NSVNNQVRDSF9FUlI6IERPTSBFeGNlcHRpb24gMTcuCiBQ QVNTIHN1Y2Nlc3NmdWxseVBhcnNlZCBpcyB0cnVlCiAKIFRFU1QgQ09NUExFVEUKZGlmZiAtLWdp dCBhL0xheW91dFRlc3RzL3N2Zy9kb20vc2NyaXB0LXRlc3RzL1NWR1RyYW5zZm9ybUxpc3QuanMg Yi9MYXlvdXRUZXN0cy9zdmcvZG9tL3NjcmlwdC10ZXN0cy9TVkdUcmFuc2Zvcm1MaXN0LmpzCmlu ZGV4IGY1ZmQ5MmYyNTJlMzBhY2EzZTBkNTdlZTJjNzYwMGJmOTNkMDA0ODAuLjdlOGMxNThhOWRm ZmEwNDczMDk4MzBlMmRhYmFkNGIwMjVmMTBhZTMgMTAwNjQ0Ci0tLSBhL0xheW91dFRlc3RzL3N2 Zy9kb20vc2NyaXB0LXRlc3RzL1NWR1RyYW5zZm9ybUxpc3QuanMKKysrIGIvTGF5b3V0VGVzdHMv c3ZnL2RvbS9zY3JpcHQtdGVzdHMvU1ZHVHJhbnNmb3JtTGlzdC5qcwpAQCAtMTIsNSArMTIsNyBA QCBzaG91bGRUaHJvdygidHJhbnNmb3JtLmNyZWF0ZVNWR1RyYW5zZm9ybUZyb21NYXRyaXgoc3Zn RWxlbWVudCkiKTsKIHNob3VsZFRocm93KCJ0cmFuc2Zvcm0uY3JlYXRlU1ZHVHJhbnNmb3JtRnJv bU1hdHJpeCgnYVN0cmluZycpIik7CiBzaG91bGRUaHJvdygidHJhbnNmb3JtLmNyZWF0ZVNWR1Ry YW5zZm9ybUZyb21NYXRyaXgoMSkiKTsKIHNob3VsZFRocm93KCJ0cmFuc2Zvcm0uY3JlYXRlU1ZH VHJhbnNmb3JtRnJvbU1hdHJpeCh0cnVlKSIpOworc2hvdWxkVGhyb3coInRyYW5zZm9ybS5jcmVh dGVTVkdUcmFuc2Zvcm1Gcm9tTWF0cml4KHVuZGVmaW5lZCkiKTsKK3Nob3VsZFRocm93KCJ0cmFu c2Zvcm0uY3JlYXRlU1ZHVHJhbnNmb3JtRnJvbU1hdHJpeChudWxsKSIpOwogCiBzdWNjZXNzZnVs bHlQYXJzZWQgPSB0cnVlOwpkaWZmIC0tZ2l0IGEvV2ViQ29yZS9DaGFuZ2VMb2cgYi9XZWJDb3Jl L0NoYW5nZUxvZwppbmRleCBkNzkyZDY2OWU4YzljMjNjY2U2MWU4Mzk3ZmM0ZDMyZDY4YzUyZDcy Li5jOWFjNTMwODAwMjk4ZDhkMDZmZjhlOGFmM2EyNGY3MzRmYmI5ZTUyIDEwMDY0NAotLS0gYS9X ZWJDb3JlL0NoYW5nZUxvZworKysgYi9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDE2IEBA CisyMDEwLTEyLTA1ICBSb2IgQnVpcyAgPHJ3bGJ1aXNAZ21haWwuY29tPgorCisgICAgICAgIFJl dmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIGNyZWF0ZVNWR1RyYW5zZm9ybUZy b21NYXRyaXgodW5kZWZpbmVkKSA9PiBOVUxMIHB0cgorICAgICAgICBodHRwczovL2J1Z3Mud2Vi a2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9NDk1NjQKKworICAgICAgICBUaHJvdyBUWVBFX01JU01B VENIX0VSUiB3aGVuIHVzaW5nIHVuZGVmaW5lZCBvciBudWxsIGFzIHZhbHVlIGZvciBtYXRyaXgg cGFyYW1ldGVyLgorCisgICAgICAgICogc3ZnL1NWR1RyYW5zZm9ybUxpc3QuaWRsOgorICAgICAg ICAqIHN2Zy9wcm9wZXJ0aWVzL1NWR1RyYW5zZm9ybUxpc3RQcm9wZXJ0eVRlYXJPZmYuaDoKKyAg ICAgICAgKFdlYkNvcmU6OlNWR1RyYW5zZm9ybUxpc3RQcm9wZXJ0eVRlYXJPZmY6OmNyZWF0ZVNW R1RyYW5zZm9ybUZyb21NYXRyaXgpOgorCiAyMDEwLTEyLTAzICBEaW1pdHJpIEdsYXprb3YgIDxk Z2xhemtvdkBjaHJvbWl1bS5vcmc+CiAKICAgICAgICAgUmV2aWV3ZWQgYnkgRGFyaW4gQWRsZXIu CmRpZmYgLS1naXQgYS9XZWJDb3JlL3N2Zy9TVkdUcmFuc2Zvcm1MaXN0LmlkbCBiL1dlYkNvcmUv