82375 2012-03-27 13:39:55 -0700 Null dereference in SVGTextElement::animatedLocalTransform() 2012-03-28 13:40:45 -0700 1 1 1 Unclassified WebKit SVG 528+ (Nightly build) Unspecified Unspecified RESOLVED FIXED P2 Normal --- 1 schenney schenney webkit.review.bot zimmermann oldest_to_newest 589225 0 134125 schenney 2012-03-27 13:39:55 -0700 Created attachment 134125 Repro case, crashes When a malformed SVG document puts a text element inside an animation element, like this <html> <head> <script type="application/javascript"> function test() { document.getElementById("crash").getTransformToElement(); } </script> </head> <body> <svg xmlns="http://www.w3.org/2000/svg" version="1.1" onload="test()"> <animateTransform > <text id="crash"> </text> </animateTransform> </svg> </body> </html> there is a crash because the text element does not have a renderer (it is an orphan, it seems, because animateTransform elements do not have rendered children) and this causes a crash when getCTM calls SVGTextElement::animatedLocalTransform(). 589238 1 134128 schenney 2012-03-27 13:50:12 -0700 Created attachment 134128 Patch 589863 2 134128 zimmermann 2012-03-28 05:15:31 -0700 Comment on attachment 134128 Patch r=me. 589941 3 134128 webkit.review.bot 2012-03-28 07:28:21 -0700 Comment on attachment 134128 Patch Clearing flags on attachment: 134128 Committed r112394: <http://trac.webkit.org/changeset/112394> 589942 4 webkit.review.bot 2012-03-28 07:28:25 -0700 All reviewed patches have been landed. Closing bug. 590075 5 schenney 2012-03-28 10:09:50 -0700 Just FYI, I checked the other implementations of animatedLocalTransform(). There is only one, in SVGStyledTransformableElement, and it already had the exact check I added. Maybe in the future we should require that changes to implementations of a method check for all other implementations to see if they need the same fix. We can just raise the issue in reviews. 590363 6 schenney 2012-03-28 13:40:45 -0700 *** Bug 81992 has been marked as a duplicate of this bug. *** 134125 2012-03-27 13:39:55 -0700 2012-03-27 13:39:55 -0700 Repro case, crashes get-text-element-transform-crash.html text/html 388 schenney PGh0bWw+CiAgPGhlYWQ+CiAgICA8c2NyaXB0IHR5cGU9ImFwcGxpY2F0aW9uL2phdmFzY3JpcHQi PgogICAgICBmdW5jdGlvbiB0ZXN0KCkgewogICAgICAgIGRvY3VtZW50LmdldEVsZW1lbnRCeUlk KCJjcmFzaCIpLmdldFRyYW5zZm9ybVRvRWxlbWVudCgpOwogICAgICB9CiAgICA8L3NjcmlwdD4K ICA8L2hlYWQ+CiAgPGJvZHk+CiAgICA8c3ZnIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAw L3N2ZyIgdmVyc2lvbj0iMS4xIiBvbmxvYWQ9InRlc3QoKSI+CiAgICAgIDxhbmltYXRlVHJhbnNm