RESOLVED CONFIGURATION CHANGED 110265
ASSERTION FAILED: m_role != PathSegUndefinedRole in SVGPathSegWithContext::commitChange() 
https://bugs.webkit.org/show_bug.cgi?id=110265
Summary ASSERTION FAILED: m_role != PathSegUndefinedRole in SVGPathSegWithContext::co...
Florin Malita
Reported 2013-02-19 15:02:00 PST
Created attachment 189170 [details] Crashes on debug builds. Setting attributes on SVGPathSegs that are not inserted into an SVGPathSegList triggers this assert: ASSERTION FAILED: m_role != PathSegUndefinedRole ../../third_party/WebKit/Source/WebCore/svg/SVGPathSegWithContext.h(68) : void WebCore::SVGPathSegWithContext::commitChange() Received signal 11 SEGV_MAPERR 0000bbadbeef [0x7fd283ff0a9e] base::debug::StackTrace::StackTrace() [0x7fd283ff05d5] base::debug::(anonymous namespace)::StackDumpSignalHandler() [0x7fd279408cb0] <unknown> [0x7fd2812f7981] WebCore::SVGPathSegWithContext::commitChange() [0x7fd28136c9d4] WebCore::SVGPathSegCurvetoCubic::setX() [0x7fd2813265cf] WebCore::SVGPathSegCurvetoCubicAbsV8Internal::xAttrSetter() [0x7fd28577441b] v8::internal::JSObject::SetPropertyWithCallback() [0x7fd285777cbc] v8::internal::JSObject::SetPropertyForResult() [0x7fd285772a02] v8::internal::JSReceiver::SetProperty() [0x7fd285773cb8] v8::internal::JSReceiver::SetProperty() [0x7fd2856e2609] v8::internal::StoreIC::Store() [0x7fd2856e5005] v8::internal::StoreIC_Miss() [0x28b0133062ee] <unknown>
Attachments
Crashes on debug builds. (274 bytes, text/html)
2013-02-19 15:02 PST, Florin Malita 		no flags
Details
View All Add attachment proposed patch, testcase, etc.
Florin Malita
Comment 1 2013-02-19 15:42:15 PST
(found by ClusterFuzz: https://code.google.com/p/chromium/issues/detail?id=176738)
Brent Fulgham
Comment 2 2022-07-15 16:04:42 PDT
This code has been significantly refactored since this patch was proposed. There doesn't seem to be any action we can take here.
Note You need to log in before you can comment on or make changes to this bug.