Closed
Bug 409573
Opened 17 years ago
Closed 17 years ago
Null deref [@ nsSVGUseFrame::GetCanvasTM] with <filter>s, <use>, XBL
Categories
(Core :: SVG, defect)
Tracking
()
RESOLVED
FIXED
People
(Reporter: jruderman, Assigned: longsonr)
References
Details
(Keywords: assertion, crash, testcase)
Crash Data
Attachments
(2 files)
|
(deleted),
image/svg+xml
|
Details | |
|
(deleted),
patch
|
tor
:
review+
tor
:
superreview+
beltzner
:
approval1.9+
|
Details | Diff | Splinter Review |
testcase (crashes Firefox when loaded)
Loading the testcase triggers:
###!!! ASSERTION: null TM: 'parentTM', file /Users/jruderman/trunk/mozilla/layout/svg/base/src/nsSVGGFrame.cpp, line 123
###!!! ASSERTION: You can't dereference a NULL nsCOMPtr with operator->().: 'mRawPtr != 0', file ../../../../dist/include/xpcom/nsCOMPtr.h, line 868
Crash [@ nsSVGUseFrame::GetCanvasTM] dereferencing 0x00000000.
|
Assignee | |
Comment 1•17 years ago
|
||
|
|
Assignee | |
Updated•17 years ago
|
Attachment #294392 -
Attachment is patch: true
Attachment #294392 -
Flags: superreview?(tor)
Attachment #294392 -
Flags: review?(tor)
|
Reporter | |
Updated•17 years ago
|
Assignee: nobody → longsonr
Attachment #294392 -
Flags: superreview?(tor)
Attachment #294392 -
Flags: superreview+
Attachment #294392 -
Flags: review?(tor)
Attachment #294392 -
Flags: review+
|
|
Assignee | |
Updated•17 years ago
|
Attachment #294392 -
Flags: approval1.9?
|
|
Assignee | |
Comment 2•17 years ago
|
||
Low risk patch. Avoid calling the problem function. The same test is already present in nsSVGGlyphFrame.cpp
|
||
Comment 3•17 years ago
|
||
Comment on attachment 294392 [details] [diff] [review]
patch
a=beltzner for 1.9
Attachment #294392 -
Flags: approval1.9? → approval1.9+
|
|
Assignee | |
Comment 4•17 years ago
|
||
checked in.
Status: NEW → RESOLVED
Closed: 17 years ago
Resolution: --- → FIXED
|
|
Assignee | |
Updated•17 years ago
|
Flags: in-testsuite?
|
||
Updated•13 years ago
|
Crash Signature: [@ nsSVGUseFrame::GetCanvasTM]
You need to log in
before you can comment on or make changes to this bug.
Description
•