Summary: | hang due to infinitely growing points array because parsePoints loop is broken | ||||||
---|---|---|---|---|---|---|---|
Product: | WebKit | Reporter: | Eric Seidel (no email) <eric> | ||||
Component: | SVG | Assignee: | Nobody <webkit-unassigned> | ||||
Status: | RESOLVED FIXED | ||||||
Severity: | Normal | CC: | joost, pnormand | ||||
Priority: | P1 | Keywords: | HasReduction, SVGHitList | ||||
Version: | 420+ | ||||||
Hardware: | Mac | ||||||
OS: | OS X 10.4 | ||||||
URL: | http://www.treebuilder.de/default.asp?file=606899.xml | ||||||
Bug Depends on: | 6890 | ||||||
Bug Blocks: | |||||||
Attachments: |
|
Description
Eric Seidel (no email)
2006-01-30 18:10:24 PST
Created attachment 6249 [details]
testcase
This testcase still hangs WebKit. The var "d" is initialized without a value, and then used to set an attribute, if the var "d" is given a value, the testcase no longer hangs Safari.
Might be nice to have a reduction that didn't involve SVG. The hang doesn't seem to have anything to do with the unintiailized JS variable. It's inside SVG path parsing. The reason for the hang is that SVGPolyParser::parsePoints ends up calling parseMappedAttribute over and over again, because each time it calls svgPolyTo it then appends a new item to the points which triggers the attribute mapping machinery again over and over again, so it just keeps making the points array longer and longer forever. i've already got a fix for this one, actually its not due to notifications, its just because parsePoints never steps forward through the empty string, it just infinite loops over nothing Alex landed a fix for this. |