See attached repro, which apparently infinitely loops then crashes in DRT. Chromium https://code.google.com/p/chromium/issues/detail?id=181447 #8 0x0000000001165c5f in WTF::HashMap<WebCore::SVGElement*, WTF::OwnPtr<WTF::HashSet<WebCore::SVGElement*, WTF::PtrHash<WebCore::SVGElement*>, WTF::HashTraits<WebCore::SVGElement*> > >, WTF::PtrHash<WebCore::SVGElement*>, WTF::HashTraits<WebCore::SVGElement*>, WTF::HashTraits<WTF::OwnPtr<WTF::HashSet<WebCore::SVGElement*, WTF::PtrHash<WebCore::SVGElement*>, WTF::HashTraits<WebCore::SVGElement*> > > > >::find (this= 0x10f36f18cc30, key=@0x7fffff7ff258: 0x10f36f23a8e0) at ../../third_party/WebKit/Source/WTF/wtf/HashMap.h:299 #9 0x00000000011640a8 in WebCore::SVGDocumentExtensions::setOfElementsReferencingTarget (this=0x10f36f18cb60, referencedElement= 0x10f36f23a8e0) at ../../third_party/WebKit/Source/WebCore/svg/SVGDocumentExtensions.cpp:300 #10 0x00000000011fc22a in WebCore::removeFromCacheAndInvalidateDependencies (object=0x10f36f006578, needsLayout=false) at ../../third_party/WebKit/Source/WebCore/rendering/svg/RenderSVGResource.cpp:183 #11 0x00000000011fbff8 in WebCore::RenderSVGResource::markForLayoutAndParentResourceInvalidation (object=0x10f36f006578, needsLayout=false) at ../../third_party/WebKit/Source/WebCore/rendering/svg/RenderSVGResource.cpp:202 #12 0x00000000011fc2d4 in WebCore::removeFromCacheAndInvalidateDependencies (object=0x10f36f341038, needsLayout=false) ---Type <return> to continue, or q <return> to quit--- at ../../third_party/WebKit/Source/WebCore/rendering/svg/RenderSVGResource.cpp:189 #13 0x00000000011fc024 in WebCore::RenderSVGResource::markForLayoutAndParentResourceInvalidation (object=0x10f36f006578, needsLayout=false) at ../../third_party/WebKit/Source/WebCore/rendering/svg/RenderSVGResource.cpp:207 #14 0x00000000011fc2d4 in WebCore::removeFromCacheAndInvalidateDependencies (object=0x10f36f341038, needsLayout=false) at ../../third_party/WebKit/Source/WebCore/rendering/svg/RenderSVGResource.cpp:189 #15 0x00000000011fc024 in WebCore::RenderSVGResource::markForLayoutAndParentResourceInvalidation (object=0x10f36f006578, needsLayout=false) at ../../third_party/WebKit/Source/WebCore/rendering/svg/RenderSVGResource.cpp:207 #16 0x00000000011fc2d4 in WebCore::removeFromCacheAndInvalidateDependencies (object=0x10f36f341038, needsLayout=false) at ../../third_party/WebKit/Source/WebCore/rendering/svg/RenderSVGResource.cpp:189 #17 0x00000000011fc024 in WebCore::RenderSVGResource::markForLayoutAndParentResourceInvalidation (object=0x10f36f006578, needsLayout=false) at ../../third_party/WebKit/Source/WebCore/rendering/svg/RenderSVGResource.cpp:207 #18 0x00000000011fc2d4 in WebCore::removeFromCacheAndInvalidateDependencies (object=0x10f36f341038, needsLayout=false) at ../../third_party/WebKit/Source/WebCore/rendering/svg/RenderSVGResource.cpp:189 #19 0x00000000011fc024 in WebCore::RenderSVGResource::markForLayoutAndParentResourceInvalidation (object=0x10f36f006578, needsLayout=false) at ../../third_party/WebKit/Source/WebCore/rendering/svg/RenderSVGResource.cpp:207 #20 0x00000000011fc2d4 in WebCore::removeFromCacheAndInvalidateDependencies (object=0x10f36f341038, needsLayout=false) at ../../third_party/WebKit/Source/WebCore/rendering/svg/RenderSVGResource.cpp:189 #21 0x00000000011fc024 in WebCore::RenderSVGResource::markForLayoutAndParentResourceInvalidation (object=0x10f36f006578, needsLayout=false) at ../../third_party/WebKit/Source/WebCore/rendering/svg/RenderSVGResource.cpp:207 #22 0x00000000011fc2d4 in WebCore::removeFromCacheAndInvalidateDependencies (object=0x10f36f341038, needsLayout=false) at ../../third_party/WebKit/Source/WebCore/rendering/svg/RenderSVGResource.cpp:189 #23 0x00000000011fc024 in WebCore::RenderSVGResource::markForLayoutAndParentResourceInvalidation (object=0x10f36f006578, needsLayout=false) at ../../third_party/WebKit/Source/WebCore/rendering/svg/RenderSVGResource.cpp:207
Created attachment 192589 [details] Layout test
Created attachment 192609 [details] Patch
I also checked the case of a textpath with a path parent that it was referencing, but the crash did not happen.
Comment on attachment 192609 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=192609&action=review R=me > LayoutTests/svg/text/textpath-referencing-text-crash-expected.txt:6 > + LF Something is up here, these lines don't usually appear.
Comment on attachment 192609 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=192609&action=review >> LayoutTests/svg/text/textpath-referencing-text-crash-expected.txt:6 >> + LF > > Something is up here, these lines don't usually appear. It's Chromium's svn properties file, I think, and safe to leave here.
Comment on attachment 192609 [details] Patch Clearing flags on attachment: 192609 Committed r146515: <http://trac.webkit.org/changeset/146515>
All reviewed patches have been landed. Closing bug.
*** Bug 104634 has been marked as a duplicate of this bug. ***