Bug 71287 – REGRESSION: SVG feColorMatrix causes crash

• Component: SVG
• Status: RESOLVED FIXED

[Philip Rogers]

Reproducible on WebKit nightly and Chrome 16.0.912dev

Visit the following page (linked from http://www.w3.org/Graphics/SVG/IG/resources/svgprimer.html):
http://srufaculty.sru.edu/david.dailey/svg/newstuff/filterColorMatrixSaturate.svg

You will get a sadtab in Chrome, and a error page in WebKit nightly.

[Alexey Proskuryakov]

ASSERTION FAILED: i < size()
/Users/ap/Safari/OpenSource/WebKitBuild/Debug/JavaScriptCore.framework/PrivateHeaders/Vector.h(537) : float &WTF::Vector<float, 0>::at(size_t)
1   0x109d782c8 WTF::Vector<float, 0ul>::at(unsigned long)
2   0x109d6454d WTF::Vector<float, 0ul>::operator[](unsigned long)
3   0x10adaa79d WebCore::SVGAnimatedNumberListAnimator::calculateAnimatedValue(float, unsigned int, WTF::OwnPtr<WebCore::SVGAnimatedType>&, WTF::OwnPtr<WebCore::SVGAnimatedType>&, WTF::OwnPtr<WebCore::SVGAnimatedType>&)
4   0x10adb2ee3 WebCore::SVGAnimateElement::calculateAnimatedValue(float, unsigned int, WebCore::SVGSMILElement*)
5   0x10adbd610 WebCore::SVGAnimationElement::updateAnimation(float, unsigned int, WebCore::SVGSMILElement*)
6   0x10ae98bae WebCore::SVGSMILElement::progress(WebCore::SMILTime, WebCore::SVGSMILElement*)
7   0x10ad41e28 WebCore::SMILTimeContainer::updateAnimations(WebCore::SMILTime, double, WTF::String const&)
8   0x10ad417b8 WebCore::SMILTimeContainer::begin()

[Alexey Proskuryakov]

<rdar://problem/10379164>

[Philip Rogers]

Created attachment 113801 [details]
Preliminary patch and test

[Philip Rogers]

Created attachment 113879 [details]
Fix REGRESSION: SVG feColorMatrix causes crash

[Tim Horton]

Comment on attachment 113879 [details]
Fix REGRESSION: SVG feColorMatrix causes crash

View in context: https://bugs.webkit.org/attachment.cgi?id=113879&action=review

> third_party/WebKit/Source/ThirdParty/ChangeLog:10
> [phone]  Philip Rogers  <[e-mail]>
> +
> +        fix REGRESSION: SVG feColorMatrix causes crash
> +        https://bugs.webkit.org/show_bug.cgi?id=71287
> +
> +        Reviewed by NOBODY (OOPS!).
> +
> +        * gtest/codegear/gtest_all.cc:
> +        * gtest/codegear/gtest_link.cc:
> +

I am assuming this was accidentally included?

> third_party/WebKit/LayoutTests/svg/filters/feColorMatrix-invalid-animation.svg:4
> +  <filter id="gopher">

It might be nice to have (in the <title> or in text on the page) an explanation of what it means to pass this test.

Also, "gopher" might not be an ideal name for the filter.

[Nikolas Zimmermann]

(In reply to comment #4)
> Created an attachment (id=113879) [details]
> Fix REGRESSION: SVG feColorMatrix causes crash

You have to generate your patch from a WebKit source tree, not a chromium one, otherwise it won't be testable by the EWS bots.

[Philip Rogers]

Created attachment 114111 [details]
fix REGRESSION: SVG feColorMatrix causes crash

This patch should now apply cleanly and I cleaned up the test (removed spurious id, added description).

[WebKit Review Bot]

Comment on attachment 114111 [details]
fix REGRESSION: SVG feColorMatrix causes crash

Clearing flags on attachment: 114111

Committed r99638: <http://trac.webkit.org/changeset/99638>

[WebKit Review Bot]

All reviewed patches have been landed.  Closing bug.