REGRESSION: SVG demo crashes Safari 4 (does not crash Safari 3.x) http://codinginparadise.org/projects/svgweb/samples/demo.html Exception Type: EXC_BAD_ACCESS (SIGBUS) Exception Codes: KERN_PROTECTION_FAILURE at 0x0000000000000288 Crashed Thread: 0 Thread 0 Crashed: 0 com.apple.WebCore 0x93739238 WebCore::CSSStyleSelector::initElementAndPseudoState(WebCore::Element*) + 24 1 com.apple.WebCore 0x9373890b WebCore::CSSStyleSelector::styleForElement(WebCore::Element*, WebCore::RenderStyle*, bool, bool) + 75 2 com.apple.WebCore 0x937388ae WebCore::Node::styleForRenderer() + 126 3 com.apple.WebCore 0x93c2c8ec WebCore::SVGClipPathElement::canvasResource() + 124 4 com.apple.WebCore 0x93a36bda WebCore::SVGStyledElement::invalidateResourcesInAncestorChain() const + 58 5 com.apple.WebCore 0x93a36adb WebCore::SVGStyledElement::svgAttributeChanged(WebCore::QualifiedName const&) + 75 6 com.apple.WebCore 0x93a38151 WebCore::SVGRectElement::svgAttributeChanged(WebCore::QualifiedName const&) + 33 7 com.apple.WebCore 0x937952a7 WebCore::NamedNodeMap::addAttribute(WTF::PassRefPtr<WebCore::Attribute>) + 119 8 com.apple.WebCore 0x938b57bd WebCore::Element::setAttribute(WebCore::AtomicString const&, WebCore::AtomicString const&, int&) + 589 9 com.apple.WebCore 0x938b53bd WebCore::JSElement::setAttribute(JSC::ExecState*, JSC::ArgList const&) + 301 10 com.apple.WebCore 0x938b5263 WebCore::jsElementPrototypeFunctionSetAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, JSC::ArgList const&) + 115 11 ??? 0x00ff620f 0 + 16736783 12 com.apple.JavaScriptCore 0x916f25dc JSC::Interpreter::execute(JSC::FunctionBodyNode*, JSC::ExecState*, JSC::JSFunction*, JSC::JSObject*, JSC::ArgList const&, JSC::ScopeChainNode*, JSC::JSValue*) + 524 13 com.apple.JavaScriptCore 0x91601115 JSC::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 149 14 com.apple.WebCore 0x9381a27a WebCore::JSEventListener::handleEvent(WebCore::Event*, bool) + 2074 15 com.apple.WebCore 0x938c398d WebCore::XMLHttpRequest::dispatchReadyStateChangeEvent() + 141 16 com.apple.WebCore 0x938c38ce WebCore::XMLHttpRequest::callReadyStateChangeListener() + 30 17 com.apple.WebCore 0x938e9167 WebCore::XMLHttpRequest::didFinishLoading(unsigned long) + 455 18 com.apple.WebCore 0x937c98fd WebCore::SubresourceLoader::didFinishLoading() + 45 19 com.apple.Foundation 0x90ee34a7 -[NSURLConnection(NSURLConnectionReallyInternal) sendDidFinishLoading] + 87 Full crash log attached.
Created attachment 31335 [details] full crash log Note, I have click 2 flash installed (which could be causing this, but I doubt it).
Note that only the URL http://codinginparadise.org/projects/svgweb/samples/demo.html crashes, not when you pass it query parameters.
Should be trivial to catch in the debugger. Obviously some "this" is ending up NULL.
This might be related to an issue on the SVG Web side (the toolkit used in the SVG demo): http://code.google.com/p/sgweb/issues/detail?id=106 In that demo I'm actually using Flash to do the rendering rather than the native SVG support in Safari. I internally use the JavaScript XML Parser class to build up an internal representation of the SVG file that I use for tracking, and then send over a string version of it to Flash to do the actual rendering. However, I noticed a surprising thing recently: even though the SVG is parsed by XML, all of the XML nodes become specific Safari SVGElement nodes rather than generic XML DOM nodes. This causes some trouble for me; I have an open issue on my side to create a workaround internally to prevent this from happening.
If you remove the namespace before sending it off to WebKit WebKit will make plain old Element nodes instead of SVG elements. :)
(In reply to comment #5) > If you remove the namespace before sending it off to WebKit WebKit will make > plain old Element nodes instead of SVG elements. :) r51397 on 10.6.2 has no issues...
Doesn't crash for me either with a local debug build of r58908.