Bug 13140

Summary: Crash after loading SVG fragment with XMLHttpRequest (Yosemite Map Geology Layer)
Product: WebKit Reporter: Andreas Neumann <a.neumann>
Component: SVGAssignee: Alexey Proskuryakov <ap>
Status: RESOLVED FIXED    
Severity: Normal CC: mitz
Priority: P1    
Version: 523.x (Safari 3)   
Hardware: Mac   
OS: OS X 10.4   
URL: http://www.carto.net/neumann/webkitsvgbugs/yosemite_geology_dynamic_loading.svg
Attachments:
Description Flags
crashlog for yosemite geology loading
none
proposed fix
none
proposed fix
none
proposed fix mitz: review+

Description Andreas Neumann 2007-03-21 06:19:40 PDT
If you load this SVG file and click on the text (geology layer) an XMLHttpRequest() is generated and a SVG fragment added to the DOM. During or after loading Webkit crashes. I don't know if this bug is SVG related, DOM related or an XML parser problem. It somehow has to do with the content that is loaded, because it crashes on the geology layer, but not on other layers, like hydrology.

A crashlog will be attached.
Comment 1 Andreas Neumann 2007-03-21 06:24:28 PDT
Created attachment 13734 [details]
crashlog for yosemite geology loading
Comment 2 David Kilzer (:ddkilzer) 2007-03-21 08:55:33 PDT
P1 crashers need a Radar, too! :)

Comment 3 Alexey Proskuryakov 2007-03-21 11:59:15 PDT
Created attachment 13743 [details]
proposed fix

I still don't really understand why xhr.responseXML has to create a full SVG (or XHTML) DOM, but ok...
Comment 4 Alexey Proskuryakov 2007-03-21 12:00:23 PDT
Created attachment 13744 [details]
proposed fix

Forgot to include chagnelogs.
Comment 5 Alexey Proskuryakov 2007-03-21 12:07:25 PDT
Created attachment 13745 [details]
proposed fix

So, I didn't even notice reportWarning next to reportError :(

Thanks, Mitz!
Comment 6 mitz 2007-03-21 12:11:37 PDT
Comment on attachment 13745 [details]
proposed fix

r=me

I think according to the style guidelines the outer ifs should have braces.
Comment 7 Alexey Proskuryakov 2007-03-21 12:25:30 PDT
Committed revision 20363.

I do not know if it's correct for d="" to emit an error message, but the crasher is fixed now.