296806 - Firefox crashes when using <g> in a XHTML Namespace [@ nsStyleContext::GetStyleData]

Status: RESOLVED DUPLICATE of bug 296626

(Core :: SVG, defect)

Description

[sendmail.to]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; de-DE; rv:1.7.8) Gecko/20050511 Firefox/1.0.4
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8b2) Gecko/20050605 Firefox/1.0+

Firefox crashes when using <g> in a XHTML Namespace.
Look into the testcase, to repdroduce this problem.

Reproducible: Always

Steps to Reproduce:
1. Open Deerpark 
2. load testcase.xml
3. Deer Park Crashes



I'm not sure, but this Bug could be related to Bug 296626.

Comment 1

[sendmail.to]

Attachment: testcase

Comment 2

[Hixie (not reading bugmail)]

Any chance you can make a testcase that doesn't involve XSLT?

Comment 3

[sendmail.to]

Attachment: XSLT for testcase

Comment 4

[sendmail.to]

Attachment: Testcase without XSLT

I hope Deer Park crash with the new testcase is caused by the same Bug ;-)

Comment 5

[Gabriel Chadwick]

I confirm this with Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8b2)
Gecko/20050605 Firefox/1.0+ .

Comment 6

[Gabriel Chadwick]

Talkback report TB6430592K

Comment 7

[timeless]

Incident ID: 6430592
Stack Signature	nsStyleContext::GetStyleData cdac8b8e
Product ID	FirefoxTrunk
Build ID	2005060506
Trigger Time	2005-06-06 06:08:36.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	firefox.exe + (001ec259)
URL visited	
User Comments	
Since Last Crash	80 sec
Total Uptime	80 sec
Trigger Reason	Access violation
Source File, Line No.
c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/style/nsStyleContext.cpp,
line 248
Stack Trace 	
nsStyleContext::GetStyleData 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/style/nsStyleContext.cpp,
line 248]
nsCSSFrameConstructor::InitAndRestoreFrame 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp,
line 6736]
nsCSSFrameConstructor::ConstructTextFrame 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp,
line 5209]
nsCSSFrameConstructor::ConstructFrameInternal 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp,
line 7581]
nsCSSFrameConstructor::ConstructFrame 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp,
line 7491]
nsCSSFrameConstructor::ProcessChildren 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp,
line 11798]
nsCSSFrameConstructor::ConstructSVGFrame 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp,
line 7395]
nsCSSFrameConstructor::ConstructFrameInternal 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp,
line 7630]
nsCSSFrameConstructor::ConstructFrame 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp,
line 7491]
nsCSSFrameConstructor::ProcessInlineChildren 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp,
line 13102]
nsCSSFrameConstructor::ConstructInline 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp,
line 12913]
nsCSSFrameConstructor::ConstructFrameByDisplayType 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp,
line 6575]
nsCSSFrameConstructor::ConstructFrameInternal 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp,
line 7661]
nsCSSFrameConstructor::ConstructFrame 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp,
line 7491]
nsCSSFrameConstructor::ProcessChildren 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp,
line 11798]
nsCSSFrameConstructor::ConstructSVGFrame 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp,
line 7395]
nsCSSFrameConstructor::ConstructFrameInternal 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp,
line 7630]
nsCSSFrameConstructor::ConstructFrame 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp,
line 7491]
nsCSSFrameConstructor::ProcessChildren 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp,
line 11798]
nsCSSFrameConstructor::ConstructBlock 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp,
line 12859]
nsCSSFrameConstructor::ConstructFrameByDisplayType 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp,
line 6683]
nsCSSFrameConstructor::ConstructFrameInternal 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp,
line 7661]
nsCSSFrameConstructor::ConstructFrame 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp,
line 7491]
nsCSSFrameConstructor::ProcessChildren 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp,
line 11798]
nsCSSFrameConstructor::ConstructDocElementFrame 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp,
line 4404]
nsCSSFrameConstructor::ContentInserted 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp,
line 8974]
PresShell::InitialReflow 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp,
line 2825]
nsContentSink::StartLayout 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/base/src/nsContentSink.cpp,
line 924]
nsXMLContentSink::StartLayout 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/xml/document/src/nsXMLContentSink.cpp,
line 802]
nsXMLContentSink::DidBuildModel 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/xml/document/src/nsXMLContentSink.cpp,
line 283]

Comment 8

[tor]

*** This bug has been marked as a duplicate of 296626 ***