b3JtID4KICAgICAgICA8dGV4dCBpZD0iY3Jhc2giPgogICAgICAgIDwvdGV4dD4KICAgICAgPC9h bmltYXRlVHJhbnNmb3JtPgogICAgPC9zdmc+CiAgPC9ib2R5Pgo8L2h0bWw+Cg== 134128 2012-03-27 13:50:12 -0700 2012-03-28 07:28:21 -0700 Patch bug-82375-20120327165011.patch text/plain 3781 schenney SW5kZXg6IFNvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2Vi Q29yZS9DaGFuZ2VMb2cJKHJldmlzaW9uIDExMjMxMikKKysrIFNvdXJjZS9XZWJDb3JlL0NoYW5n ZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDIxIEBACisyMDEyLTAzLTI3ICBTdGVwaGVu IENoZW5uZXkgIDxzY2hlbm5leUBjaHJvbWl1bS5vcmc+CisKKyAgICAgICAgTnVsbCBkZXJlZmVy ZW5jZSBpbiBTVkdUZXh0RWxlbWVudDo6YW5pbWF0ZWRMb2NhbFRyYW5zZm9ybSgpCisgICAgICAg IGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD04MjM3NQorCisgICAgICAg IFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIEEgcG9vcmx5IHN0cnVjdHVy ZWQgU1ZHIGZpbGUgd2l0aCBhIHRleHQgZWxlbWVudCBpbnNpZGUgYW4KKyAgICAgICAgYW5pbWF0 ZWRUcmFuc2Zvcm0gZWxlbWVudCBsZWF2ZXMgdGhlIHRleHQgZWxlbWVudCBwbGFjZWQgb3V0c2lk ZSBvZgorICAgICAgICB0aGUgU1ZHIHJvb3QgYW5kIGl0IGhhcyBubyByZW5kZXJlcigpLiBMYXRl ciBhdHRlbXB0cyB0byB1c2UgdGhlCisgICAgICAgIHJlbmRlcmVyIGluIGFuaW1hdGVkTG9jYWxU cmFuc2Zvcm0gZmFpbC4KKworICAgICAgICBUZXN0OiBzdmcvY3VzdG9tL2dldC10ZXh0LWVsZW1l bnQtdHJhbnNmb3JtLWNyYXNoLmh0bWwKKworICAgICAgICAqIHN2Zy9TVkdUZXh0RWxlbWVudC5j cHA6CisgICAgICAgIChXZWJDb3JlOjpTVkdUZXh0RWxlbWVudDo6YW5pbWF0ZWRMb2NhbFRyYW5z Zm9ybSk6IEFkZGVkIGEgY2hlY2sgZm9yIG51bGwgcmVuZGVyZXIsIGFuZCBkbyBub3QgY2hlY2sK KyAgICAgICAgZm9yIHN0eWxlIHRyYW5zZm9ybSBpZiB0aGVyZSBpcyBubyByZW5kZXJlci4KKwog MjAxMi0wMy0yNyAgVGltb3RoeSBIYXRjaGVyICA8dGltb3RoeUBhcHBsZS5jb20+CiAKICAgICAg ICAgTWFrZSBXZWJLaXQgcHJvcGVybHkgbG9hZCBhIHN0YWdlZCBmcmFtZXdvcmsgd2hlbiBzb2Z0 IGxpbmtpbmcuCkluZGV4OiBTb3VyY2UvV2ViQ29yZS9zdmcvU1ZHVGV4dEVsZW1lbnQuY3BwCj09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT0KLS0tIFNvdXJjZS9XZWJDb3JlL3N2Zy9TVkdUZXh0RWxlbWVudC5jcHAJKHJldmlz aW9uIDExMjI3NikKKysrIFNvdXJjZS9XZWJDb3JlL3N2Zy9TVkdUZXh0RWxlbWVudC5jcHAJKHdv cmtpbmcgY29weSkKQEAgLTExMCwxMCArMTEwLDEwIEBAIEFmZmluZVRyYW5zZm9ybSBTVkdUZXh0 RWxlbWVudDo6Z2V0U2NyZWUKIEFmZmluZVRyYW5zZm9ybSBTVkdUZXh0RWxlbWVudDo6YW5pbWF0 ZWRMb2NhbFRyYW5zZm9ybSgpIGNvbnN0CiB7CiAgICAgQWZmaW5lVHJhbnNmb3JtIG1hdHJpeDsK LSAgICBSZW5kZXJTdHlsZSogc3R5bGUgPSByZW5kZXJlcigpLT5zdHlsZSgpOworICAgIFJlbmRl clN0eWxlKiBzdHlsZSA9IHJlbmRlcmVyKCkgPyByZW5kZXJlcigpLT5zdHlsZSgpIDogMDsKIAog ICAgIC8vIGlmIENTUyBwcm9wZXJ0eSB3YXMgc2V0LCB1c2UgdGhhdCwgb3RoZXJ3aXNlIGZhbGxi YWNrIHRvIGF0dHJpYnV0ZSAoaWYgc2V0KQotICAgIGlmIChzdHlsZS0+aGFzVHJhbnNmb3JtKCkp IHsKKyAgICBpZiAoc3R5bGUgJiYgc3R5bGUtPmhhc1RyYW5zZm9ybSgpKSB7CiAgICAgICAgIFRy YW5zZm9ybWF0aW9uTWF0cml4IHQ7CiAgICAgICAgIC8vIEZvciBub3csIHRoZSB0cmFuc2Zvcm0t