Bug 50749

Summary:

SVG nested tags recursions cause stack exhaustions

Product:

WebKit

Reporter:

Berend-Jan Wever <skylined>

Component:

SVG

Assignee:

Nobody <webkit-unassigned>

Status:

RESOLVED DUPLICATE

Severity:

Normal

CC:

christopher.reiss, eric, sabouhallawa, zimmermann

Priority:

Version:

528+ (Nightly build)

Hardware:

OS:

Windows Vista

URL:

http://code.google.com/p/chromium/issues/detail?id=66030

Attachments:

Description	Flags
Repro	none

Berend-Jan Wever

Reported 2010-12-09 04:46:42 PST

Created attachment 76047 [details] Repro I could not find an open bug for this issue, even though it has been around for a while. The following simple repro can be used to check for recursion issues in various tags: <body> <script> var asTags = ['a', 'altGlyph', 'altGlyphDef', 'altGlyphItem', 'animate', 'animateColor', 'animateMotion', 'animateTransform', 'circle', 'clipPath', 'color-profile', 'cursor', 'definition-src', 'defs', 'desc', 'ellipse', 'feBlend', 'feColorMatrix', 'feComponentTransfer', 'feComposite', 'feConvolveMatrix', 'feDiffuseLighting', 'feDisplacementMap', 'feDistantLight', 'feFlood', 'feFuncA', 'feFuncB', 'feFuncG', 'feFuncR', 'feGaussianBlur', 'feImage', 'feMerge', 'feMergeNode', 'feMorphology', 'feOffset', 'fePointLight', 'feSpecularLighting', 'feSpotLight', 'feTile', 'feTurbulence', 'filter', 'font', 'font-face', 'font-face-format', 'font-face-name', 'font-face-src', 'font-face-uri', 'foreignObject', 'g', 'glyph', 'glyphRef', 'hkern', 'image', 'line', 'linearGradient', 'marker', 'mask', 'metadata', 'missing-glyph', 'mpath', 'path', 'pattern', 'polygon', 'polyline', 'radialGradient', 'rect', 'script', 'set', 'stop', 'style', 'svg', 'switch', 'symbol', 'text', 'textPath', 'title', 'tref', 'tspan', 'use', 'view', 'vkern']; setInterval(function() { if (confirm('Would you like to test "' + asTags[0] + '"...?')) { document.open(); document.write('<svg xmlns="http://www.w3.org/2000/svg">' + new Array(20000).join('<' + asTags[0] + '>')); document.close(); } asTags.shift(); }, 1); </script> Here's a list of the crashes I've seen so far: chrome.dll!WebCore::ContainerNode::willRemove RecursionSOV (d2c46b73f6877654a2020cfd44fc561d) chrome.dll!WebCore::RenderSVGHiddenContainer::layout+1 RecursionSOV (28afd91631a23d8ec42d3e81959a0578) My fuzzers also found this one but I cannot reproduce it manually: chrome.dll!WebCore::RenderSVGModelObject::computeRectForRepaint+1 RecursionSOV (d6b83f31f12c0154765b5a9962f9b8d0)

Attachments
Repro (813 bytes, text/html) 2010-12-09 04:46 PST, Berend-Jan Wever	no flags	Details
View All Add attachment proposed patch, testcase, etc.

Alexey Proskuryakov

Comment 1 2011-01-11 09:45:26 PST