The testcase shows a bug in isOutermostSVG(), which cause a crash.
Created attachment 29351 [details] Testcase
Maybe fix: diff --git a/WebCore/svg/SVGSVGElement.cpp b/WebCore/svg/SVGSVGElement.cpp index e66a16e..fe09148 100644 --- a/WebCore/svg/SVGSVGElement.cpp +++ b/WebCore/svg/SVGSVGElement.cpp @@ -477,6 +477,10 @@ bool SVGSVGElement::hasRelativeValues() const bool SVGSVGElement::isOutermostSVG() const { + // Element may not be in the document. + if (!parentNode()) + return false; + // This is true whenever this is the outermost SVG, even if there are HTML elements outside it return !parentNode()->isSVGElement(); }
Your fix looks good.
Fixing. Will post shortly.
I think we should return true instead of false. Will post patch later today.
Created attachment 29378 [details] First stab @ fix LayoutTests/ChangeLog | 10 ++++++++++ .../detached-outermost-svg-crash-expected.txt | 1 + .../svg/custom/detached-outermost-svg-crash.html | 13 +++++++++++++ WebCore/ChangeLog | 10 ++++++++++ WebCore/svg/SVGSVGElement.cpp | 4 ++++ 5 files changed, 38 insertions(+), 0 deletions(-)
Committing to http://svn.webkit.org/repository/webkit/trunk ... M LayoutTests/ChangeLog A LayoutTests/svg/custom/detached-outermost-svg-crash-expected.txt A LayoutTests/svg/custom/detached-outermost-svg-crash.html M WebCore/ChangeLog M WebCore/svg/SVGSVGElement.cpp Committed r42374