66019 2011-08-10 16:17:55 -0700 Crash when clicking an SVG <a> link to the local document 2011-08-11 09:49:11 -0700 1 1 1 Unclassified WebKit SVG 528+ (Nightly build) Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 thorton thorton rwlbuis webkit.review.bot zimmermann oldest_to_newest 449466 0 thorton 2011-08-10 16:17:55 -0700 Steps to Reproduce: 1. Open the attached file in a WebKit browser. Expected Results: Some text on the screen ("PASS if no crash"). Actual Results: Renderer crashes. Notes: It seems that r89745 added some code to SVGAElement::defaultEventHandler which depends on getElementById returning a valid element, which is certainly not guaranteed. I have a (very simple) patch to fix (and a test). 449467 1 103551 thorton 2011-08-10 16:18:42 -0700 Created attachment 103551 Repro. 449476 2 thorton 2011-08-10 16:31:38 -0700 <rdar://problem/9933311> 449482 3 103556 thorton 2011-08-10 16:40:28 -0700 Created attachment 103556 Patch 449489 4 103556 rwlbuis 2011-08-10 16:47:57 -0700 Comment on attachment 103556 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=103556&action=review R+, provided EWS shows up nothing. > LayoutTests/svg/custom/click-internal-anchor-with-use-crash.xhtml:23 > + <a id="link" xlink:href="#"> You could try making the invalid reference more clear (for example #non_existant or something). 449536 5 103556 webkit.review.bot 2011-08-10 18:02:15 -0700 Comment on attachment 103556 Patch Clearing flags on attachment: 103556 Committed r92809: <http://trac.webkit.org/changeset/92809> 449537 6 webkit.review.bot 2011-08-10 18:02:19 -0700 All reviewed patches have been landed. Closing bug. 103551 2011-08-10 16:18:42 -0700 2011-08-10 16:18:42 -0700 Repro. click-internal-anchor-with-use-crash.xhtml application/xhtml+xml 866 thorton 77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz4KPGh0bWw+CiAgICA8c3Zn IHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgb25sb2FkPSJvbkxvYWQoKSIgeG1s bnM6eGxpbms9Imh0dHA6Ly93d3cudzMub3JnLzE5OTkveGxpbmsiPgogICAgICAgIDxzY3JpcHQg dHlwZT0idGV4dC9qYXZhc2NyaXB0Ij4KICAgICAgICBmdW5jdGlvbiBvbkxvYWQoKQogICAgICAg IHsKICAgICAgICAgICAgY2xpY2tMaW5rKGRvY3VtZW50LmdldEVsZW1lbnRCeUlkKCJsaW5rIikp OwogICAgICAgICAgICAKICAgICAgICAgICAgaWYgKHdpbmRvdy5sYXlvdXRUZXN0Q29udHJvbGxl cikKICAgICAgICAgICAgICAgIGxheW91dFRlc3RDb250cm9sbGVyLmR1bXBBc1RleHQoKTsKICAg ICAgICB9CgogICAgICAgIGZ1bmN0aW9uIGNsaWNrTGluayhsaW5rKQogICAgICAgIHsKICAgICAg ICAgICAgdmFyIGV2ZW50ID0gZG9jdW1lbnQuY3JlYXRlRXZlbnQoIk1vdXNlRXZlbnRzIik7CiAg