[Webkit-unassigned] [Bug 23586] crash on SVGUseElement::expandSymbolElementsInShadowTree(

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=23586





------- Comment #7 from eric at webkit.org  2009-04-07 06:56 PDT -------
Ok, I've created a test case which might cause this crash.  Right now it hits
another ASSERT first:
ASSERTION FAILED: instance->shadowTreeElement()
(/Users/eseidel/Projects/WebKit/WebCore/svg/SVGUseElement.cpp:838
WebCore::SVGElementInstance*
WebCore::SVGUseElement::instanceForShadowTreeElement(WebCore::Node*,
WebCore::SVGElementInstance*) const)

The testcase I've created is unlikely to be the root cause of this bug.  Since
again, invaders.svg used to work fine.  I'm not sure if they're doing something
which silently fails (but doesn't crash) in FF, or if we have some bug in our
<use> code which they're tripping with totally innocent SVG code.  By working
around this crash with an if, we might just be papering over some other bug. 
Then again, if we're able to repro this crash in other ways, then it needs to
be fixed with an null-check anyway. :)


-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.