Created attachment 46907 [details] Reproducible test case Crash on dispatching SVG mouse events Steps to reproduce: 1. Open attached svg_crash.svg. 2. Move the mouse over the blinking black rectangle. See http://crbug.com/32269 (in particular comment 8). This first appeared as chromium-specific bug, but then it turned out to be reproducible in Safari.
I verified it crashes even after http://trac.webkit.org/changeset/53446
Thanks, the testcase is evil :-) We need to add: if (!m_targetElementInstance) return 0; to SVGUseElement::instanceForShadowTreeElement. Can you try wheter that fixes it, my tree is jammed atm :-)
Created attachment 47087 [details] Initial patch As discussed on IRC, there is no way to test using DRT at the moment - that particular code in EventHandler leading to crashes is not reachable when moving mouse using DRT. Adding the original testcase as manual-test.
Landed in r53589.