Bug 20550

Summary: SVGUseElement.setAttribute crashes Safari
Product: WebKit Reporter: Tuom Larsen <tuom.larsen>
Component: SVGAssignee: Nobody <webkit-unassigned>
Status: RESOLVED DUPLICATE    
Severity: Critical CC: mrowe
Priority: P1 Keywords: HasReduction, InRadar
Version: 528+ (Nightly build)   
Hardware: PC   
OS: Windows XP   
Attachments:
Description Flags
test case none

Description Tuom Larsen 2008-08-27 13:40:15 PDT 
Define a "symbol" with transform attribute and "use" instance of that symbol with some "fill".
Change fill of "use", then change transform of "symbol". This crashes Safari 3.1 and latest 4 beta here.
Comment 1 Mark Rowe (bdash) 2008-08-27 13:54:16 PDT 
Can you please attach an SVG file that demonstrates the problem?
Comment 2 Tuom Larsen 2008-08-27 15:55:01 PDT 
@#$%^!! It took me three hours to isolate it...
Anyway, please, look at the attachment and double click inside that circle.
Comment 3 Tuom Larsen 2008-08-27 15:56:34 PDT 
Created attachment 23043 [details]
test case
Comment 4 Mark Rowe (bdash) 2008-08-27 15:58:30 PDT 
<rdar://problem/6181015>
Comment 5 Mark Rowe (bdash) 2008-08-27 15:58:50 PDT 
Thanks for taking the time to make a reduction!
Comment 6 Tuom Larsen 2008-08-27 16:11:56 PDT 
No problem.
And please, is it crashing for you or is it just here?
Comment 7 Mark Rowe (bdash) 2008-08-27 16:19:51 PDT 
Yes, it crashes for me on Mac OS X.
Comment 8 Nikolas Zimmermann 2008-09-21 18:54:07 PDT 
I've got a fix, uploading in the next days.
Comment 9 Eric Seidel (no email) 2008-10-02 12:49:16 PDT 
I guess the fix was forgotten?
Comment 10 Eric Seidel (no email) 2008-10-07 16:23:28 PDT 
This no longer seems to crash with tip of tree, so I'm assuming this is fixed.

Please verify using a nightly build:
http://nightly.webkit.org
Comment 11 Tuom Larsen 2008-10-08 08:48:00 PDT 
(In reply to comment #10)
> This no longer seems to crash with tip of tree, so I'm assuming this is fixed.
> 
> Please verify using a nightly build:
> http://nightly.webkit.org
> 

r37382 on Win still crashes. May I reopen the bug?
Comment 12 Nikolas Zimmermann 2008-10-08 19:59:40 PDT 

*** This bug has been marked as a duplicate of 15413 ***