Last Comment Bug 291902 - Crash [@ nsCSSFrameConstructor::WipeContainingBlock] with path:hover {display:block}
: Crash [@ nsCSSFrameConstructor::WipeContainingBlock] with path:hover {display...
Status: VERIFIED FIXED
[rft-dl]
: crash, fixed1.8.1, testcase, verified1.8.0.2
Product: Core
Classification: Components
Component: SVG (show other bugs)
: Trunk
: All All
P2 critical (vote)
: mozilla1.9alpha1
Assigned To: Boris Zbarsky [:bz] (still a bit busy)
: Hixie (not reading bugmail)
: Jet Villegas (:jet)
Mentors:
: 329044 (view as bug list)
Depends on:
Blocks: stirdom 144004 285964 294445 296086 310933 329044
  Show dependency treegraph
 
Reported: 2005-04-26 00:10 PDT by Martijn Wargers [:mwargers]
Modified: 2007-02-04 23:35 PST (History)
9 users (show)
dveditz: blocking1.8.0.2+
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
Testcase (518 bytes, image/svg+xml)
2005-04-26 00:11 PDT, Martijn Wargers [:mwargers]
no flags Details
Crash log (21.78 KB, text/plain)
2005-04-26 13:11 PDT, Stefan [:stefanh]
no flags Details
Proposed patch (2.11 KB, patch)
2005-10-04 18:11 PDT, Boris Zbarsky [:bz] (still a bit busy)
no flags Details | Diff | Splinter Review
Slightly better (2.06 KB, patch)
2005-10-07 20:13 PDT, Boris Zbarsky [:bz] (still a bit busy)
dbaron: review+
dbaron: superreview+
Details | Diff | Splinter Review
testcase2 (1.88 KB, application/vnd.mozilla.xul+xml)
2005-10-08 08:29 PDT, Martijn Wargers [:mwargers]
no flags Details
Updated to comments (2.19 KB, patch)
2005-10-14 14:31 PDT, Boris Zbarsky [:bz] (still a bit busy)
timr: approval1.8.0.2+
Details | Diff | Splinter Review

Description User image Martijn Wargers [:mwargers] 2005-04-26 00:10:17 PDT
I just tried a win32 2005-03-24 trunk build with SVG enabled.
The testcase that I'll attach crashes that build for me when hovering over the
path element (the ellipse).
Comment 1 User image Martijn Wargers [:mwargers] 2005-04-26 00:11:29 PDT
Created attachment 181849 [details]
Testcase
Comment 2 User image Stefan [:stefanh] 2005-04-26 13:11:26 PDT
Created attachment 181897 [details]
Crash log

The testcase makes my self-compiled build (svg-enabled) from 050423 crash on
Mac OS 10.3.9.
Comment 3 User image Martijn Wargers [:mwargers] 2005-04-26 13:50:01 PDT
Also crashes with path:hover{position:absolute;}
Comment 4 User image Boris Zbarsky [:bz] (still a bit busy) 2005-05-01 22:23:08 PDT
So the basic problem is that we end up with a block-inside-inline, try to
reframe the containing block, don't find one, and crash.

I suppose we could bail out of reframing the containing block if there is no
containing block, or just fall back on reconstructing the entire document
hierarchy....  Or we could introduce more svg-specific knowledge into the frame
constructor...
Comment 5 User image Jesse Ruderman 2005-09-08 00:48:45 PDT
I've hit this crash a few times while playing with bug 306663.  I'd appreciate a
fix for this crash.
Comment 6 User image Boris Zbarsky [:bz] (still a bit busy) 2005-10-04 18:11:48 PDT
Created attachment 198533 [details] [diff] [review]
Proposed patch

This should fix it.  Also fixes the non-tracking bugs this blocks.
Comment 7 User image Boris Zbarsky [:bz] (still a bit busy) 2005-10-07 20:13:05 PDT
Created attachment 198876 [details] [diff] [review]
Slightly better
Comment 8 User image Martijn Wargers [:mwargers] 2005-10-08 08:29:21 PDT
Created attachment 198937 [details]
testcase2

This testcase crashes with the same backtrace, so I guess this too will be
fixed with this patch. (otherwise I'll file a new bug on it)
Comment 9 User image David Baron :dbaron: ⌚️UTC-8 2005-10-13 15:47:30 PDT
Comment on attachment 198876 [details] [diff] [review]
Slightly better

>   if (parentContainer) {
>     ReinsertContent(parentContainer, blockContent);
>   }
>   else {
>-    NS_ERROR("uh oh. the block we need to reframe has no parent!");
>+    ReconstructDocElementHierarchy();
>   }

Check blockContent->IsInDoc() before doing something that drastic, please?
Comment 10 User image Boris Zbarsky [:bz] (still a bit busy) 2005-10-14 14:31:55 PDT
Created attachment 199601 [details] [diff] [review]
Updated to comments
Comment 11 User image Boris Zbarsky [:bz] (still a bit busy) 2005-10-14 15:49:34 PDT
Fixed on trunk.
Comment 12 User image Boris Zbarsky [:bz] (still a bit busy) 2005-10-16 08:21:38 PDT
Er... actually fixed now.  checkin didn't go through the first time.  :(
Comment 13 User image Stephen Donner [:stephend] 2005-10-20 16:54:18 PDT
Verified FIXED using both testcases on SeaMonkey 1.1a;Mozilla/5.0 (Windows; U;
Windows NT 5.1; en-US; rv:1.9a1) Gecko/20051020 SeaMonkey/1.1a
Comment 14 User image Tim Riley [:timr] 2006-03-06 17:41:25 PST
Comment on attachment 199601 [details] [diff] [review]
Updated to comments

a=timr based on conversation with dvedtz
Comment 15 User image Daniel Veditz [:dveditz] 2006-03-07 00:29:15 PST
*** Bug 329044 has been marked as a duplicate of this bug. ***
Comment 16 User image Daniel Veditz [:dveditz] 2006-03-07 00:34:41 PST
crash fix checked into the 1.8 and 1.8.0 branches
Comment 17 User image Jay Patel [:jay] 2006-03-07 16:29:05 PST
v.fixed on 1.8.0 branch with Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.0.2) Gecko/20060307 Firefox/1.5.0.2, no crash with either testcase.

Note You need to log in before you can comment on or make changes to this bug.