ICAgICAgICAgIGV2ZW50LmluaXRNb3VzZUV2ZW50KCJjbGljayIsIHRydWUsIHRydWUsIHdpbmRv dywKICAgICAgICAgICAgICAgIDAsIDAsIDAsIDAsIDAsCiAgICAgICAgICAgICAgICBmYWxzZSwg ZmFsc2UsIGZhbHNlLCBmYWxzZSwKICAgICAgICAgICAgICAgIDAsIG51bGwpOwogICAgICAgICAg ICBsaW5rLmRpc3BhdGNoRXZlbnQoZXZlbnQpOwogICAgICAgIH0KICAgICAgICA8L3NjcmlwdD4K ICAgICAgICA8YSBpZD0ibGluayIgeGxpbms6aHJlZj0iIyI+CiAgICAgICAgICAgIDx0ZXh0IHg9 IjUwIiB5PSI1MCI+UEFTUyBpZiBubyBjcmFzaDwvdGV4dD4KICAgICAgICA8L2E+CiAgICA8L3N2 Zz4KPC9odG1sPgo= 103556 2011-08-10 16:40:28 -0700 2011-08-11 09:49:11 -0700 Patch 0001-Crash-when-clicking-an-SVG-a-link-to-the-local-docum.patch text/plain 4866 thorton RnJvbSBlYWVmZjkwOTdkMzVmNTczNTY4MjdjMTI4OTEwYTE4YzAxOTE2Zjg0IE1vbiBTZXAgMTcg MDA6MDA6MDAgMjAwMQpGcm9tOiBUaW0gSG9ydG9uIDx0aW1vdGh5X2hvcnRvbkBhcHBsZS5jb20+ CkRhdGU6IFdlZCwgMTAgQXVnIDIwMTEgMTU6MDU6MzQgLTA3MDAKU3ViamVjdDogW1BBVENIXSBD cmFzaCB3aGVuIGNsaWNraW5nIGFuIFNWRyA8YT4gbGluayB0byB0aGUgbG9jYWwgZG9jdW1lbnQK IGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD02NjAxOQogPHJkYXI6Ly9w cm9ibGVtLzk5MzMzMTE+CgpSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KCkNoZWNrIGlmIHRo ZSB0YXJnZXQgZWxlbWVudCBvZiBhbiBpbnRlcm5hbCBsaW5rIGlzIHZhbGlkIGJlZm9yZQptYWtp bmcgdXNlIG9mIGl0LgoKVGVzdDogc3ZnL2N1c3RvbS9jbGljay1pbnRlcm5hbC1hbmNob3Itd2l0 aC11c2UtY3Jhc2gueGh0bWwKLS0tCiBMYXlvdXRUZXN0cy9DaGFuZ2VMb2cgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICB8ICAgMTQgKysrKysrKysrKwogLi4uaWNrLWludGVybmFsLWFuY2hv ci13aXRoLXVzZS1jcmFzaC1leHBlY3RlZC50eHQgfCAgICAyICsKIC4uLi9jbGljay1pbnRlcm5h bC1hbmNob3Itd2l0aC11c2UtY3Jhc2gueGh0bWwgICAgIHwgICAyNyArKysrKysrKysrKysrKysr KysrKwogU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nICAgICAgICAgICAgICAgICAgICAgICAgICAg fCAgIDE2ICsrKysrKysrKysrCiBTb3VyY2UvV2ViQ29yZS9zdmcvU1ZHQUVsZW1lbnQuY3BwICAg ICAgICAgICAgICAgICB8ICAgIDIgKy0KIDUgZmlsZXMgY2hhbmdlZCwgNjAgaW5zZXJ0aW9ucygr KSwgMSBkZWxldGlvbnMoLSkKIGNyZWF0ZSBtb2RlIDEwMDY0NCBMYXlvdXRUZXN0cy9zdmcvY3Vz dG9tL2NsaWNrLWludGVybmFsLWFuY2hvci13aXRoLXVzZS1jcmFzaC1leHBlY3RlZC50eHQKIGNy ZWF0ZSBtb2RlIDEwMDY0NCBMYXlvdXRUZXN0cy9zdmcvY3VzdG9tL2NsaWNrLWludGVybmFsLWFu Y2hvci13aXRoLXVzZS1jcmFzaC54aHRtbAoKZGlmZiAtLWdpdCBhL0xheW91dFRlc3RzL0NoYW5n ZUxvZyBiL0xheW91dFRlc3RzL0NoYW5nZUxvZwppbmRleCBkZjRhMmNkLi4yZmQyM2M0IDEwMDY0 NAotLS0gYS9MYXlvdXRUZXN0cy9DaGFuZ2VMb2cKKysrIGIvTGF5b3V0VGVzdHMvQ2hhbmdlTG9n CkBAIC0xLDMgKzEsMTcgQEAKKzIwMTEtMDgtMTAgIFRpbSBIb3J0b24gIDx0aW1vdGh5X2hvcnRv bkBhcHBsZS5jb20+CisKKyAgICAgICAgQ3Jhc2ggd2hlbiBjbGlja2luZyBhbiBTVkcgPGE+IGxp