600933 - points.initialize causes nsDocument leak and "ABORT: Tear-off objects remain in hashtable at shutdown"

Status: RESOLVED WORKSFORME

(Core :: SVG, defect)

Description

[Jesse Ruderman]

Attachment: leaking testcase (requires extension; quits Firefox when loaded)

1. Temporarily install 'DOM Fuzz Lite' from
    https://www.squarefree.com/extensions/domFuzzLite.xpi
2. Load one of the testcases.

Result: leak nsDocument / abort

Comment 1

[Jesse Ruderman]

Attachment: ABORT testcase (requires extension; quits Firefox when loaded)

Comment 2

[Jesse Ruderman]

Attachment: stack trace for the abort

###!!! ABORT: Tear-off objects remain in hashtable at shutdown.: 'mTable.Count() == 0', file content/svg/content/src/nsSVGAttrTearoffTable.h, line 54

At nsSVGAttrTearoffTable<nsSVGLength2, nsIDOMSVGAnimatedLength>::
  ~nsSVGAttrTearoffTable()

Comment 3

[Jesse Ruderman]

The line
  x.points.initialize({})

now triggers
  Error: uncaught exception: [Exception... "Unknown or invalid type"  code: "0" nsresult: "0x80620000 (NS_ERROR_DOM_SVG_WRONG_TYPE_ERR)"  location: "file:///Users/jruderman/Desktop/s.svg Line: 14"]

Comment 4

[Jesse Ruderman]

... thanks to the fix for bug 601251.

Comment 5

[Jesse Ruderman]

Did that fix the leak bug, or just break the testcase?

Comment 6

[Robert Longson [:longsonr]]

It stopped you being able to pass random weird things to most SVG DOM methods. The leak may well no longer be triggerable.

Comment 7

[Robert Longson [:longsonr]]

You'll have to try harder from now on ;-)

Comment 8

[Jesse Ruderman]

Fair enough ;)