[Webkit-unassigned] [Bug 47759] Crash while processing ill-formed <textPath> ouside of <text>

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=47759


Cosmin Truta <ctruta at chromium.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
  Attachment #74958|0                           |1
        is obsolete|                            |
  Attachment #75109|                            |review?
               Flag|                            |




--- Comment #9 from Cosmin Truta <ctruta at chromium.org>  2010-11-29 23:13:29 PST ---
Created an attachment (id=75109)
 --> (https://bugs.webkit.org/attachment.cgi?id=75109&action=review)
Fix and layout test

Actually, <text> inside <a> inside <textPath> shouldn't work either, because the spec says "The ‘a’ element may contain any element that its parent may contain, except itself", and <textPath> cannot contain <text>.

In my interpretation of the content model, <textPath> cannot be inside another <textPath> in any way. That line from text-linking.svg must be removed. However, since I don't have the means to regenerate the expected image output of text-linking.svg, I will open a separate bug 50211. This will be committed after that one gets committed.

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.