Bug 21293 - REGRESSION: Crash beneath RenderSVGViewportContainer::viewportTransform() during SVGSVGElement destruction
Summary: REGRESSION: Crash beneath RenderSVGViewportContainer::viewportTransform() dur...
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: SVG (show other bugs)
Version: 528+ (Nightly build)
Hardware: Mac OS X 10.5
: P1 Normal
Assignee: Nobody
URL:
Keywords: LayoutTestFailure, Regression
Depends on:
Blocks:
 
Reported: 2008-10-01 21:41 PDT by mitz
Modified: 2008-10-01 21:57 PDT (History)
0 users

See Also:


Attachments
Step around the problem by calling detach() earlier (2.46 KB, patch)
2008-10-01 21:48 PDT, mitz
mrowe: review+
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description mitz 2008-10-01 21:41:48 PDT
svg/custom/use-modify-target-symbol.svg crashes beneath RenderSVGViewportContainer::viewportTransform() due to calling an SVGSVGElement method on a half-destructed object.
Comment 1 mitz 2008-10-01 21:48:57 PDT
Created attachment 24005 [details]
Step around the problem by calling detach() earlier
Comment 2 mitz 2008-10-01 21:54:18 PDT
Fixed in <http://trac.webkit.org/changeset/37180>.