[webkit-reviews] review denied: [Bug 44610] Malformed SVG causes crash in updateContainerOffset : [Attachment 77978] Revised patch version 3

[bugzilla-daemon at webkit.org]

Dirk Schulze <krit at webkit.org> has denied Leo Yang
<leo.yang at torchmobile.com.cn>'s request for review:
Bug 44610: Malformed SVG causes crash in updateContainerOffset
https://bugs.webkit.org/show_bug.cgi?id=44610

Attachment 77978: Revised patch version 3
https://bugs.webkit.org/attachment.cgi?id=77978&action=review

------- Additional Comments from Dirk Schulze <krit at webkit.org>
View in context: https://bugs.webkit.org/attachment.cgi?id=77978&action=review

just a snippet

> WebCore/svg/SVGUseElement.cpp:726
> -	   handleDeepUseReferencing(static_cast<SVGUseElement*>(target),
targetInstance, foundProblem);
> +    if (targetHasUseTag && newTarget) {
> +	   RefPtr<SVGElementInstance> newInstance =
SVGElementInstance::create(this, newTarget);
> +	   SVGElementInstance* newInstancePtr = newInstance.get();
> +	   targetInstance->appendChild(newInstance.release());
> +	   buildInstanceTree(newTarget, newInstancePtr, foundProblem);
> +    }

should be
if (!targetHasUseTag || !newTarget)
    return;