[Webkit-unassigned] [Bug 90820] New: [Regression] Infinite loop in document.elementFromPoint

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=90820

           Summary: [Regression] Infinite loop in
                    document.elementFromPoint
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: Unspecified
        OS/Version: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: SVG
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: pdr at google.com
                CC: zimmermann at kde.org, shinyak at chromium.org


Created an attachment (id=151315)
 --> (https://bugs.webkit.org/attachment.cgi?id=151315&action=review)
Testcase

In writing a perf test (https://bugs.webkit.org/show_bug.cgi?id=90811) I found a bug where we infinite loop when calling document.elementFromPoint on a <use>'d element in SVG. In the attached testcase you should see:
About to call document.elementFromPoint(100,100)... 3... 2... 1... Done!

But you actually see:
About to call document.elementFromPoint(100,100)... 3... 2... 1...
and the browser hangs.

A quick look through trac hints at a regression from r118319 but that's just a guess.

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.