Fixes #8582.
In SVGStartElement, the gradientTransform and transform attribute handlers reassign value to tokens[j+1] inside the inner token-parsing loop. After the loop, all tokens (including tokens[j+1]) are freed via DestroyString(). The outer attribute loop then calls DestroyString(value) at line 2524, which double-frees the already-destroyed token string, causing SIGABRT.
- Use a separate
token_value local variable inside each inner loop instead of reassigning value
- The outer loop's
DestroyString(value) now correctly frees the original SVGEscapeString()-allocated string exactly once
- Add
tests/cli-svg.tap regression test
