[Webkit-unassigned] [Bug 108485] New: Assertion faulire in SVGAnimatedType::valueAsString()
bugzilla-daemon at webkit.org
bugzilla-daemon at webkit.org
Thu Jan 31 07:47:59 PST 2013
https://bugs.webkit.org/show_bug.cgi?id=108485
Summary: Assertion faulire in SVGAnimatedType::valueAsString()
Product: WebKit
Version: 528+ (Nightly build)
Platform: Unspecified
OS/Version: Unspecified
Status: NEW
Severity: Normal
Priority: P2
Component: SVG
AssignedTo: webkit-unassigned at lists.webkit.org
ReportedBy: reni at webkit.org
CC: zimmermann at kde.org, zherczeg at webkit.org,
pdr at google.com, schenney at chromium.org,
fmalita at chromium.org
During SVG fuzzing I've got the following ASSERT_NOT_REACHED assertion faulire:
Program received signal SIGSEGV, Segmentation fault.
0x00007ffff59d0f6a in WebCore::SVGAnimatedType::valueAsString (this=0xa69ff0) at /home/reni/repos/webkit2/Source/WebCore/svg/SVGAnimatedType.cpp:268
268 ASSERT_NOT_REACHED();
Test:
<svg xmlns="http://www.w3.org/2000/svg">
<circle>
<animateTransform attributeName="transform" attributeType="CSS"></animateTransform>
</circle>
</svg>
The problem is that the type of the SVGAnimatedType object is AnimatedTransformList what doesn't need valueAsString() support theoretically.
--
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
More information about the webkit-unassigned
mailing list