[Webkit-unassigned] [Bug 108184] ASSERT(time.isFinite()) in SVGSMILElement::createInstanceTimesFromSyncbase

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=108184


Philip Rogers <pdr at google.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|RESOLVED                    |REOPENED
         Resolution|FIXED                       |




--- Comment #16 from Philip Rogers <pdr at google.com>  2014-01-21 13:59:27 PST ---
(In reply to comment #15)
> All reviewed patches have been landed.  Closing bug.

I'm very sorry but I made a mistake when reviewing this. We should have landed a test that crashes before this patch and does not crash after this patch. I created this testcase when merging this patch to Chrome and it's available at: https://codereview.chromium.org/144333002

(LayoutTests/svg/animations/self-dependency-crash.html and LayoutTests/svg/animations/self-dependency-crash-expected.html).

Would you be willing to land this test in another patch? If not, I'd be happy to do it for you.

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.