Jesse Ruderman Reporter
	Description • 13 years ago

1. Install https://www.squarefree.com/extensions/domFuzzLite2.xpi
2. Load the testcase.

Result:
  Debug: Crash [@ nsSVGSwitchElement::FindActiveChild] calling 0x0 ?
  Opt:   Crash [@ nsNodeUtils::ContentRemoved]         calling bogus ?

The GC pattern makes me wonder if this is related to bug 335998 being fixed.

	Olli Pettay [:smaug][bugs@pettay.fi] Assignee
	Comment 2 • 13 years ago

Um, nsSVGSwitchElement overrides InsertChildAt/RemoveChildAt

	Olli Pettay [:smaug][bugs@pettay.fi] Assignee
	Comment 3 • 13 years ago

The changes shouldn't be in hot paths, and this is the right thing to do.
Yet, it is unfortunate to add new Addref/releases.

	Olli Pettay [:smaug][bugs@pettay.fi] Assignee
	Comment 4 • 13 years ago

...so I patched all the cases I found where similar problem could occur,
not only nsGenericElement.

	Olli Pettay [:smaug][bugs@pettay.fi] Assignee
	Comment 5 • 13 years ago

And note, in parser eTreeOpAppendChildrenToNewParent
it is really the node which needs to be strong.

	Olli Pettay [:smaug][bugs@pettay.fi] Assignee
	Comment 6 • 13 years ago

http://hg.mozilla.org/mozilla-central/rev/071d9c997f3d

	Johnny Stenback (:jst)
	Comment 7 • 13 years ago

Olli, this is something we could take in 8, right?

	Daniel Veditz [:dveditz]
	Comment 8 • 13 years ago

I could not reproduce the crash using the testcase on Firefox 8 (beta), is it possible this was introduced by something in Firefox 9 rather than bug 335998 as Jesse guessed? Didn't see any script errors running the testcase so I think I ran it correctly, but I'd be happier if Jesse concurred. It's also possible something else that landed on both Fx9 and 8 masked/fixed this, or something that landed earlier on Fx9 that un-masked the underlying problem.

	Olli Pettay [:smaug][bugs@pettay.fi] Assignee
	Comment 9 • 13 years ago

The patch for bug 335998 is not in FF8.

	Olli Pettay [:smaug][bugs@pettay.fi] Assignee
	Comment 10 • 13 years ago

I don't see any reason to take this to FF8.

	Johnny Stenback (:jst)
	Comment 11 • 13 years ago

Excellent, thanks Olli!

	Marcia Knous [:marcia]
	Comment 12 • 13 years ago

Verified fixed using Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:11.0a1) Gecko/20111122 Firefox/11.0a1. I verified by following the steps in Comment 0.

	u279076
	Comment 13 • 13 years ago

(In reply to Marcia Knous [:marcia] from comment #12)
> Verified fixed using Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:11.0a1)
> Gecko/20111122 Firefox/11.0a1. I verified by following the steps in Comment
> 0.

Thanks Marcia. If you have time, could you please also verify on Firefox 9 and 10?

	Marcia Knous [:marcia]
	Comment 14 • 13 years ago

Verified fixed using Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:9.0) Gecko/20100101 Firefox/9.0. The extension is not compatible with Aurora, so I am not sure if forcing compat would be a fair test.