[Webkit-unassigned] [Bug 47498] Crash while processing ill-formed SVG with cycles.

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=47498





--- Comment #1 from Cosmin Truta <ctruta at chromium.org>  2010-10-12 12:37:37 PST ---
Below is the cycle solver's debug output, obtained from running the test case with DEBUG_CYCLE_DETECTION set to 1.

Before cycle detection:
-> this=0x7ffbb1d073f0, SVGResources(renderer=0x7ffbb1cd5f18, node=0x7ffbb1d1e1c0)
 | DOM Tree:
#document    0x7ffbc78a9400
    svg    0x7ffbb3bdb6c0
        #text    0x7ffbb3bf4ba0 "\n"
        filter    0x7ffbb1d23c00
            #text    0x7ffbb3bf4b40 "\n"
*            textPath    0x7ffbb1d1e1c0

 | List of resources:
 |-> Fill       : 0x7ffbb41333d8 (node=0x7ffbb1d23c00)

Detecting wheter any resources references any of following objects:
Local resources:
|> RenderSVGResourceFilter: object=0x7ffbb41333d8 (node=0x7ffbb1d23c00)
Parent resources:
|> RenderSVGResourceFilter: object=0x7ffbb41333d8 (node=0x7ffbb1d23c00)
ASSERTION FAILED: resourceLeadingToCycle == m_resources->filter()
(third_party/WebKit/WebCore/rendering/SVGResourcesCycleSolver.cpp:197 void WebCore::SVGResourcesCycleSolver::breakCycle(WebCore::RenderSVGResourceContainer*))
Segmentation fault

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.