[Webkit-unassigned] [Bug 77245] New: [Chromium] SVG Composite of Offset crashes

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=77245

           Summary: [Chromium] SVG Composite of Offset crashes
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: Unspecified
        OS/Version: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: SVG
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: schenney at chromium.org
                CC: zimmermann at kde.org, schenney at chromium.org


Created an attachment (id=124368)
 --> (https://bugs.webkit.org/attachment.cgi?id=124368&action=review)
Test case, suitable for LayoutTest

What steps will reproduce the problem?
1. Load the attached test case as a chromium LayoutTest
2. In current r106139, it crashes
3. In r105663 it produces incorrect results

What is the expected output? What do you see instead?
You should see a green rectangle and an offset of it, with the upper portion of the image empty. In r105663, you see that the offset rectangle has been incorrectly clipped, and the difference operation that should have removed the upper rectangles has left something behind, because it is subtracting the clipped lower rectangle.

This works in Firefox, and is disabled in Safari.

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.