Bug 22804 – Crash (null-deref) when using :before pseudoselector with content CSS rule in SVG

• Status: RESOLVED
• Resolution: FIXED
• Component: SVG

[Oliver Hunt]

CSS generated content results in a RenderObject with no element, causing SVG text layout and painting to crash and burn

<rdar://problem/6302405>

[Oliver Hunt]

Created attachment 25941 [details]
Patch o' doom

Fixeration

[Adele Peterson]

Comment on attachment 25941 [details]
Patch o' doom

R=me.  I assume the CL entries for Info.plist and the Xcode proj don't belong...

[Oliver Hunt]

(In reply to comment #2)
> (From update of attachment 25941 [details] [review])
> R=me.  I assume the CL entries for Info.plist and the Xcode proj don't
> belong...
> 

Yup *sigh*

Also, have better text in the test now -- says something akin to "This test ensures that we don't display css content or crash when css generated content is used"

[Oliver Hunt]

Committing to http://svn.webkit.org/repository/webkit/trunk ...
	M	LayoutTests/ChangeLog
	A	LayoutTests/svg/css/crash-css-generated-content-expected.txt
	A	LayoutTests/svg/css/crash-css-generated-content.xhtml
	M	WebCore/ChangeLog
	M	WebCore/rendering/SVGRootInlineBox.cpp
Committed r39218