[Webkit-unassigned] [Bug 20400] Infinite recursion crash in WebCore::RenderSVGRoot::absoluteClippedOverflowRect on a <stop> element outside of a gradient block

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=20400


eric at webkit.org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
  Attachment #24545|                            |review?
               Flag|                            |




------- Comment #5 from eric at webkit.org  2008-10-21 14:23 PDT -------
Created an attachment (id=24545)
 --> (https://bugs.webkit.org/attachment.cgi?id=24545&action=view)
Fix the crash

 LayoutTests/ChangeLog                          |   10 ++++++++++
 LayoutTests/svg/custom/stop-crash-expected.txt |    1 +
 LayoutTests/svg/custom/stop-crash.svg          |    8 ++++++++
 WebCore/ChangeLog                              |   13 +++++++++++++
 WebCore/rendering/RenderSVGGradientStop.h      |   10 ++++++++--
 5 files changed, 40 insertions(+), 2 deletions(-)


-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.