Bug 36730

Summary: Crash on SVG Test of new W3C test-suite.
Product: WebKit Reporter: Dirk Schulze <krit>
Component: SVGAssignee: Nobody <webkit-unassigned>
Status: RESOLVED WORKSFORME    
Severity: Normal CC: robin.qiu, rwlbuis, zimmermann
Priority: P2    
Version: 528+ (Nightly build)   
Hardware: PC   
OS: OS X 10.5   
URL: http://dev.w3.org/SVG/profiles/1.1F2/test/harness/htmlObject/text-tref-02-b.html
Attachments:
Description Flags
backtrace none

Dirk Schulze
Reported 2010-03-28 13:10:21 PDT
WebKit crashes with SEGFAULT on WebCore::RenderLineBoxList::appendLineBox(WebCore::InlineFlowBox*) () after visiting the site above. Will add a detailed bt later.
Attachments
backtrace (4.67 KB, application/octet-stream)
2010-03-29 12:35 PDT, Dirk Schulze 		no flags
Details
View All Add attachment proposed patch, testcase, etc.
Dirk Schulze
Comment 1 2010-03-29 12:35:05 PDT
Created attachment 51947 [details] backtrace
Dirk Schulze
Comment 2 2010-03-29 12:53:06 PDT
Reduced the test case: <svg xmlns="http://www.w3.org/2000/svg"> <defs> <foreignObject> <svg> <text>Hello</text> </svg> </foreignObject> </defs> </svg> The text element breaks the SVG. This doesn't happen for <rect..
Dirk Schulze
Comment 3 2010-03-29 12:57:05 PDT
(In reply to comment #2) > Reduced the test case: > > <svg xmlns="http://www.w3.org/2000/svg"> > <defs> > <foreignObject> > <svg> > <text>Hello</text> > </svg> > </foreignObject> > </defs> > </svg> > > The text element breaks the SVG. This doesn't happen for <rect.. It even breaks without the <defs>-element. <svg xmlns="http://www.w3.org/2000/svg"> <foreignObject> <svg> <text>Hello</text> </svg> </foreignObject> </svg>
Nikolas Zimmermann
Comment 4 2010-03-30 01:56:59 PDT
That problem is long-outstanding. SVG text demands a SVGRootInlineBox, which is not present in that foreignObject sub-tree IIRC, would need to dive into text again to be check that.
Rob Buis
Comment 5 2011-05-05 10:39:20 PDT
I think this works nowadays? Cheers, Rob.
Dirk Schulze
Comment 6 2011-05-05 10:40:37 PDT
yes, I couldn't see this crash either.
Note You need to log in before you can comment on or make changes to this bug.