-
commit-queue@webkit.org authored
Reviewed by Dirk Schulze. Malformed SVG causes crash in updateContainerOffset https://bugs.webkit.org/show_bug.cgi?id=44610 Test case for recursive svg <use>. This test case passes if no crash occurs. * svg/custom/recursive-use-expected.txt: Added. * svg/custom/recursive-use.svg: Added. 2011-01-05 Leo Yang <leo.yang@torchmobile.com.cn> Reviewed by Dirk Schulze. Malformed SVG causes crash in updateContainerOffset https://bugs.webkit.org/show_bug.cgi?id=44610 We should check recursive <use> at the begining of WebCore::SVGUseElement::buildInstanceTree instead of at the end of it because the target element's children may cause infinite recursive <use>. Test: svg/custom/recursive-use.svg * svg/SVGUseElement.cpp: (WebCore::SVGUseElement::buildInstanceTree): (WebCore::SVGUseElement::hasCycleUseReferencing): * svg/SVGUseElement.h: git-svn-id: http://svn.webkit.org/repository/webkit/trunk@75059 268f45cc-cd09-0410-ab3c-d52691b4dbfc
0f5d54e5