6947 2006-01-30 17:43:38 -0800 reproducible crash in SVG Game (due to graphics context set-up) 2006-07-24 10:23:25 -0700 1 1 1 Unclassified WebKit SVG 420+ Mac OS X 10.4 RESOLVED FIXED http://www.codedread.com/yastframe.php HasReduction, InRadar, SVGHitList P1 Normal --- 8425 1 eric dmaclach alice.barraclough dmaclach ian oldest_to_newest 30677 0 eric 2006-01-30 17:43:38 -0800 Reproducible SVG Crash, p2 SVG Hitlist. 30678 1 eric 2006-01-30 17:43:49 -0800 http://www.codedread.com/yastframe.php 32037 2 darin 2006-02-10 09:30:55 -0800 Reproducible crashes, even in SVG, are P1. 32245 3 a 2006-02-12 11:39:39 -0800 unfortunately the actual game itself cannot possibly work so it doesn't seem like a very useful test case alas... a reduced testcase would be very useful. on first glance it looks like a extreme duplicate of 6713 36611 4 alice.barraclough 2006-03-16 18:11:43 -0800 <rdar://problem/4481614> 39420 5 7745 a 2006-04-16 10:37:10 -0700 Created attachment 7745 reduction 41376 6 8132 jonathanjohnsson 2006-05-06 00:52:16 -0700 Created attachment 8132 More reduced test case I reduced the reduction a bit more, it still crashes every time. The difference in the crash logs are mainly in the beginning, as follows (then proceeding identical, except for some addresses): -- first reduction -- Exception: EXC_BAD_ACCESS (0x0001) Codes: KERN_PROTECTION_FAILURE (0x0002) at 0x000003e1 Thread 0 Crashed: 0 com.apple.CoreGraphics 0x903c5560 CGColorTransformGetColorSpace + 52 1 libRIP.A.dylib 0x9474d258 ripc_GetRenderingState + 88 2 libRIP.A.dylib 0x9474c450 ripc_DrawImage + 144 3 com.apple.CoreGraphics 0x903d9ef4 CGContextDelegateDrawImage + 76 4 com.apple.CoreGraphics 0x9046bac4 metalDelegate_FillRectWithImages + 360 5 com.apple.CoreGraphics 0x9046b944 CGContextDelegateFillRectWithImages + 116 6 com.apple.CoreGraphics 0x9046b728 Private_CGContextFillRectWithImagesPrivate + 124 -- second reduction -- Exception: EXC_BAD_ACCESS (0x0001) Codes: KERN_PROTECTION_FAILURE (0x0002) at 0x00000009 Thread 0 Crashed: 0 com.apple.CoreGraphics 0x9043e514 CGContextDelegateSupportsFeature + 28 1 com.apple.CoreGraphics 0x9046b6f0 Private_CGContextFillRectWithImagesPrivate + 68 41377 7 jonathanjohnsson 2006-05-06 01:05:25 -0700 My added test case is practically identical to the test case in bug 8425 (and can be reduced to it). I don't know if that qualifies as a duplicate, someone in the know should look at it. (My reduction was iterative, slowly removing and rearranging elements, crashing every iteration.) 41416 8 eric 2006-05-06 14:37:41 -0700 Yeah, I'm pretty sure I know what's causing this. Beginning a transparency layer, then swapping out the current context (in order to draw the filter content into a temporary buffer) than swapping it back in, causes the problem. In your reduction we have <g opacity="0.5"><g filter="url(#foo)"/></g> which is what is causing the crash. 