Summary: | WebCore::SVGAnimateMotionElement::applyResultsToTarget crash | ||||||||
---|---|---|---|---|---|---|---|---|---|
Product: | WebKit | Reporter: | Philip Rogers <pdr> | ||||||
Component: | SVG | Assignee: | Nobody <webkit-unassigned> | ||||||
Status: | RESOLVED FIXED | ||||||||
Severity: | Normal | CC: | webkit.review.bot, zimmermann | ||||||
Priority: | P2 | ||||||||
Version: | 528+ (Nightly build) | ||||||||
Hardware: | Unspecified | ||||||||
OS: | Unspecified | ||||||||
Attachments: |
|
Created attachment 139471 [details]
Skip building instance tree for disallowed target
My first foray into the shadow tree :)
Comment on attachment 139471 [details]
Skip building instance tree for disallowed target
Ah great, r=me.
Comment on attachment 139471 [details] Skip building instance tree for disallowed target Clearing flags on attachment: 139471 Committed r115730: <http://trac.webkit.org/changeset/115730> All reviewed patches have been landed. Closing bug. |
Created attachment 139461 [details] Repro case As the title says, we can crash in WebCore::SVGAnimateMotionElement::applyResultsToTarget. See the attached svg file for a repro. Original bug: crbug.com/124575