220165 - Mozilla crashes after clicking HTML button embedded in SVG document

Status: RESOLVED FIXED

(Core :: SVG, defect)

Description

[Marek Stępień [:marcoos, inactive]]

The win32 SVG enabled  build of Mozilla (from
ftp.mozilla.org/pub/mozilla/nightly/2003-09-23-12-trunk/)  crashes after
clicking an <html:button> element. (Tested on Windows XP).

Steps to reproduce:

1. Go to http://www.croczilla.com/svg/foreign1.xml and click the button called
"This is a wide button"

Expected results:

1. A JS-alert with a "boo!" message should appear.

Actual results:

1. Mozilla crashes


A testcase follows.

Comment 1

[Marek Stępień [:marcoos, inactive]]

Attachment: A simple testcase

Slightly minimized version of the file from croczilla.com.

Comment 2

[Boris Zbarsky [:bzbarsky]]

Attachment: Patch

This is a bit of a hack, especially with the pushing of "null" as the floater
containing block.  I wonder why there is a floater containing block on the
stack that does not have the SPACE_MGR bit set....

It may be less hackish to just set the SPACE_MGR bit directly on the frame here
instead of messing with the floater containing block.

In any case, we do want to be calling ConstructBlock here so that floated and
positioned kids of the foreignObject will act correctly.

Comment 3

[Alex Fritze]

Comment on attachment 132076 [details] [diff] [review]
Patch

Patch looks good, but do you think it would make sense to simplify things and
treat all SVG frames as blocks?

Comment 4

[Boris Zbarsky [:bzbarsky]]

What do you mean by that, exactly?

Comment 5

[Alex Fritze]

Comment on attachment 132076 [details] [diff] [review]
Patch

I meant calling ConstructBlock() for all SVG frames and not just special case
for foreignObject - but just ignore it cause it doesn't make sense :-)

You technically don't need SR to check this in because it's not part of the
default build. 
That's not to say that I don't think it would be a good idea if dbaron has a
look at this, but it would be nice to get this in soon.

Comment 6

[Nick Konstadoglou]

It works just fine with firebird 0.6.1
maybe it should be changed to fixed?

Comment 7

[Marek Stępień [:marcoos, inactive]]

Nick: This became broken *after* Firebird 0.6.1 was released.

Comment 8

[Boris Zbarsky [:bzbarsky]]

Taking.

Comment 9

[Boris Zbarsky [:bzbarsky]]

Attachment: Updated to new CreateViewForFrame arg list

Comment 10

[Boris Zbarsky [:bzbarsky]]

Fixed.

Comment 11

[Boris Zbarsky [:bzbarsky]]

Checked in a test for this.