1480275 - Assertion failure: IsInComposedDoc(), at src/dom/svg/SVGUseElement.cpp:234

Status: RESOLVED FIXED

(Core :: SVG, defect, P2)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Reduced with m-c:
BuildID=20180801095220
SourceStamp=af6a7edf0069549543f2fba6a8ee3ea251b20829

Assertion failure: IsInComposedDoc(), at src/dom/svg/SVGUseElement.cpp:234

#0 mozilla::dom::SVGUseElement::UpdateShadowTree() src/dom/svg/SVGUseElement.cpp:251:50
#1 nsIDocument::DoUpdateSVGUseElementShadowTrees() src/dom/base/nsDocument.cpp:9816:19
#2 mozilla::PresShell::DoFlushPendingNotifications(mozilla::ChangesToFlush) src/layout/base/PresShell.cpp:4259:16
#3 nsIDocument::FlushPendingNotifications(mozilla::ChangesToFlush) src/dom/base/nsDocument.cpp:7459:12
#4 nsIDocument::FlushPendingNotifications(mozilla::FlushType) src/dom/base/nsDocument.cpp:7398:3
#5 nsDocLoader::DocLoaderIsEmpty(bool) src/uriloader/base/nsDocLoader.cpp:694:14
#6 nsDocLoader::OnStopRequest(nsIRequest*, nsISupports*, nsresult) src/uriloader/base/nsDocLoader.cpp:627:5
#7 non-virtual thunk to nsDocLoader::OnStopRequest(nsIRequest*, nsISupports*, nsresult) src/uriloader/base/nsDocLoader.cpp
#8 mozilla::net::nsLoadGroup::RemoveRequest(nsIRequest*, nsISupports*, nsresult) src/netwerk/base/nsLoadGroup.cpp:629:28
#9 imgRequestProxy::RemoveFromLoadGroup() src/image/imgRequestProxy.cpp:445:15
#10 imgRequestProxy::OnLoadComplete(bool) src/image/imgRequestProxy.cpp:1114:7
#11 void mozilla::image::ImageObserverNotifier<mozilla::image::ObserverTable const*>::operator()<void mozilla::image::SyncNotifyInternal<mozilla::image::ObserverTable const*>(mozilla::image::ObserverTable const* const&, bool, unsigned int, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&)::{lambda(mozilla::image::IProgressObserver*)#7}>(void mozilla::image::SyncNotifyInternal<mozilla::image::ObserverTable const*>(mozilla::image::ObserverTable const* const&, bool, unsigned int, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&)::{lambda(mozilla::image::IProgressObserver*)#7}) src/image/ProgressTracker.cpp:283:9
#12 void mozilla::image::SyncNotifyInternal<mozilla::image::ObserverTable const*>(mozilla::image::ObserverTable const* const&, bool, unsigned int, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&) src/image/ProgressTracker.cpp:357:5
#13 mozilla::image::ProgressTracker::SyncNotifyProgress(unsigned int, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&)::$_1::operator()(mozilla::image::ObserverTable const*) const src/image/ProgressTracker.cpp:378:5
#14 _ZNK7mozilla5image11CopyOnWriteINS0_13ObserverTableEE4ReadIZNS0_15ProgressTracker18SyncNotifyProgressEjRKNS_3gfx12IntRectTypedINS6_12UnknownUnitsEEEE3$_1EEDTclfp_scPKS2_LDnEEET_ src/image/CopyOnWrite.h:179:12
#15 mozilla::image::ProgressTracker::SyncNotifyProgress(unsigned int, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&) src/image/ProgressTracker.cpp:377:14
#16 mozilla::image::RasterImage::NotifyProgress(unsigned int, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&, mozilla::Maybe<unsigned int> const&, mozilla::image::DecoderFlags, mozilla::image::SurfaceFlags) src/image/RasterImage.cpp:1710:28
#17 mozilla::image::RasterImage::NotifyForLoadEvent(unsigned int) src/image/RasterImage.cpp:980:3
#18 mozilla::image::RasterImage::NotifyDecodeComplete(mozilla::image::DecoderFinalStatus const&, mozilla::image::ImageMetadata const&, mozilla::image::DecoderTelemetry const&, unsigned int, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&, mozilla::Maybe<unsigned int> const&, mozilla::image::DecoderFlags, mozilla::image::SurfaceFlags) src/image/RasterImage.cpp:1797:7
#19 mozilla::image::IDecodingTask::NotifyDecodeComplete(mozilla::NotNull<mozilla::image::RasterImage*>, mozilla::NotNull<mozilla::image::Decoder*>)::$_2::operator()() const src/image/IDecodingTask.cpp:130:12
#20 mozilla::detail::RunnableFunction<mozilla::image::IDecodingTask::NotifyDecodeComplete(mozilla::NotNull<mozilla::image::RasterImage*>, mozilla::NotNull<mozilla::image::Decoder*>)::$_2>::Run() src/xpcom/threads/nsThreadUtils.h:554:5
#21 nsThread::ProcessNextEvent(bool, bool*) src/xpcom/threads/nsThread.cpp:1235:14
#22 NS_ProcessNextEvent(nsIThread*, bool) src/xpcom/threads/nsThreadUtils.cpp:519:10
#23 mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:97:21
#24 MessageLoop::RunInternal() src/ipc/chromium/src/base/message_loop.cc:325:10
#25 MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:298:3
#26 nsBaseAppShell::Run() src/widget/nsBaseAppShell.cpp:158:27
#27 XRE_RunAppShell() src/toolkit/xre/nsEmbedFunctions.cpp:942:22
#28 mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:269:9
#29 MessageLoop::RunInternal() src/ipc/chromium/src/base/message_loop.cc:325:10
#30 MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:298:3
#31 XRE_InitChildProcess(int, char**, XREChildData const*) src/toolkit/xre/nsEmbedFunctions.cpp:768:34
#32 content_process_main(mozilla::Bootstrap*, int, char**) src/browser/app/../../ipc/contentproc/plugin-container.cpp:50:30
#33 main src/browser/app/nsBrowserApp.cpp:287:18
#34 __libc_start_main /build/glibc-Cl5G7W/glibc-2.23/csu/../csu/libc-start.c:291
#35 _start (firefox+0x423d04)

Comment 1

[Emilio Cobos Álvarez (:emilio)]

Attachment: Bug 1480275: Handle nested use shadow trees properly when the ID target changes. r=heycam

We end up with three <svg:use> elements to update (lol), because the target (#c)
changes, since we create another element with that ID in the document via
outerHTML.

Comment 2

[Emilio Cobos Álvarez (:emilio)]

Review ping Cam? Has been sitting here for two weeks, and should be trivial.

Comment 3

[Cameron McCormack (:heycam)]

Comment on attachment 8996994 [details]
Bug 1480275: Handle nested use shadow trees properly when the ID target changes. r=heycam

Cameron McCormack (:heycam) (away 24 Aug) has approved the revision.

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/e1269166fb70
Handle nested use shadow trees properly when the ID target changes. r=heycam

Comment 5

[Daniel Varga [:dvarga]]

https://hg.mozilla.org/mozilla-central/rev/e1269166fb70