Bug 21293

Summary: REGRESSION: Crash beneath RenderSVGViewportContainer::viewportTransform() during SVGSVGElement destruction
Product: WebKit Reporter: mitz
Component: SVGAssignee: Nobody <webkit-unassigned>
Status: RESOLVED FIXED    
Severity: Normal Keywords: LayoutTestFailure, Regression
Priority: P1    
Version: 528+ (Nightly build)   
Hardware: Mac   
OS: OS X 10.5   
Attachments:
Description Flags
Step around the problem by calling detach() earlier mrowe: review+

mitz
Reported 2008-10-01 21:41:48 PDT
svg/custom/use-modify-target-symbol.svg crashes beneath RenderSVGViewportContainer::viewportTransform() due to calling an SVGSVGElement method on a half-destructed object.
Attachments
Step around the problem by calling detach() earlier (2.46 KB, patch)
2008-10-01 21:48 PDT, mitz 		mrowe: review+
DetailsFormatted DiffDiff
View All Add attachment proposed patch, testcase, etc.
mitz
Comment 1 2008-10-01 21:48:57 PDT
Created attachment 24005 [details] Step around the problem by calling detach() earlier
mitz
Comment 2 2008-10-01 21:54:18 PDT
Fixed in <http://trac.webkit.org/changeset/37180>.
Note You need to log in before you can comment on or make changes to this bug.