Last Comment Bug 291902 - Crash [@ nsCSSFrameConstructor::WipeContainingBlock] with path:hover {display:block}
: Crash [@ nsCSSFrameConstructor::WipeContainingBlock] with path:hover {display...
: crash, fixed1.8.1, testcase, verified1.8.0.2
Product: Core
Classification: Components
Component: SVG (show other bugs)
: Trunk
: All All
: P2 critical (vote)
: mozilla1.9alpha1
Assigned To: Boris Zbarsky [:bz] (TPAC)
: Hixie (not reading bugmail)
: 329044 (view as bug list)
Depends on:
Blocks: stirdom 144004 285964 294445 296086 310933 329044
  Show dependency treegraph
Reported: 2005-04-26 00:10 PDT by Martijn Wargers [:mwargers] (not working for Mozilla)
Modified: 2007-02-04 23:35 PST (History)
9 users (show)
dveditz: blocking1.8.0.2+
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---

Testcase (518 bytes, image/svg+xml)
2005-04-26 00:11 PDT, Martijn Wargers [:mwargers] (not working for Mozilla)
no flags Details
Crash log (21.78 KB, text/plain)
2005-04-26 13:11 PDT, Stefan [:stefanh]
no flags Details
Proposed patch (2.11 KB, patch)
2005-10-04 18:11 PDT, Boris Zbarsky [:bz] (TPAC)
no flags Details | Diff | Splinter Review
Slightly better (2.06 KB, patch)
2005-10-07 20:13 PDT, Boris Zbarsky [:bz] (TPAC)
dbaron: review+
dbaron: superreview+
Details | Diff | Splinter Review
testcase2 (1.88 KB, application/vnd.mozilla.xul+xml)
2005-10-08 08:29 PDT, Martijn Wargers [:mwargers] (not working for Mozilla)
no flags Details
Updated to comments (2.19 KB, patch)
2005-10-14 14:31 PDT, Boris Zbarsky [:bz] (TPAC)
timr: approval1.8.0.2+
Details | Diff | Splinter Review

Description Martijn Wargers [:mwargers] (not working for Mozilla) 2005-04-26 00:10:17 PDT
I just tried a win32 2005-03-24 trunk build with SVG enabled.
The testcase that I'll attach crashes that build for me when hovering over the
path element (the ellipse).
Comment 1 Martijn Wargers [:mwargers] (not working for Mozilla) 2005-04-26 00:11:29 PDT
Created attachment 181849 [details]
Comment 2 Stefan [:stefanh] 2005-04-26 13:11:26 PDT
Created attachment 181897 [details]
Crash log

The testcase makes my self-compiled build (svg-enabled) from 050423 crash on
Mac OS 10.3.9.
Comment 3 Martijn Wargers [:mwargers] (not working for Mozilla) 2005-04-26 13:50:01 PDT
Also crashes with path:hover{position:absolute;}
Comment 4 Boris Zbarsky [:bz] (TPAC) 2005-05-01 22:23:08 PDT
So the basic problem is that we end up with a block-inside-inline, try to
reframe the containing block, don't find one, and crash.

I suppose we could bail out of reframing the containing block if there is no
containing block, or just fall back on reconstructing the entire document
hierarchy....  Or we could introduce more svg-specific knowledge into the frame
Comment 5 Jesse Ruderman 2005-09-08 00:48:45 PDT
I've hit this crash a few times while playing with bug 306663.  I'd appreciate a
fix for this crash.
Comment 6 Boris Zbarsky [:bz] (TPAC) 2005-10-04 18:11:48 PDT
Created attachment 198533 [details] [diff] [review]
Proposed patch

This should fix it.  Also fixes the non-tracking bugs this blocks.
Comment 7 Boris Zbarsky [:bz] (TPAC) 2005-10-07 20:13:05 PDT
Created attachment 198876 [details] [diff] [review]
Slightly better
Comment 8 Martijn Wargers [:mwargers] (not working for Mozilla) 2005-10-08 08:29:21 PDT
Created attachment 198937 [details]

This testcase crashes with the same backtrace, so I guess this too will be
fixed with this patch. (otherwise I'll file a new bug on it)
Comment 9 David Baron :dbaron: ⌚️UTC-7 (busy September 14-25) 2005-10-13 15:47:30 PDT
Comment on attachment 198876 [details] [diff] [review]
Slightly better

>   if (parentContainer) {
>     ReinsertContent(parentContainer, blockContent);
>   }
>   else {
>-    NS_ERROR("uh oh. the block we need to reframe has no parent!");
>+    ReconstructDocElementHierarchy();
>   }

Check blockContent->IsInDoc() before doing something that drastic, please?
Comment 10 Boris Zbarsky [:bz] (TPAC) 2005-10-14 14:31:55 PDT
Created attachment 199601 [details] [diff] [review]
Updated to comments
Comment 11 Boris Zbarsky [:bz] (TPAC) 2005-10-14 15:49:34 PDT
Fixed on trunk.
Comment 12 Boris Zbarsky [:bz] (TPAC) 2005-10-16 08:21:38 PDT
Er... actually fixed now.  checkin didn't go through the first time.  :(
Comment 13 Stephen Donner [:stephend] 2005-10-20 16:54:18 PDT
Verified FIXED using both testcases on SeaMonkey 1.1a;Mozilla/5.0 (Windows; U;
Windows NT 5.1; en-US; rv:1.9a1) Gecko/20051020 SeaMonkey/1.1a
Comment 14 Tim Riley [:timr] 2006-03-06 17:41:25 PST
Comment on attachment 199601 [details] [diff] [review]
Updated to comments

a=timr based on conversation with dvedtz
Comment 15 Daniel Veditz [:dveditz] 2006-03-07 00:29:15 PST
*** Bug 329044 has been marked as a duplicate of this bug. ***
Comment 16 Daniel Veditz [:dveditz] 2006-03-07 00:34:41 PST
crash fix checked into the 1.8 and 1.8.0 branches
Comment 17 Jay Patel [:jay] 2006-03-07 16:29:05 PST
v.fixed on 1.8.0 branch with Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv: Gecko/20060307 Firefox/, no crash with either testcase.

Note You need to log in before you can comment on or make changes to this bug.