The following SVG will likely be linked from a future w3c specification document: http://www.bjoernsworld.de/temp/eventflow2.svg It would be nice if WebKit didn't crash on it. It dies from an uncaught ObjC exception apparently: Exception: EXC_BAD_ACCESS (0x0001) Codes: KERN_INVALID_ADDRESS (0x0001) at 0xbbadbeef Thread 0 Crashed: 0 com.apple.WebCore 0x017a93da ReportBlockedObjCException(NSException*) + 76 (BlockExceptions.mm:35) 1 com.apple.WebCore 0x017ce3cc WebCore::KCanvasFEMergeQuartz::getCIFilter(WebCore::KCanvasFilterQuartz*) const + 202 (KCanvasFilterQuartz.mm:642) 2 com.apple.WebCore 0x017ccb1a WebCore::KCanvasFilterQuartz::getCIFilterStack(CIImage*) + 170 (KCanvasFilterQuartz.mm:145) 3 com.apple.WebCore 0x017ccc63 WebCore::KCanvasFilterQuartz::applyFilter(WebCore::FloatRect const&) + 211 (KCanvasFilterQuartz.mm:115) 4 com.apple.WebCore 0x017d077f WebCore::KCanvasContainerQuartz::paint(WebCore::RenderObject::PaintInfo&, int, int) + 2957 (KCanvasResourcesQuartz.mm:157) 5 com.apple.WebCore 0x018edd5a WebCore::RenderBox::paint(WebCore::RenderObject::PaintInfo&, int, int) + 92 (RenderBox.cpp:266) 6 com.apple.WebCore 0x017d0713 WebCore::KCanvasContainerQuartz::paint(WebCore::RenderObject::PaintInfo&, int, int) + 2849 (KCanvasResourcesQuartz.mm:154) 7 com.apple.WebCore 0x018edd5a WebCore::RenderBox::paint(WebCore::RenderObject::PaintInfo&, int, int) + 92 (RenderBox.cpp:266) 8 com.apple.WebCore 0x017d0713 WebCore::KCanvasContainerQuartz::paint(WebCore::RenderObject::PaintInfo&, int, int) + 2849 (KCanvasResourcesQuartz.mm:154) 9 com.apple.WebCore 0x018f529e WebCore::RenderCanvas::paint(WebCore::RenderObject::PaintInfo&, int, int) + 220 (RenderCanvas.cpp:161) 10 com.apple.WebCore 0x019146f4 WebCore::RenderLayer::paintLayer(WebCore::RenderLayer*, WebCore::GraphicsContext*, WebCore::IntRect const&, bool, bool, WebCore::RenderObject*) + 1284 (RenderLayer.cpp:1145) 11 com.apple.WebCore 0x01914891 WebCore::RenderLayer::paint(WebCore::GraphicsContext*, WebCore::IntRect const&, bool, WebCore::RenderObject*) + 67 (RenderLayer.cpp:1052) 12 com.apple.WebCore 0x0183ecee WebCore::Frame::paint(WebCore::GraphicsContext*, WebCore::IntRect const&) + 484 (Frame.cpp:2727) 13 com.apple.WebCore 0x01872f19 -[WebCoreFrameBridge drawRect:] + 183 (WebCoreFrameBridge.mm:924) 14 com.apple.WebKit 0x0035c279 -[WebHTMLView drawRect:] + 879 (WebHTMLView.m:2497) 15 com.apple.AppKit 0x933f1957 -[NSView _drawRect:clip:] + 3228 16 com.apple.AppKit 0x933efe39 -[NSView _recursiveDisplayRectIfNeededIgnoringOpacity:isVisibleRect:rectIsVisibleRectForView:topView:] + 1273 17 com.apple.WebKit 0x00353cbb -[WebHTMLView(WebPrivate) _recursiveDisplayRectIfNeededIgnoringOpacity:isVisibleRect:rectIsVisibleRectForView:topView:] + 351 (WebHTMLView.m:747) 18 com.apple.AppKit 0x933f05e7 -[NSView _recursiveDisplayRectIfNeededIgnoringOpacity:isVisibleRect:rectIsVisibleRectForView:topView:] + 3239 19 com.apple.AppKit 0x933f05e7 -[NSView _recursiveDisplayRectIfNeededIgnoringOpacity:isVisibleRect:rectIsVisibleRectForView:topView:] + 3239 20 com.apple.AppKit 0x933f05e7 -[NSView _recursiveDisplayRectIfNeededIgnoringOpacity:isVisibleRect:rectIsVisibleRectForView:topView:] + 3239 21 com.apple.AppKit 0x933f05e7 -[NSView _recursiveDisplayRectIfNeededIgnoringOpacity:isVisibleRect:rectIsVisibleRectForView:topView:] + 3239 22 com.apple.AppKit 0x933f05e7 -[NSView _recursiveDisplayRectIfNeededIgnoringOpacity:isVisibleRect:rectIsVisibleRectForView:topView:] + 3239 23 com.apple.AppKit 0x933f05e7 -[NSView _recursiveDisplayRectIfNeededIgnoringOpacity:isVisibleRect:rectIsVisibleRectForView:topView:] + 3239 24 com.apple.AppKit 0x933f05e7 -[NSView _recursiveDisplayRectIfNeededIgnoringOpacity:isVisibleRect:rectIsVisibleRectForView:topView:] + 3239 25 com.apple.AppKit 0x933ef120 -[NSThemeFrame _recursiveDisplayRectIfNeededIgnoringOpacity:isVisibleRect:rectIsVisibleRectForView:topView:] + 290 26 com.apple.AppKit 0x933ee90c -[NSView _displayRectIgnoringOpacity:isVisibleRect:rectIsVisibleRectForView:] + 523 27 com.apple.AppKit 0x933ee23c -[NSView displayIfNeeded] + 439 28 com.apple.AppKit 0x933edfde -[NSWindow displayIfNeeded] + 168 29 com.apple.Safari 0x0001bd9c 0x1000 + 109980 30 com.apple.AppKit 0x9343e28c _handleWindowNeedsDisplay + 206 31 com.apple.CoreFoundation 0x90823419 __CFRunLoopDoObservers + 342 32 com.apple.CoreFoundation 0x908224bb CFRunLoopRunSpecific + 827 33 com.apple.CoreFoundation 0x90822179 CFRunLoopRunInMode + 61 34 com.apple.HIToolbox 0x92ed28e0 RunCurrentEventLoopInMode + 285 35 com.apple.HIToolbox 0x92ed1fe7 ReceiveNextEventCommon + 385 36 com.apple.HIToolbox 0x92ed1e3e BlockUntilNextEventMatchingListInMode + 81 37 com.apple.AppKit 0x93372ad1 _DPSNextEvent + 576 38 com.apple.AppKit 0x933726be -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] + 137 39 com.apple.Safari 0x00006a3a 0x1000 + 23098 40 com.apple.AppKit 0x9336c443 -[NSApplication run] + 512 41 com.apple.AppKit 0x93360397 NSApplicationMain + 573 42 com.apple.Safari 0x0005ef22 0x1000 + 384802 43 com.apple.Safari 0x0005ee3d 0x1000 + 384573
Even though it's "just SVG", this is likely to be a high profile example of crashiness if we don't fix, so bumping to P1.
Created attachment 7354 [details] testcase for brokeness
My brief look into this makes me think that feMerge is not assigning the default image for a node in feMerge. This results in an image source name, name, of type DeprecatedString, DeprecatedName::getNSString() seems to produce something borken when the string is length 0 (gdb can't look at it certainly). Leading from this [m_imagesByName valueForKey:name.getNSString()] fails with an index out of bounds exception.
Maciej didn't appear to actually bump to P1, i am attempting to do so
I bet the problem is that DeprecatedString is a null string instead of an empty string.
(In reply to comment #5) > I bet the problem is that DeprecatedString is a null string instead of an empty > string. Turns out it's an empty string. But -[NSDictionary valueForKey:] has a bug where it will fail for the empty string. I filed a bug about this. Fix is to check for the empty string before calling valueForKey:.
(In reply to comment #3) > DeprecatedName::getNSString() seems to produce something borken when the string > is length 0 (gdb can't look at it certainly). No, that part is working fine. > Leading from this [m_imagesByName valueForKey:name.getNSString()] fails with an > index out of bounds exception. This is the immediate cause of the crash. It's a bug in NSDictionary's valueForKey:, which should not raise an exception in this case.
Using valueForKey: here is a mistake anyway. This should just be calling objectForKey:, which works fine with empty strings.
Created attachment 7374 [details] patch with detailed change log and a layout test