| Summary: | SVG path.getPresentationAttribute("") -> NULL ptr | ||||||
|---|---|---|---|---|---|---|---|
| Product: | WebKit | Reporter: | Berend-Jan Wever <skylined> | ||||
| Component: | SVG | Assignee: | Nobody <webkit-unassigned> | ||||
| Status: | RESOLVED FIXED | ||||||
| Severity: | Normal | CC: | eric, skylined | ||||
| Priority: | P1 | Keywords: | GoogleBug | ||||
| Version: | 528+ (Nightly build) | ||||||
| Hardware: | PC | ||||||
| OS: | Windows Vista | ||||||
| URL: | http://skypher.com/SkyLined/Repro/WebKit/Bug%2025553%20-%20SVG%20path.getPresentationAttribute(%22%22)%20NULL%20ptr/repro.html | ||||||
| Attachments: |
|
||||||
Added repro url. Renaming to "SVG" Created attachment 30021 [details]
Fix mappedAttributes() access without NULL check
6 files changed, 41 insertions(+), 0 deletions(-)
Comment on attachment 30021 [details]
Fix mappedAttributes() access without NULL check
r=me
Thank you very much for the bug and excellent test case! Committing to http://svn.webkit.org/repository/webkit/trunk ... M LayoutTests/ChangeLog A LayoutTests/svg/custom/path-getPresentationAttribute-crash-expected.txt A LayoutTests/svg/custom/path-getPresentationAttribute-crash.html M WebCore/ChangeLog M WebCore/html/HTMLInputElement.cpp M WebCore/svg/SVGStyledElement.cpp Committed r43237 |
Bug found in latest Chrome 1.x release without symbols, so I have no stack dump or anything. It repro's reliably in latest Chrome 2.x ToT. Repro <SCRIPT> path = window.document.createElementNS("http://www.w3.org/2000/svg", "path"); path.getPresentationAttribute(""); </SCRIPT>