397704 - Crash [@ nsSVGEnum::SetBaseValue]

Status: RESOLVED FIXED

(Core :: SVG, defect)

Description

[Jesse Ruderman]

Attachment: testcase (crashes Firefox when loaded)

Loading the testcase crashes Firefox, making nsSVGEnum::SetBaseValue dereference 0xaaaaaaa1.

Regression from bug 383685, perhaps?

Comment 1

[Jesse Ruderman]

The crash is preceded by:

###!!! ASSERTION: mapping request for a non-attrib enum: 'info.mEnumCount > 0 && mAttrEnum < info.mEnumCount', file /Users/jruderman/trunk/mozilla/content/svg/content/src/nsSVGEnum.cpp, line 56

Comment 2

[Robert Longson [:longsonr]]

Attachment: patch

Comment 3

[Robert Longson [:longsonr]]

Attachment: do need to set a value though

Comment 4

[tor]

How I hate <marker>'s orient...

This will stop a crash, but calling SetOrientToAuto or SetOrientToAngle won't cause the marker top update (not that it would have done so before either).

Comment 5

[Robert Longson [:longsonr]]

(In reply to comment #4)
> How I hate <marker>'s orient...
> 
> This will stop a crash, but calling SetOrientToAuto or SetOrientToAngle won't
> cause the marker top update (not that it would have done so before either).
> 

Well, bug 397749 will fix those although at the moment that patch has this fix and bug 397620 in it.

Comment 6

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Gah!

Having nsSVGEnumMapping change over time for the same element is a bit of a trap since none of the others do that. How hard would it be to leave it the same but have extra code elsewhere to deal with the orient?

Comment 7

[Robert Longson [:longsonr]]

The patch in bug 397749 fixes this crash, together with a number of other issues.

For orientType the nsSVGEnumMapping does not change over time, it does not exist at all. I've now made a special SetBaseValue method that only nsSVGMarkerElement can use for enumerations to handle orientType. nsSVGEnum.cpp file no longer requires changes.

Comment 8

[Robert Longson [:longsonr]]

Fixed by check in for bug 397749

Comment 9

[Robert Longson [:longsonr]]

Reopening as the patch for bug 397749 has been backed out.

Comment 10

[Robert Longson [:longsonr]]

bug 397749 has been checked in again.

Comment 11

[Jesse Ruderman]

Loading the testcase does not cause any assertions or crash on branch.

Comment 12

[Jesse Ruderman]

Crashtest checked in.