c3ZnL1NWR1RyYW5zZm9ybUxpc3QuaWRsCmluZGV4IGNkZDgxM2Q4MTA5YjJiZDBmMGQ3MTkwYzdk YWU0YWUxMzE0NjE4NTcuLjhiYmIwOTE0OGIxM2M3Yjc2NmYwMjU0ZTlmYzdmNGIwYTlhODRkZWYg MTAwNjQ0Ci0tLSBhL1dlYkNvcmUvc3ZnL1NWR1RyYW5zZm9ybUxpc3QuaWRsCisrKyBiL1dlYkNv cmUvc3ZnL1NWR1RyYW5zZm9ybUxpc3QuaWRsCkBAIC00NCw3ICs0NCw5IEBAIG1vZHVsZSBzdmcg ewogICAgICAgICBbU3RyaWN0VHlwZUNoZWNraW5nLCBSZXF1aXJlc0FsbEFyZ3VtZW50cz1SYWlz ZV0gU1ZHVHJhbnNmb3JtIGFwcGVuZEl0ZW0oaW4gU1ZHVHJhbnNmb3JtIGl0ZW0pCiAgICAgICAg ICAgICByYWlzZXMoRE9NRXhjZXB0aW9uLCBTVkdFeGNlcHRpb24pOwogCi0gICAgICAgIFtTdHJp Y3RUeXBlQ2hlY2tpbmcsIFJlcXVpcmVzQWxsQXJndW1lbnRzPVJhaXNlXSBTVkdUcmFuc2Zvcm0g Y3JlYXRlU1ZHVHJhbnNmb3JtRnJvbU1hdHJpeChpbiBTVkdNYXRyaXggbWF0cml4KTsKKyAgICAg ICAgW1N0cmljdFR5cGVDaGVja2luZywgUmVxdWlyZXNBbGxBcmd1bWVudHM9UmFpc2VdIFNWR1Ry YW5zZm9ybSBjcmVhdGVTVkdUcmFuc2Zvcm1Gcm9tTWF0cml4KGluIFNWR01hdHJpeCBtYXRyaXgp CisgICAgICAgICAgICByYWlzZXMoRE9NRXhjZXB0aW9uKTsKKwogICAgICAgICBTVkdUcmFuc2Zv cm0gY29uc29saWRhdGUoKQogICAgICAgICAgICAgcmFpc2VzKERPTUV4Y2VwdGlvbik7CiAgICAg fTsKZGlmZiAtLWdpdCBhL1dlYkNvcmUvc3ZnL3Byb3BlcnRpZXMvU1ZHVHJhbnNmb3JtTGlzdFBy b3BlcnR5VGVhck9mZi5oIGIvV2ViQ29yZS9zdmcvcHJvcGVydGllcy9TVkdUcmFuc2Zvcm1MaXN0 UHJvcGVydHlUZWFyT2ZmLmgKaW5kZXggZDNhZDFjYWNiOTc1MmM0ZGRiNTM3MDY0ZjI5ZDRkNDY1 Nzk1NGFkMi4uYTMzMGYzYjRjYjJkYjEyMzZmMDdjOTc0MDU2Nzk1ODFhZGY0YWFiNiAxMDA2NDQK LS0tIGEvV2ViQ29yZS9zdmcvcHJvcGVydGllcy9TVkdUcmFuc2Zvcm1MaXN0UHJvcGVydHlUZWFy T2ZmLmgKKysrIGIvV2ViQ29yZS9zdmcvcHJvcGVydGllcy9TVkdUcmFuc2Zvcm1MaXN0UHJvcGVy dHlUZWFyT2ZmLmgKQEAgLTM4LDkgKzM4LDkgQEAgcHVibGljOgogICAgICAgICByZXR1cm4gYWRv cHRSZWYobmV3IFNWR1RyYW5zZm9ybUxpc3RQcm9wZXJ0eVRlYXJPZmYoYW5pbWF0ZWRQcm9wZXJ0 eSwgcm9sZSkpOwogICAgIH0KIAotICAgIFBhc3NSZWZQdHI8U1ZHUHJvcGVydHlUZWFyT2ZmPFNW R1RyYW5zZm9ybT4gPiBjcmVhdGVTVkdUcmFuc2Zvcm1Gcm9tTWF0cml4KFNWR1Byb3BlcnR5VGVh ck9mZjxTVkdNYXRyaXg+KiBtYXRyaXgpCisgICAgUGFzc1JlZlB0cjxTVkdQcm9wZXJ0eVRlYXJP ZmY8U1ZHVHJhbnNmb3JtPiA+IGNyZWF0ZVNWR1RyYW5zZm9ybUZyb21NYXRyaXgoU1ZHUHJvcGVy dHlUZWFyT2ZmPFNWR01hdHJpeD4qIG1hdHJpeCwgRXhjZXB0aW9uQ29kZSYgZWMpCiAgICAgewot ICAgICAgICBBU1NFUlQobWF0cml4KTsKKyAgICAgICAgaWYgKCFtYXRyaXgpIHsgZWMgPSBUWVBF X01JU01BVENIX0VSUjsgcmV0dXJuIDA7IH0KICAgICAgICAgU1ZHVHJhbnNmb3JtTGlzdCYgdmFs dWVzID0gbV9hbmltYXRlZFByb3BlcnR5LT52YWx1ZXMoKTsKICAgICAgICAgcmV0dXJuIFNWR1By b3BlcnR5VGVhck9mZjxTVkdUcmFuc2Zvcm0+OjpjcmVhdGUodmFsdWVzLmNyZWF0ZVNWR1RyYW5z Zm9ybUZyb21NYXRyaXgobWF0cml4LT5wcm9wZXJ0eVJlZmVyZW5jZSgpKSk7CiAgICAgfQo=