Bug 6951

Summary: hang due to infinitely growing points array because parsePoints loop is broken
Product: WebKit Reporter: Eric Seidel (no email) <eric>
Component: SVGAssignee: Nobody <webkit-unassigned>
Status: RESOLVED FIXED    
Severity: Normal CC: joost, pnormand
Priority: P1 Keywords: HasReduction, SVGHitList
Version: 420+   
Hardware: Mac   
OS: OS X 10.4   
URL: http://www.treebuilder.de/default.asp?file=606899.xml
Bug Depends on: 6890    
Bug Blocks:    
Attachments:
Description Flags
testcase none

Description Eric Seidel (no email) 2006-01-30 18:10:24 PST
"Brown" SVG hangs safari

Crash/Data Loss, SVGHitList, p2.

http://www.treebuilder.de/default.asp?file=606899.xml
Comment 1 Joost de Valk (AlthA) 2006-02-04 10:25:53 PST
Created attachment 6249 [details]
testcase

This testcase still hangs WebKit. The var "d" is initialized without a value, and then used to set an attribute, if the var "d" is given a value, the testcase no longer hangs Safari.
Comment 2 Darin Adler 2006-02-11 10:49:46 PST
Might be nice to have a reduction that didn't involve SVG.
Comment 3 Darin Adler 2006-02-12 21:40:51 PST
The hang doesn't seem to have anything to do with the unintiailized JS variable. It's inside SVG path parsing.
Comment 4 Darin Adler 2006-02-12 21:52:50 PST
The reason for the hang is that SVGPolyParser::parsePoints ends up calling parseMappedAttribute over and over again, because each time it calls svgPolyTo it then appends a new item to the points which triggers the attribute mapping machinery again over and over again, so it just keeps making the points array longer and longer forever.
Comment 5 Alexander Kellett 2006-02-13 02:40:30 PST
i've already got a fix for this one, actually its not due to notifications, its just because parsePoints never steps forward through the empty string, it just infinite loops over nothing
Comment 6 Darin Adler 2006-03-06 15:08:47 PST
Alex landed a fix for this.
Comment 7 Martin Robinson 2011-11-11 08:29:15 PST
*** Bug 71454 has been marked as a duplicate of this bug. ***