Crash in SVGUseElement::associateInstancesWithShadowTreeElements Discovered this while trying to make a test case for bug 23586. See attached test case. The crash is under: 0 com.apple.WebCore 0x034e62e1 WebCore::Node::nextSibling() const + 9 1 com.apple.WebCore 0x03cecd91 WebCore::SVGUseElement::associateInstancesWithShadowTreeElements(WebCore::Node*, WebCore::SVGElementInstance*) + 891 (SVGUseElement.cpp:825) 2 com.apple.WebCore 0x03cf0480 WebCore::SVGUseElement::buildPendingResource() + 1500 (SVGUseElement.cpp:398) 3 com.apple.WebCore 0x03cec5d9 WebCore::SVGUseElement::insertedIntoDocument() + 37 (SVGUseElement.cpp:115)
Created attachment 29332 [details] stack trace of crash
Created attachment 29333 [details] stack trace of crash
Created attachment 29334 [details] test case (crashes Safari)
Created attachment 30980 [details] Fix ASSERT seen in shadow tree testing 5 files changed, 49 insertions(+), 1 deletions(-)
Landed in @r44540.