b3JpZ2luIGlzIG5vdCB0YWtlbiBpbnRvIGFjY291bnQKICAgICAgICAgLy8gQWxzbywgYW55IHBl cmNlbnRhZ2UgdmFsdWVzIHdpbGwgbm90IGJlIHRha2VuIGludG8gYWNjb3VudApJbmRleDogTGF5 b3V0VGVzdHMvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIExheW91dFRlc3RzL0NoYW5nZUxvZwko cmV2aXNpb24gMTEyMzEyKQorKysgTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCSh3b3JraW5nIGNvcHkp CkBAIC0xLDMgKzEsMTMgQEAKKzIwMTItMDMtMjcgIFN0ZXBoZW4gQ2hlbm5leSAgPHNjaGVubmV5 QGNocm9taXVtLm9yZz4KKworICAgICAgICBOdWxsIGRlcmVmZXJlbmNlIGluIFNWR1RleHRFbGVt ZW50OjphbmltYXRlZExvY2FsVHJhbnNmb3JtKCkKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtp dC5vcmcvc2hvd19idWcuY2dpP2lkPTgyMzc1CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZ IChPT1BTISkuCisKKyAgICAgICAgKiBzdmcvY3VzdG9tL2dldC10ZXh0LWVsZW1lbnQtdHJhbnNm b3JtLWNyYXNoLWV4cGVjdGVkLnR4dDogQWRkZWQuCisgICAgICAgICogc3ZnL2N1c3RvbS9nZXQt dGV4dC1lbGVtZW50LXRyYW5zZm9ybS1jcmFzaC5odG1sOiBBZGRlZC4KKwogMjAxMi0wMy0yNyAg RGlyayBQcmFua2UgIDxkcHJhbmtlQGNocm9taXVtLm9yZz4KIAogICAgICAgICBNYXJrIG1lZGlh L3RyYWNrL3RyYWNrLWRlbGV0ZS1kdXJpbmctc3RhcnR1cCBhcyBjcmFzaGluZyBpbiBkZWJ1Zy4K SW5kZXg6IExheW91dFRlc3RzL3N2Zy9jdXN0b20vZ2V0LXRleHQtZWxlbWVudC10cmFuc2Zvcm0t Y3Jhc2gtZXhwZWN0ZWQudHh0Cj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIExheW91dFRlc3RzL3N2Zy9jdXN0b20v Z2V0LXRleHQtZWxlbWVudC10cmFuc2Zvcm0tY3Jhc2gtZXhwZWN0ZWQudHh0CShyZXZpc2lvbiAw KQorKysgTGF5b3V0VGVzdHMvc3ZnL2N1c3RvbS9nZXQtdGV4dC1lbGVtZW50LXRyYW5zZm9ybS1j cmFzaC1leHBlY3RlZC50eHQJKHJldmlzaW9uIDApCkBAIC0wLDAgKzEgQEAKK1BBU1MKSW5kZXg6 IExheW91dFRlc3RzL3N2Zy9jdXN0b20vZ2V0LXRleHQtZWxlbWVudC10cmFuc2Zvcm0tY3Jhc2gu aHRtbAo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09Ci0tLSBMYXlvdXRUZXN0cy9zdmcvY3VzdG9tL2dldC10ZXh0LWVsZW1l bnQtdHJhbnNmb3JtLWNyYXNoLmh0bWwJKHJldmlzaW9uIDApCisrKyBMYXlvdXRUZXN0cy9zdmcv Y3VzdG9tL2dldC10ZXh0LWVsZW1lbnQtdHJhbnNmb3JtLWNyYXNoLmh0bWwJKHJldmlzaW9uIDAp CkBAIC0wLDAgKzEsMjMgQEAKKzxodG1sPgorICA8aGVhZD4KKyAgICA8c2NyaXB0IHR5cGU9ImFw cGxpY2F0aW9uL2phdmFzY3JpcHQiPgorICAgICAgZnVuY3Rpb24gdGVzdCgpIHsKKyAgICAgICAg ZG9jdW1lbnQuZ2V0RWxlbWVudEJ5SWQoImNyYXNoIikuZ2V0VHJhbnNmb3JtVG9FbGVtZW50KCk7 CisgICAgICB9CisKKyAgICAgIGlmICh3aW5kb3cubGF5b3V0VGVzdENvbnRyb2xsZXIpIHsKKyAg ICAgICAgbGF5b3V0VGVzdENvbnRyb2xsZXIuZHVtcEFzVGV4dCgpOworICAgICAgfQorCisgICAg PC9zY3JpcHQ+CisgIDwvaGVhZD4KKyAgPGJvZHk+CisgICAgPHN2ZyB4bWxucz0iaHR0cDovL3d3 dy53My5vcmcvMjAwMC9zdmciIHZlcnNpb249IjEuMSIgb25sb2FkPSJ0ZXN0KCkiPgorICAgICAg PGFuaW1hdGVUcmFuc2Zvcm0gPgorICAgICAgICA8dGV4dCBpZD0iY3Jhc2giPgorICAgICAgICA8 L3RleHQ+CisgICAgICA8L2FuaW1hdGVUcmFuc2Zvcm0+CisgICAgPC9zdmc+CisgICAgUEFTUwor ICA8L2JvZHk+Cis8L2h0bWw+Cg==