| Summary: | WebCore::SVGAnimateMotionElement::applyResultsToTarget crash | ||||||||
|---|---|---|---|---|---|---|---|---|---|
| Product: | WebKit | Reporter: | Philip Rogers <pdr> | ||||||
| Component: | SVG | Assignee: | Nobody <webkit-unassigned> | ||||||
| Status: | RESOLVED FIXED | ||||||||
| Severity: | Normal | CC: | webkit.review.bot, zimmermann | ||||||
| Priority: | P2 | ||||||||
| Version: | 528+ (Nightly build) | ||||||||
| Hardware: | Unspecified | ||||||||
| OS: | Unspecified | ||||||||
| Attachments: |
|
||||||||
Created attachment 139471 [details]
Skip building instance tree for disallowed target
My first foray into the shadow tree :)
Comment on attachment 139471 [details]
Skip building instance tree for disallowed target
Ah great, r=me.
Comment on attachment 139471 [details] Skip building instance tree for disallowed target Clearing flags on attachment: 139471 Committed r115730: <http://trac.webkit.org/changeset/115730> All reviewed patches have been landed. Closing bug. |
Created attachment 139461 [details] Repro case As the title says, we can crash in WebCore::SVGAnimateMotionElement::applyResultsToTarget. See the attached svg file for a repro. Original bug: crbug.com/124575