50608 9 dmaclach 2006-07-23 09:30:19 -0700 There is a patch for this attached to bug 8425 50676 10 ap 2006-07-24 10:23:25 -0700 Fixed by a patch in bug 8425. 7745 2006-04-16 10:37:10 -0700 2006-04-16 10:37:10 -0700 reduction yastgame.svg image/svg+xml 1274 a PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiIHN0YW5kYWxvbmU9Im5vIj8+DQo8 IURPQ1RZUEUgc3ZnIFBVQkxJQyAiLS8vVzNDLy9EVEQgU1ZHIDEuMS8vRU4iICJodHRwOi8vd3d3 LnczLm9yZy9HcmFwaGljcy9TVkcvMS4xL0RURC9zdmcxMS5kdGQiPg0KPHN2ZyB4bWxucz0iaHR0 cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8x OTk5L3hsaW5rIiBvbmxvYWQ9ImluaXQoKSI+DQo8c2NyaXB0Pg0KZnVuY3Rpb24gaW5pdCgpIHsN CiAgIHZhciBidXR0b24gPSBkb2N1bWVudC5nZXRFbGVtZW50QnlJZCgic3RhcnRidXQiKTsNCiAg IGJ1dHRvbi5zZXRBdHRyaWJ1dGUoIm9wYWNpdHkiLCAiMC41Iik7DQp9DQo8L3NjcmlwdD4NCjxk ZWZzPg0KICAgIDxsaW5lYXJHcmFkaWVudCBpZD0iYm90dG9taGlnaCIgeDE9IjAuMCIgeTE9IjAu MCIgeDI9IjAuMCIgeTI9IjEuMCI+DQogICAgICAgIDxzdG9wIG9mZnNldD0iMC4yIiBzdG9wLWNv bG9yPSIjZmZmZmZmIiBzdG9wLW9wYWNpdHk9IjAuMCIvPiA8IS0tIDAuMCAtLT4NCiAgICAgICAg PHN0b3Agb2Zmc2V0PSIxLjAiIHN0b3AtY29sb3I9IiNmZmZmZmYiIHN0b3Atb3BhY2l0eT0iMC42 IiAvPiA8IS0tIDAuNiAtLT4NCiAgICA8L2xpbmVhckdyYWRpZW50Pg0KICAgIDxmaWx0ZXIgaWQ9 ImdibHVyIj4NCiAgICAgICAgPGZlR2F1c3NpYW5CbHVyIHN0ZERldmlhdGlvbj0iMiIgLz4NCiAg ICA8L2ZpbHRlcj4NCiAgICA8cmVjdCBpZD0iYnV0dCIgeD0iMCIgeT0iMCIgd2lkdGg9Ijg3IiBo ZWlnaHQ9IjQwIiByeD0iMjUiIHJ5PSIyNSIgDQogICAgICAgICAgICBmaWxsPSJpbmhlcml0IiBz dHJva2U9Im5vbmUiIC8+DQogICAgPGcgaWQ9ImJ1dHRvbiI+DQogICAgICAgIDx1c2UgdHJhbnNm b3JtPSJzY2FsZSgwLjgsMC40NSkgdHJhbnNsYXRlKDEyLDQ1KSIgeGxpbms6aHJlZj0iI2J1dHQi IGZpbGw9ImJsYWNrIiBmaWx0ZXI9InVybCgjZ2JsdXIpIi8+IA0KICAgIDwvZz4NCjwvZGVmcz4N Cg0KPGcgaWQ9ImJ1dHRvbnNwYW5lbCI+DQogICA8ZyBpZD0ic3RhcnRidXQiPg0KICAgICAgPHVz ZSBpZD0ic3RhcnRidXRfdXNlIiB4bGluazpocmVmPSIjYnV0dG9uIiB4PSIwIiB5PSIwIiB3aWR0 aD0iMTAwIiBoZWlnaHQ9IjUwIiAvPg0KICAgICAgPHRleHQgaWQ9InN0YXJ0bGFiZWwiIHg9IjI0 IiB5PSIyOCIgZm9udC1zaXplPSIxOCIgZmlsbD0ieWVsbG93Ij5TdGFydDwvdGV4dD4NCiAgIDwv Zz4NCjwvZz4NCg0KPC9zdmc+DQo= 8132 2006-05-06 00:52:16 -0700 2006-05-06 00:52:16 -0700 More reduced test case testcase2.svg image/svg+xml 492 jonathanjohnsson PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiIHN0YW5kYWxvbmU9Im5vIj8+DQo8 IURPQ1RZUEUgc3ZnIFBVQkxJQyAiLS8vVzNDLy9EVEQgU1ZHIDEuMS8vRU4iICJodHRwOi8vd3d3 LnczLm9yZy9HcmFwaGljcy9TVkcvMS4xL0RURC9zdmcxMS5kdGQiPg0KPHN2ZyB4bWxucz0iaHR0 cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8x OTk5L3hsaW5rIiA+DQo8ZmlsdGVyIGlkPSJnYmx1ciI+DQogICAgPGZlR2F1c3NpYW5CbHVyIC8+ DQo8L2ZpbHRlcj4NCjxnIGlkPSJzdGFydGJ1dCIgb3BhY2l0eT0iMC41Ij4NCiAgICA8Zz4NCiAg ICAgICAgPHJlY3QgeD0iMCIgeT0iMCIgd2lkdGg9Ijg3IiBoZWlnaHQ9IjQwIiAgZmlsdGVyPSJ1 cmwoI2dibHVyKSIgLz4NCiAgICA8L2c+DQogICAgPHRleHQgIHg9IjI0IiB5PSIyOCIgZmlsbD0i eWVsbG93Ij5TdGFydDwvdGV4dD4NCjwvZz4NCjwvc3ZnPg0K