Closed Bug 308585 Opened 19 years ago Closed 19 years ago

Crash [@ nsSVGPatternFrame::GetCanvasTM] after removing <svg:pattern> and putting it back with DOM

Categories

(Core :: SVG, defect)

Product:
Core
Component:
SVG
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
VERIFIED FIXED

People

(Reporter: jruderman, Assigned: scootermorris)

References

Details

(Keywords: crash)

Crash Data

Attachments

(3 files)

simple testcase
(deleted), image/svg+xml
Details
stack trace
(deleted), text/plain
Details
Protect against possibility of having no content parent
(deleted), patch
tor
: review+
Details | Diff | Splinter Review 
Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.9a1) Gecko/20050914
Firefox/1.6a1

Steps to reproduce:
1. Load the testcase.
2. Click the "click here to crash" text.

Result: Firefox crashes. In a debug build, there's an assertion about
dereferencing a NULL nsCOMPtr.
Attached image simple testcase (deleted) — 

    
    

    
  

      
      
      
      

        Attached file
          
        stack trace (deleted)
        — 
      

    


  
Apple crash report with a debug build of Firefox.  Includes a stack trace with
line numbers.

    
    

    
  


  
Assignee: general → scootermorris
Status: NEW → ASSIGNED

        Attachment #196199 -
        Flags: review?(tor)

    
  

        Attachment #196199 -
        Flags: review?(tor) → review+

    
    

    
  
Checked in on trunk

Status: ASSIGNED → RESOLVED
Closed: 19 years ago
Resolution: --- → FIXED

    
    

    
  
Verified FIXED using Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1)
Gecko/20050916 Firefox/1.6a1.

I'll let Jesse do the final honors on Mac.
OS: MacOS X → All
Hardware: Macintosh → All

    
    

    
  
Verified fixed using today's trunk nightly respin.  Mozilla/5.0 (Macintosh; U;
PPC Mac OS X Mach-O; en-US; rv:1.9a1) Gecko/20050916 Firefox/1.6a1.
Status: RESOLVED → VERIFIED
Crash Signature: [@ nsSVGPatternFrame::GetCanvasTM]

          You need to log in
          before you can comment on or make changes to this bug.
        






  

    
  







  

    

      
Attachment

      

      
      
      
      
    

    

      

        

          

            
General

            

              Creator: 



            

            
Created: 

            
Updated: 

            
Size: