Created attachment 139461 [details] Repro case As the title says, we can crash in WebCore::SVGAnimateMotionElement::applyResultsToTarget. See the attached svg file for a repro. Original bug: crbug.com/124575
Created attachment 139471 [details] Skip building instance tree for disallowed target My first foray into the shadow tree :)
Comment on attachment 139471 [details] Skip building instance tree for disallowed target Ah great, r=me.
Comment on attachment 139471 [details] Skip building instance tree for disallowed target Clearing flags on attachment: 139471 Committed r115730: <http://trac.webkit.org/changeset/115730>
All reviewed patches have been landed. Closing bug.