[Webkit-unassigned] [Bug 47759] Crash while processing ill-formed <textPath> ouside of <text>

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=47759


Cosmin Truta <ctruta at chromium.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
  Attachment #74958|                            |review?, commit-queue?
               Flag|                            |




--- Comment #2 from Cosmin Truta <ctruta at chromium.org>  2010-11-26 23:15:47 PST ---
Created an attachment (id=74958)
 --> (https://bugs.webkit.org/attachment.cgi?id=74958&action=review)
Fix and layout test

There is one thing that isn't exactly done as stated in the content model spec:
SVGTextPathElement::childShouldCreateRenderer allows <textPath> inside <textPath>. (SVGTextPathElement::rendererIsNeeded is fine, however.)
This is to accommodate <textPath><a><textpath>Text</textPath></a></textPath>, which is tested in svg/custom/text-linking.svg

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.