See testcase which crashes current trunk build, within 100ms. http://crash-stats.mozilla.com/report/index/4bb24cf3-806b-11dd-b191-0013211cbf8a?p=1 0 @0x1 1 xul.dll nsSVGIntegrationUtils::GetInvalidAreaForChangedSource 2 xul.dll xul.dll@0x308f25 3 xul.dll nsIFrame::Invalidate 4 xul.dll nsFrameManager::RemoveFrame 5 xul.dll nsCSSFrameConstructor::ContentRemoved 6 xul.dll nsCSSFrameConstructor::RecreateFramesForContent 7 xul.dll nsCSSFrameConstructor::ProcessRestyledFrames 8 xul.dll nsCSSFrameConstructor::RestyleElement 9 xul.dll nsCSSFrameConstructor::ProcessOneRestyle 10 xul.dll nsCSSFrameConstructor::ProcessPendingRestyles 11 xul.dll PresShell::DoFlushPendingNotifications 12 xul.dll PresShell::FlushPendingNotifications 13 xul.dll nsDocument::FlushPendingNotifications 14 xul.dll nsGenericElement::GetPrimaryFrame 15 xul.dll nsGenericElement::GetStyledFrame 16 xul.dll nsNSElementTearoff::GetScrollInfo 17 xul.dll nsNSElementTearoff::SetScrollLeft 18 xul.dll NS_InvokeByIndex_P 19 xul.dll XPCWrappedNative::CallMethod

> gklayout.dll!nsSVGPropertyBase::GetReferencedFrame(nsIAtom * aFrameType=0x012d7a18, int * aOK=0x0012ed38) Line 68 + 0xe bytes C++ gklayout.dll!nsSVGFilterProperty::GetFilterFrame(int * aOK=0x0012ed38) Line 109 C++ gklayout.dll!nsSVGEffects::GetFilterFrame(nsIFrame * aFrame=0x0989cc28) Line 193 + 0x12 bytes C++ gklayout.dll!nsSVGIntegrationUtils::GetInvalidAreaForChangedSource(nsIFrame * aFrame=0x0989cc28, const nsRect & aInvalidRect={...}) Line 141 + 0x9 bytes C++ gklayout.dll!nsIFrame::InvalidateInternal(const nsRect & aDamageRect={...}, int aX=0, int aY=0, nsIFrame * aForChild=0x00000000, int aImmediate=0) Line 3709 + 0x2c bytes C++ gklayout.dll!nsIFrame::Invalidate(const nsRect & aDamageRect={...}, int aImmediate=0) Line 3655 C++ gklayout.dll!nsFrameManager::RemoveFrame(nsIFrame * aParentFrame=0x0cfb1b84, nsIAtom * aListName=0x00000000, nsIFrame * aOldFrame=0x0989cc28) Line 693 + 0x17 bytes C++ gklayout.dll!nsCSSFrameConstructor::ContentRemoved(nsIContent * aContainer=0x05e191d8, nsIContent * aChild=0x0cec61d8, int aIndexInContainer=3, int * aDidReconstruct=0x0012efd4) Line 9457 + 0x12 bytes C++ gklayout.dll!nsCSSFrameConstructor::RecreateFramesForContent(nsIContent * aContent=0x0cec61d8) Line 11080 + 0x1d bytes C++ etc..

I guess this will be fixed by bug 455984.

Bug still occurs. It's essentially the same as bug 455314.

Crashes in a different place on Mac: [@ nsSVGRenderingObserver::GetReferencedFrame]

longsonr has a patch in bug 458493.

not any more I don't :-(

Fixed by bug 455314.