[Webkit-unassigned] [Bug 26117] REGRESSION (r37381-r37442) : Reproducible crash viewing an SVG

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=26117


Robin Qiu <robin.qiu at torchmobile.com.cn> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
  Attachment #39980|                            |review?
               Flag|                            |
  Attachment #39906|0                           |1
        is obsolete|                            |
  Attachment #39906|review?                     |
               Flag|                            |




--- Comment #15 from Robin Qiu <robin.qiu at torchmobile.com.cn>  2009-09-23 01:18:02 PDT ---
Created an attachment (id=39980)
 --> (https://bugs.webkit.org/attachment.cgi?id=39980)
Modified test case

Eric, I updated the patch. the animation is not necessary, we only need a child
for <use>, so, an empty <set> is OK.

In this new test case:
<1> If move mouse on it, it will crash.
<2> If dump the instance tree, it will show an unwanted <cycle> element (last
line):
The instance tree of use element zoomplus:

     id = loupePlus  this = [object SVGElementInstance]  correspondingElement =
[object SVGGElement]
          id = useRim  this = [object SVGElementInstance]  correspondingElement
= [object SVGUseElement]
               id = rim  this = [object SVGElementInstance] 
correspondingElement = [object SVGCircleElement]
               id = rim  this = [object SVGElementInstance] 
correspondingElement = [object SVGCircleElement]  //this one is unwanted.

Which way do you think is better?

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.