Crash [@ nsSVGEffects::RemoveRenderingObserver]

nsSVGRenderingObserver::InvalidateViaReferencedFrame nulls out mReferencedFrame but then calls DoUpdate which, for filters calls UpdateRect which restores the mReferencedFrame that we're supposed to be forgetting.

This version fixes this bug and also bug 455314 and bug 454945

You forgot to include all files in the patch? I get: nsSVGIntegrationUtils.cpp:275: error: 'struct nsSVGEffects::EffectProperties' has no member named 'GetClipPathFrame'

Thanks Mats.

Need better comments to indicate what the semantics of the caching are. For GetReferencedFrame I would say "Get the cached reference frame; will return null if no frame has been acquired by FindReferenceFrame since the last invalidation." But I don't know if this is really the right approach. If something changes in the filter (not frame teardown) we really should recompute mFilterRect using the frame. Seems like with this patch we wouldn't, and mFilterRect just stays wrong. In fact, I think with this patch we won't even set up mFilterRect correctly in the call to UpdateRect from the nsSVGFilterProperty constructor. I guess the need to update mFilterRect right away isn't really compatible with the one-shot invalidation strategy :-(. But it's also not compatible with situations where a frame is temporarily deleted, for example during reframing for style changes, we might delete the filter frame and then create it again, and we don't have any way to be notified when the filter frame has been recreated. I think ideally we'd keep the one-shot approach but add something to asynchronously recompute mFilterRect. So how about this: in nsSVGFilterProperty::DoUpdate, call PresContext()->FrameConstructor()->PostRestyleEvent(content, 0, nsChangeHint_RepaintFrame|nsChangeHint_UpdateEffects) to get the style system to do the work. Now, in nsSVGEffects::UpdateEffects, after deleting the properties we need to check for a filter property and if there is one, get it to update its mFilterRect at that time.

This patch only fixes this bug now.

without the extraneous blank line.

Comment on attachment 342725 [details] [diff] [review] update patch This looks good. I think as a followup we can remove mFilterRect completely. Also, do markers need similar treatment?

checked in dad9b46f1cb6 I don't think markers need anything over and above what all rendering observers might need to fix bug 454945 and bug 455314