Created attachment 46907 [details]
Reproducible test case
Crash on dispatching SVG mouse events
Steps to reproduce:
1. Open attached svg_crash.svg.
2. Move the mouse over the blinking black rectangle.
See http://crbug.com/32269 (in particular comment 8). This first appeared as chromium-specific bug, but then it turned out to be reproducible in Safari.
I verified it crashes even after http://trac.webkit.org/changeset/53446
Thanks, the testcase is evil :-)
We need to add:
Can you try wheter that fixes it, my tree is jammed atm :-)
Created attachment 47087 [details]
As discussed on IRC, there is no way to test using DRT at the moment - that particular code in EventHandler leading to crashes is not reachable when moving mouse using DRT. Adding the original testcase as manual-test.
Landed in r53589.