[Webkit-unassigned] [Bug 21121] CSSCursorImageValue uses free'd SVGCursorElement pointer

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=21121





------- Comment #1 from eric at webkit.org  2008-09-25 15:05 PDT -------
Created an attachment (id=23823)
 --> (https://bugs.webkit.org/attachment.cgi?id=23823&action=view)
crashing test case

I'm not sure this reduction is 100% right.  I haven't seen it crash every time,
but I've definitely seen it crash.  The layout tests under
svg/dynamic-tests/SVGCursor* crash in chromium every time.


-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.