[Webkit-unassigned] [Bug 13611] Crash in setAttributeNS setting href of SVG <use> to nonexistent symbol

[bugzilla-daemon at webkit.org]

http://bugs.webkit.org/show_bug.cgi?id=13611





------- Comment #5 from macdome at opendarwin.org  2007-05-31 13:52 PDT -------
A slightly more complete brute-force fix:

Index: ksvg2/svg/SVGUseElement.cpp
===================================================================
--- ksvg2/svg/SVGUseElement.cpp (revision 21912)
+++ ksvg2/svg/SVGUseElement.cpp (working copy)
@@ -142,10 +142,15 @@
     if (!attached())
        return;

-    // Only update the tree if x/y/width/height or xlink:href changed.
-    if (attr->name() == SVGNames::xAttr || attr->name() == SVGNames::yAttr ||
-        attr->name() == SVGNames::widthAttr || attr->name() ==
SVGNames::heightAttr ||
-        attr->name().matches(XLinkNames::hrefAttr))
+    if (attr->name().matches(XLinkNames::hrefAttr)) {
+        // if the target changed recreate the entire rendering sub-tree
+        detach();
+        m_targetElementInstance = 0;
+        m_shadowTreeRootElement = 0;
+        attach();
+    } else if (attr->name() == SVGNames::xAttr || attr->name() ==
SVGNames::yAttr ||
+        attr->name() == SVGNames::widthAttr || attr->name() ==
SVGNames::heightAttr)
+        // otherwise only update the tree if x/y/width/height changed.
         buildPendingResource();
     else if (m_shadowTreeRootElement)
         m_shadowTreeRootElement->setChanged();


-- 
Configure bugmail: http://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.