bmsgdG8gdGhlIGxvY2FsIGRvY3VtZW50CisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3Jn L3Nob3dfYnVnLmNnaT9pZD02NjAxOQorICAgICAgICA8cmRhcjovL3Byb2JsZW0vOTkzMzMxMT4K KworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICBBZGQgYSB0 ZXN0IHdoaWNoIHByb2dyYW1tYXRpY2FsbHkgY2xpY2tzIGEgbGluayByZWZlcnJpbmcgdG8gIiMi LAorICAgICAgICBhbmQgc2hvdWxkIGNyYXNoIGJldHdlZW4gcjg5NzQ1IGFuZCB0aGlzIGNvbW1p dC4KKworICAgICAgICAqIHN2Zy9jdXN0b20vY2xpY2staW50ZXJuYWwtYW5jaG9yLXdpdGgtdXNl LWNyYXNoLWV4cGVjdGVkLnR4dDogQWRkZWQuCisgICAgICAgICogc3ZnL2N1c3RvbS9jbGljay1p bnRlcm5hbC1hbmNob3Itd2l0aC11c2UtY3Jhc2gueGh0bWw6IEFkZGVkLgorCiAyMDExLTA4LTEw ICBWc2V2b2xvZCBWbGFzb3YgIDx2c2V2aWtAY2hyb21pdW0ub3JnPgogCiAgICAgICAgIFdlYiBJ bnNwZWN0b3I6IGNvbnNvbGUgbWVzc2FnZXMgbWFya2VycyBhcmUgbG9zdCBpbiBSZXNvdXJjZXMg cGFuZWwgYWZ0ZXIgcGFnZSByZWxvYWQKZGlmZiAtLWdpdCBhL0xheW91dFRlc3RzL3N2Zy9jdXN0 b20vY2xpY2staW50ZXJuYWwtYW5jaG9yLXdpdGgtdXNlLWNyYXNoLWV4cGVjdGVkLnR4dCBiL0xh eW91dFRlc3RzL3N2Zy9jdXN0b20vY2xpY2staW50ZXJuYWwtYW5jaG9yLXdpdGgtdXNlLWNyYXNo LWV4cGVjdGVkLnR4dApuZXcgZmlsZSBtb2RlIDEwMDY0NAppbmRleCAwMDAwMDAwLi4yYjk2MzJk Ci0tLSAvZGV2L251bGwKKysrIGIvTGF5b3V0VGVzdHMvc3ZnL2N1c3RvbS9jbGljay1pbnRlcm5h bC1hbmNob3Itd2l0aC11c2UtY3Jhc2gtZXhwZWN0ZWQudHh0CkBAIC0wLDAgKzEsMiBAQAorUEFT UyBpZiBubyBjcmFzaAorCmRpZmYgLS1naXQgYS9MYXlvdXRUZXN0cy9zdmcvY3VzdG9tL2NsaWNr LWludGVybmFsLWFuY2hvci13aXRoLXVzZS1jcmFzaC54aHRtbCBiL0xheW91dFRlc3RzL3N2Zy9j dXN0b20vY2xpY2staW50ZXJuYWwtYW5jaG9yLXdpdGgtdXNlLWNyYXNoLnhodG1sCm5ldyBmaWxl IG1vZGUgMTAwNjQ0CmluZGV4IDAwMDAwMDAuLjhjNWI0ZGMKLS0tIC9kZXYvbnVsbAorKysgYi9M YXlvdXRUZXN0cy9zdmcvY3VzdG9tL2NsaWNrLWludGVybmFsLWFuY2hvci13aXRoLXVzZS1jcmFz aC54aHRtbApAQCAtMCwwICsxLDI3IEBACivvu788P3htbCB2ZXJzaW9uPSIxLjAiIGVuY29kaW5n PSJ1dGYtOCI/PgorPGh0bWw+CisgICAgPHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAw MC9zdmciIG9ubG9hZD0ib25Mb2FkKCkiIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8x OTk5L3hsaW5rIj4KKyAgICAgICAgPHNjcmlwdCB0eXBlPSJ0ZXh0L2phdmFzY3JpcHQiPgorICAg ICAgICBmdW5jdGlvbiBvbkxvYWQoKQorICAgICAgICB7CisgICAgICAgICAgICBjbGlja0xpbmso ZG9jdW1lbnQuZ2V0RWxlbWVudEJ5SWQoImxpbmsiKSk7CisgICAgICAgICAgICAKKyAgICAgICAg ICAgIGlmICh3aW5kb3cubGF5b3V0VGVzdENvbnRyb2xsZXIpCisgICAgICAgICAgICAgICAgbGF5 b3V0VGVzdENvbnRyb2xsZXIuZHVtcEFzVGV4dCgpOworICAgICAgICB9CisKKyAgICAgICAgZnVu Y3Rpb24gY2xpY2tMaW5rKGxpbmspCisgICAgICAgIHsKKyAgICAgICAgICAgIHZhciBldmVudCA9 IGRvY3VtZW50LmNyZWF0ZUV2ZW50KCJNb3VzZUV2ZW50cyIpOworICAgICAgICAgICAgZXZlbnQu