[Webkit-unassigned] [Bug 23586] crash on SVGUseElement::expandSymbolElementsInShadowTree(

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=23586


darin at apple.com changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
  Attachment #27107|review?                     |review-
               Flag|                            |




------- Comment #3 from darin at apple.com  2009-01-28 09:00 PDT -------
(From update of attachment 27107)
> diff --git a/WebCore/svg/SVGUseElement.cpp b/WebCore/svg/SVGUseElement.cpp
> index 83ad559..b5beae9 100644
> --- a/WebCore/svg/SVGUseElement.cpp
> +++ b/WebCore/svg/SVGUseElement.cpp
> @@ -719,8 +719,9 @@ void SVGUseElement::expandSymbolElementsInShadowTree(Node* element)
>              removeDisallowedElementsFromSubtree(svgElement.get());
>  
>          // Replace <symbol> with <svg>.
> -        ASSERT(element->parentNode()); 
> -        element->parentNode()->replaceChild(svgElement.release(), element, ec);
> +        // ASSERT(element->parentNode());
> +        if (element->parentNode())
> +            element->parentNode()->replaceChild(svgElement.release(), element, ec);
>          ASSERT(ec == 0);

Keep in mind that when the DOM, JavaScript, and mutation events are involved,
it's not possible to make any assumptions about things like this, so it's not a
huge surprise that sometimes the element might not have a parent here. Even if
you do find what's causing this in one particular case, we have to make sure
that our DOM manipulation code does not assume too much. If you make a call to
modify the DOM, by the time you return everything might have changed. All the
nodes might be in an entirely new configuration. And our code has to cope with
that without crashing.

The change seems fine, but you need a ChangeLog and a regression test for this,
so review-.


-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.