Some SVG content uses GraphicsContext::clipToImageBuffer to define a clipping from the contents of an ImageBuffer. But GraphicsContextImpl doesn't have an implementation for this method so the call cannot be delegated and recorded. Instead, cairo GraphicsContext tries to perform cairo operations while in the recording state which causes the crash.
Created attachment 343315 [details] Patch
Comment on attachment 343315 [details] Patch Attachment 343315 [details] did not pass mac-ews (mac): Output: https://webkit-queues.webkit.org/results/8288431 New failing tests: performance-api/performance-observer-no-document-leak.html
Created attachment 343317 [details] Archive of layout-test-results from ews100 for mac-sierra The attached test failures were seen while running run-webkit-tests on the mac-ews. Bot: ews100 Port: mac-sierra Platform: Mac OS X 10.12.6
Created attachment 343318 [details] Patch
Comment on attachment 343318 [details] Patch Attachment 343318 [details] did not pass mac-debug-ews (mac): Output: https://webkit-queues.webkit.org/results/8289544 New failing tests: performance-api/performance-observer-no-document-leak.html
Created attachment 343323 [details] Archive of layout-test-results from ews114 for mac-sierra The attached test failures were seen while running run-webkit-tests on the mac-debug-ews. Bot: ews114 Port: mac-sierra Platform: Mac OS X 10.12.6
Comment on attachment 343318 [details] Patch Clearing flags on attachment: 343318 Committed r233078: <https://trac.webkit.org/changeset/233078>
All reviewed patches have been landed. Closing bug.