Bug 85202 - WebCore::SVGAnimateMotionElement::applyResultsToTarget crash
: WebCore::SVGAnimateMotionElement::applyResultsToTarget crash
Status: RESOLVED FIXED
: WebKit
SVG
: 528+ (Nightly build)
: Unspecified Unspecified
: P2 Normal
Assigned To:
:
:
:
:
  Show dependency treegraph
 
Reported: 2012-04-30 09:22 PST by
Modified: 2012-05-01 09:10 PST (History)


Attachments
Repro case (222 bytes, image/svg+xml)
2012-04-30 09:22 PST, Philip Rogers
no flags Details
Skip building instance tree for disallowed target (7.13 KB, patch)
2012-04-30 10:28 PST, Philip Rogers
no flags Review Patch | Details | Formatted Diff | Diff


Note

You need to log in before you can comment on or make changes to this bug.


Description From 2012-04-30 09:22:04 PST
Created an attachment (id=139461) [details]
Repro case

As the title says, we can crash in WebCore::SVGAnimateMotionElement::applyResultsToTarget. See the attached svg file for a repro.

Original bug: crbug.com/124575
------- Comment #1 From 2012-04-30 10:28:36 PST -------
Created an attachment (id=139471) [details]
Skip building instance tree for disallowed target

My first foray into the shadow tree :)
------- Comment #2 From 2012-05-01 07:41:41 PST -------
(From update of attachment 139471 [details])
Ah great, r=me.
------- Comment #3 From 2012-05-01 09:09:54 PST -------
(From update of attachment 139471 [details])
Clearing flags on attachment: 139471

Committed r115730: <http://trac.webkit.org/changeset/115730>
------- Comment #4 From 2012-05-01 09:10:08 PST -------
All reviewed patches have been landed.  Closing bug.