[Webkit-unassigned] [Bug 25092] New: Crash in SVGUseElement::associateInstancesWithShadowTreeElements

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=25092

           Summary: Crash in
                    SVGUseElement::associateInstancesWithShadowTreeElements
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: Macintosh
        OS/Version: Mac OS X 10.5
            Status: NEW
          Severity: Normal
          Priority: P1
         Component: SVG
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: eric at webkit.org
OtherBugsDependingO 23586
             nThis:


Crash in SVGUseElement::associateInstancesWithShadowTreeElements

Discovered this while trying to make a test case for bug 23586.  See attached
test case.

The crash is under:
0   com.apple.WebCore                   0x034e62e1 WebCore::Node::nextSibling()
const + 9
1   com.apple.WebCore                   0x03cecd91
WebCore::SVGUseElement::associateInstancesWithShadowTreeElements(WebCore::Node*,
WebCore::SVGElementInstance*) + 891 (SVGUseElement.cpp:825)
2   com.apple.WebCore                   0x03cf0480
WebCore::SVGUseElement::buildPendingResource() + 1500 (SVGUseElement.cpp:398)
3   com.apple.WebCore                   0x03cec5d9
WebCore::SVGUseElement::insertedIntoDocument() + 37 (SVGUseElement.cpp:115)


-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.