[webkit-reviews] review requested: [Bug 26117] REGRESSION (r37381-r37442) : Reproducible crash viewing an SVG : [Attachment 39980] Modified test case

[bugzilla-daemon at webkit.org]

Robin Qiu <robin.qiu at torchmobile.com.cn> has asked  for review:
Bug 26117: REGRESSION (r37381-r37442) : Reproducible crash viewing an SVG
https://bugs.webkit.org/show_bug.cgi?id=26117

Attachment 39980: Modified test case
https://bugs.webkit.org/attachment.cgi?id=39980&action=review

------- Additional Comments from Robin Qiu <robin.qiu at torchmobile.com.cn>
Eric, I updated the patch. the animation is not necessary, we only need a child
for <use>, so, an empty <set> is OK.

In this new test case:
<1> If move mouse on it, it will crash.
<2> If dump the instance tree, it will show an unwanted <cycle> element (last
line):
The instance tree of use element zoomplus:

     id = loupePlus  this = [object SVGElementInstance]  correspondingElement =
[object SVGGElement]
	  id = useRim  this = [object SVGElementInstance]  correspondingElement
= [object SVGUseElement]
	       id = rim  this = [object SVGElementInstance] 
correspondingElement = [object SVGCircleElement]
	       id = rim  this = [object SVGElementInstance] 
correspondingElement = [object SVGCircleElement]  //this one is unwanted.

Which way do you think is better?