291902 - Crash [@ nsCSSFrameConstructor::WipeContainingBlock] with path:hover {display:block}

Status: VERIFIED FIXED

(Core :: SVG, defect, P2)

Description

[Martijn Wargers (dead)]

I just tried a win32 2005-03-24 trunk build with SVG enabled.
The testcase that I'll attach crashes that build for me when hovering over the
path element (the ellipse).

Comment 1

[Martijn Wargers (dead)]

Attachment: Testcase

Comment 2

[Stefan [:stefanh]]

Attachment: Crash log

The testcase makes my self-compiled build (svg-enabled) from 050423 crash on
Mac OS 10.3.9.

Comment 3

[Martijn Wargers (dead)]

Also crashes with path:hover{position:absolute;}

Comment 4

[Boris Zbarsky [:bzbarsky]]

So the basic problem is that we end up with a block-inside-inline, try to
reframe the containing block, don't find one, and crash.

I suppose we could bail out of reframing the containing block if there is no
containing block, or just fall back on reconstructing the entire document
hierarchy....  Or we could introduce more svg-specific knowledge into the frame
constructor...

Comment 5

[Jesse Ruderman]

I've hit this crash a few times while playing with bug 306663.  I'd appreciate a
fix for this crash.

Comment 6

[Boris Zbarsky [:bzbarsky]]

Attachment: Proposed patch

This should fix it.  Also fixes the non-tracking bugs this blocks.

Comment 7

[Boris Zbarsky [:bzbarsky]]

Attachment: Slightly better

Comment 8

[Martijn Wargers (dead)]

Attachment: testcase2

This testcase crashes with the same backtrace, so I guess this too will be
fixed with this patch. (otherwise I'll file a new bug on it)

Comment 9

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Comment on attachment 198876 [details] [diff] [review]
Slightly better

>   if (parentContainer) {
>     ReinsertContent(parentContainer, blockContent);
>   }
>   else {
>-    NS_ERROR("uh oh. the block we need to reframe has no parent!");
>+    ReconstructDocElementHierarchy();
>   }

Check blockContent->IsInDoc() before doing something that drastic, please?

Comment 10

[Boris Zbarsky [:bzbarsky]]

Attachment: Updated to comments

Comment 11

[Boris Zbarsky [:bzbarsky]]

Fixed on trunk.

Comment 12

[Boris Zbarsky [:bzbarsky]]

Er... actually fixed now.  checkin didn't go through the first time.  :(

Comment 13

[Stephen Donner [:stephend] Not actively reading bugmail]

Verified FIXED using both testcases on SeaMonkey 1.1a;Mozilla/5.0 (Windows; U;
Windows NT 5.1; en-US; rv:1.9a1) Gecko/20051020 SeaMonkey/1.1a

Comment 14

[Tim Riley [:timr]]

Comment on attachment 199601 [details] [diff] [review]
Updated to comments

a=timr based on conversation with dvedtz

Comment 15

[Daniel Veditz [:dveditz]]

*** Bug 329044 has been marked as a duplicate of this bug. ***

Comment 16

[Daniel Veditz [:dveditz]]

crash fix checked into the 1.8 and 1.8.0 branches

Comment 17

[Jay Patel [:jay]]

v.fixed on 1.8.0 branch with Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.0.2) Gecko/20060307 Firefox/1.5.0.2, no crash with either testcase.