376611 - Don't cache marker frames

Status: RESOLVED FIXED

(Core :: SVG, defect)

Description

[Robert Longson [:longsonr]]

Marker frames suffer from the same issue as bug 375775

Comment 1

[Robert Longson [:longsonr]]

Attachment: attempted testcase

This causes mozilla to reference deleted memory. Depending on the values it points to you might crash.

Comment 2

[Robert Longson [:longsonr]]

Attachment: patch

Comment 3

[tor]

Comment on attachment 260733 [details] [diff] [review]
patch

> class nsSVGMarkerProperty : public nsStubMutationObserver {
...
>+  nsWeakPtr AddMutationObserver(nsIURI *aURI, nsIContent *aContent);

nsWeakPtr is actually nsCOMPtr<nsIWeakReference> and the nsCOMPtr user manual says not to use nsCOMPtrs as return values:

  http://www.mozilla.org/projects/xpcom/nsCOMPtr.html#guide_nsCOMPtr_in_APIs

Comment 4

[Robert Longson [:longsonr]]

Attachment: address review comment

Comment 5

[Robert Longson [:longsonr]]

checked in.

Comment 6

[Daniel Veditz [:dveditz]]

This doesn't crash in FF2.0.0.3 -- a trunk only feature/problem?

Comment 7

[Robert Longson [:longsonr]]

This is a fix for bug 371563. The 1.8 branch has a completely different implementation of markers so this fix is not required there.