Bug 25105 – isOutermostSVG() crashes with null deref

• Component: SVG
• Status: RESOLVED FIXED

[Simon Fraser (smfr)]

The testcase shows a bug in isOutermostSVG(), which cause a crash.

[Simon Fraser (smfr)]

Created attachment 29351 [details]
Testcase

[Simon Fraser (smfr)]

Maybe fix:
diff --git a/WebCore/svg/SVGSVGElement.cpp b/WebCore/svg/SVGSVGElement.cpp
index e66a16e..fe09148 100644
--- a/WebCore/svg/SVGSVGElement.cpp
+++ b/WebCore/svg/SVGSVGElement.cpp
@@ -477,6 +477,10 @@ bool SVGSVGElement::hasRelativeValues() const
 
 bool SVGSVGElement::isOutermostSVG() const
 {
+    // Element may not be in the document.
+    if (!parentNode())
+        return false;
+
     // This is true whenever this is the outermost SVG, even if there are HTML elements outside it
     return !parentNode()->isSVGElement();
 }

[Eric Seidel (no email)]

Your fix looks good.

[Eric Seidel (no email)]

Fixing.  Will post shortly.

[Eric Seidel (no email)]

I think we should return true instead of false.  Will post patch later today.

[Eric Seidel (no email)]

Created attachment 29378 [details]
First stab @ fix

 LayoutTests/ChangeLog                              |   10 ++++++++++
 .../detached-outermost-svg-crash-expected.txt      |    1 +
 .../svg/custom/detached-outermost-svg-crash.html   |   13 +++++++++++++
 WebCore/ChangeLog                                  |   10 ++++++++++
 WebCore/svg/SVGSVGElement.cpp                      |    4 ++++
 5 files changed, 38 insertions(+), 0 deletions(-)

[Eric Seidel (no email)]

Committing to http://svn.webkit.org/repository/webkit/trunk ...
	M	LayoutTests/ChangeLog
	A	LayoutTests/svg/custom/detached-outermost-svg-crash-expected.txt
	A	LayoutTests/svg/custom/detached-outermost-svg-crash.html
	M	WebCore/ChangeLog
	M	WebCore/svg/SVGSVGElement.cpp
Committed r42374