aW5pdE1vdXNlRXZlbnQoImNsaWNrIiwgdHJ1ZSwgdHJ1ZSwgd2luZG93LAorICAgICAgICAgICAg ICAgIDAsIDAsIDAsIDAsIDAsCisgICAgICAgICAgICAgICAgZmFsc2UsIGZhbHNlLCBmYWxzZSwg ZmFsc2UsCisgICAgICAgICAgICAgICAgMCwgbnVsbCk7CisgICAgICAgICAgICBsaW5rLmRpc3Bh dGNoRXZlbnQoZXZlbnQpOworICAgICAgICB9CisgICAgICAgIDwvc2NyaXB0PgorICAgICAgICA8 YSBpZD0ibGluayIgeGxpbms6aHJlZj0iIyI+CisgICAgICAgICAgICA8dGV4dCB4PSI1MCIgeT0i NTAiPlBBU1MgaWYgbm8gY3Jhc2g8L3RleHQ+CisgICAgICAgIDwvYT4KKyAgICA8L3N2Zz4KKzwv aHRtbD4KZGlmZiAtLWdpdCBhL1NvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZyBiL1NvdXJjZS9XZWJD b3JlL0NoYW5nZUxvZwppbmRleCBjMDEwZmE5Li4zMzM4ZDA5IDEwMDY0NAotLS0gYS9Tb3VyY2Uv V2ViQ29yZS9DaGFuZ2VMb2cKKysrIGIvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCkBAIC0xLDMg KzEsMTkgQEAKKzIwMTEtMDgtMTAgIFRpbSBIb3J0b24gIDx0aW1vdGh5X2hvcnRvbkBhcHBsZS5j b20+CisKKyAgICAgICAgQ3Jhc2ggd2hlbiBjbGlja2luZyBhbiBTVkcgPGE+IGxpbmsgdG8gdGhl IGxvY2FsIGRvY3VtZW50CisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVn LmNnaT9pZD02NjAxOQorICAgICAgICA8cmRhcjovL3Byb2JsZW0vOTkzMzMxMT4KKworICAgICAg ICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICBDaGVjayBpZiB0aGUgdGFy Z2V0IGVsZW1lbnQgb2YgYW4gaW50ZXJuYWwgbGluayBpcyB2YWxpZCBiZWZvcmUKKyAgICAgICAg bWFraW5nIHVzZSBvZiBpdC4KKworICAgICAgICBUZXN0OiBzdmcvY3VzdG9tL2NsaWNrLWludGVy bmFsLWFuY2hvci13aXRoLXVzZS1jcmFzaC54aHRtbAorCisgICAgICAgICogc3ZnL1NWR0FFbGVt ZW50LmNwcDoKKyAgICAgICAgKFdlYkNvcmU6OlNWR0FFbGVtZW50OjpkZWZhdWx0RXZlbnRIYW5k bGVyKToKKwogMjAxMS0wOC0xMCAgVnNldm9sb2QgVmxhc292ICA8dnNldmlrQGNocm9taXVtLm9y Zz4KIAogICAgICAgICBXZWIgSW5zcGVjdG9yOiBjb25zb2xlIG1lc3NhZ2VzIG1hcmtlcnMgYXJl IGxvc3QgaW4gUmVzb3VyY2VzIHBhbmVsIGFmdGVyIHBhZ2UgcmVsb2FkCmRpZmYgLS1naXQgYS9T b3VyY2UvV2ViQ29yZS9zdmcvU1ZHQUVsZW1lbnQuY3BwIGIvU291cmNlL1dlYkNvcmUvc3ZnL1NW R0FFbGVtZW50LmNwcAppbmRleCAwOWM2OTYyLi40YzI4NTc4IDEwMDY0NAotLS0gYS9Tb3VyY2Uv V2ViQ29yZS9zdmcvU1ZHQUVsZW1lbnQuY3BwCisrKyBiL1NvdXJjZS9XZWJDb3JlL3N2Zy9TVkdB RWxlbWVudC5jcHAKQEAgLTE3MCw3ICsxNzAsNyBAQCB2b2lkIFNWR0FFbGVtZW50OjpkZWZhdWx0 RXZlbnRIYW5kbGVyKEV2ZW50KiBldmVudCkKICAgICAgICAgICAgICAgICAgICAgcmV0dXJuOwog ICAgICAgICAgICAgICAgIH0KICAgICAgICAgICAgICAgICAvLyBPbmx5IGFsbG93IG5hdmlnYXRp b24gdG8gaW50ZXJuYWwgPHZpZXc+IGFuY2hvcnMuCi0gICAgICAgICAgICAgICAgaWYgKCF0YXJn ZXRFbGVtZW50LT5oYXNUYWdOYW1lKFNWR05hbWVzOjp2aWV3VGFnKSkKKyAgICAgICAgICAgICAg ICBpZiAodGFyZ2V0RWxlbWVudCAmJiAhdGFyZ2V0RWxlbWVudC0+aGFzVGFnTmFtZShTVkdOYW1l czo6dmlld1RhZykpCiAgICAgICAgICAgICAgICAgICAgIHJldHVybjsKICAgICAgICAgICAgIH0K ICNlbmRpZgotLSAKMS43LjQuNAoK