[Webkit-unassigned] [Bug 47498] New: Crash while processing ill-formed SVG with cycles.

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=47498

           Summary: Crash while processing ill-formed SVG with cycles.
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: All
        OS/Version: All
            Status: UNCONFIRMED
          Severity: Normal
          Priority: P2
         Component: SVG
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: ctruta at chromium.org
                CC: zimmermann at kde.org, mdelaney at apple.com


This is the Chromium issue 55521
http://code.google.com/p/chromium/issues/detail?id=55521

The SVG cycle solver crashes when processing input like the following:

<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
<filter id="crash">
<textPath fill="url(#crash)"></textPath>
</filter>
</svg>

This happens inside SVGResourcesCycleSolver::breakCycle, where the resourceType() is FilterResourceType, but the resource leading to cycle is in fact m_resources->fill(), not m_resources->filter().
The same crash occurs when replacing fill= with stroke=. In this case, the resource leading to cycle is m_resources->stroke() instead of m_resources->filter().

Here is a stack trace:
***
ASSERTION FAILED: resourceLeadingToCycle == m_resources->filter()
(third_party/WebKit/WebCore/rendering/SVGResourcesCycleSolver.cpp:197 void WebCore::SVGResourcesCycleSolver::breakCycle(WebCore::RenderSVGResourceContainer*))
        WebCore::SVGResourcesCycleSolver::breakCycle() [0x146ca67]
        WebCore::SVGResourcesCycleSolver::resolveCycles() [0x146c69c]
        WebCore::SVGResourcesCache::addResourcesFromRenderObject() [0x1468a82]
        WebCore::SVGResourcesCache::clientUpdatedFromElement() [0x146900d]
        WebCore::RenderSVGInline::updateFromElement() [0x1516536]
        WebCore::SVGStyledElement::attach() [0x14cad16]
        WebCore::XMLDocumentParser::startElementNs() [0xfb274c]
        WebCore::startElementNsHandler() [0xfb37fb]
        ...


WebKit also crashes upon encountering other attributes (like clip= and mask=), but that happens in an entirely different place, inside SVGRenderSupport::layoutChildren. Here is a stack trace:
***
SHOULD NEVER BE REACHED
(third_party/WebKit/WebCore/rendering/RenderInline.h:104 virtual void WebCore::RenderInline::layout())
        WebCore::RenderInline::layout() [0x123e51c]
        WebCore::SVGRenderSupport::layoutChildren() [0x145b4ed]
        WebCore::RenderSVGHiddenContainer::layout() [0x151725d]
        WebCore::RenderSVGResourceContainer::layout() [0x14e92fe]
        WebCore::SVGRenderSupport::layoutChildren() [0x145b4ed]
        WebCore::RenderSVGRoot::layout() [0x14f828f]
        WebCore::RenderBlock::layoutBlockChild() [0x11d30bd]
        WebCore::RenderBlock::layoutBlockChildren() [0x11d2c44]
        WebCore::RenderBlock::layoutBlock() [0x11d03ab]
        WebCore::RenderBlock::layout() [0x11cfcc2]
        WebCore::RenderView::layout() [0x12c7cf5]
        WebCore::FrameView::layout() [0x115e381]
        WebCore::Document::implicitClose() [0xf19084]
        WebCore::FrameLoader::checkCallImplicitClose() [0x10def33]
        WebCore::FrameLoader::checkCompleted() [0x10ded06]
        WebCore::FrameLoader::finishedParsing() [0x10dea75]
        WebCore::Document::finishedParsing() [0xf21520]
        WebCore::XMLDocumentParser::end() [0xfae37f]
        WebCore::XMLDocumentParser::finish() [0xfae3b8]
        WebCore::Document::finishParsing() [0xf194ee]
        WebCore::DocumentWriter::endIfNotLoadingMainResource() [0x10d943d]
        WebCore::DocumentWriter::end() [0x10d9393]
        WebCore::DocumentLoader::finishedLoading() [0x10cf397]
        WebCore::FrameLoader::finishedLoading() [0x10e5281]
        WebCore::MainResourceLoader::didFinishLoading() [0x10f62cb]
        WebCore::ResourceLoader::didFinishLoading() [0x1101b57]
        WebCore::ResourceHandleInternal::didFinishLoading() [0x19ccd8c]

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.