[Webkit-unassigned] [Bug 100491] New: Crash on loading SVG filter resource on HTML element

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=100491

           Summary: Crash on loading SVG filter resource on HTML element
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: Unspecified
        OS/Version: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: CSS
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: krit at webkit.org
                CC: pdr at google.com, schenney at chromium.org,
                    fmalita at chromium.org


Created an attachment (id=170873)
 --> (https://bugs.webkit.org/attachment.cgi?id=170873&action=review)
SVG Filter example

Did not investigate further. Just noticed that Chromium and nightly are constantly crashing. This is the backlog:

ASSERTION FAILED: filter->renderer()->isSVGResourceContainer()
/Users/dschulze/Downloads/git-webkit/Source/WebCore/rendering/RenderLayerFilterInfo.cpp(144) : void WebCore::RenderLayerFilterInfo::updateReferenceFilterClients(const WebCore::FilterOperations &)
1   0x107553da6 WebCore::RenderLayerFilterInfo::updateReferenceFilterClients(WebCore::FilterOperations const&)
2   0x10752be7e WebCore::RenderLayer::updateOrRemoveFilterEffect()
3   0x10752dc39 WebCore::RenderLayer::styleChanged(WebCore::StyleDifference, WebCore::RenderStyle const*)
4   0x1074a5360 WebCore::RenderBoxModelObject::styleDidChange(WebCore::StyleDifference, WebCore::RenderStyle const*)
5   0x107484036 WebCore::RenderBox::styleDidChange(WebCore::StyleDifference, WebCore::RenderStyle const*)
6   0x10740cf23 WebCore::RenderBlock::styleDidChange(WebCore::StyleDifference, WebCore::RenderStyle const*)
7   0x1075945e1 WebCore::RenderObject::setStyle(WTF::PassRefPtr<WebCore::RenderStyle>)
8   0x107593cea WebCore::RenderObject::setAnimatableStyle(WTF::PassRefPtr<WebCore::RenderStyle>)
9   0x10734d768 WebCore::NodeRendererFactory::createRenderer()
10  0x10734da2e WebCore::NodeRendererFactory::createRendererIfNeeded()
11  0x107335c45 WebCore::Node::createRendererIfNeeded()
12  0x106827d60 WebCore::Element::attach()
13  0x106a1e5ac WebCore::executeTask(WebCore::HTMLConstructionSiteTask&)
14  0x106a1e436 WebCore::HTMLConstructionSite::executeQueuedTasks()
15  0x106af8a59 WebCore::HTMLTreeBuilder::constructTreeFromAtomicToken(WebCore::AtomicHTMLToken*)
16  0x106af884a WebCore::HTMLTreeBuilder::constructTreeFromToken(WebCore::HTMLToken&)
17  0x106a3c75a WebCore::HTMLDocumentParser::pumpTokenizer(WebCore::HTMLDocumentParser::SynchronousMode)
18  0x106a3c1f0 WebCore::HTMLDocumentParser::pumpTokenizerIfPossible(WebCore::HTMLDocumentParser::SynchronousMode)
19  0x106a3d0bf WebCore::HTMLDocumentParser::append(WebCore::SegmentedString const&)
20  0x1065e4a54 WebCore::DecodedDataDocumentParser::flush(WebCore::DocumentWriter*)
21  0x10669385c WebCore::DocumentWriter::end()
22  0x106671abf WebCore::DocumentLoader::finishedLoading()
23  0x107295d9d WebCore::MainResourceLoader::didFinishLoading(double)
24  0x1076d5005 WebCore::ResourceLoader::didFinishLoading(WebCore::ResourceHandle*, double)
25  0x1076d1c1a -[WebCoreResourceHandleAsDelegate connectionDidFinishLoading:]
26  0x7fff83b08f58 __65-[NSURLConnectionInternal _withConnectionAndDelegate:onlyActive:]_block_invoke_0
27  0x7fff83b08e9c -[NSURLConnectionInternal _withConnectionAndDelegate:onlyActive:]
28  0x7fff83b08d98 -[NSURLConnectionInternal _withActiveConnectionAndDelegate:]
29  0x7fff8482cf01 ___delegate_didFinishLoading_block_invoke_0
30  0x7fff8481f3ca ___withDelegateAsync_block_invoke_0
31  0x7fff848af56a __block_global_1

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.