Closed Bug 304765 Opened 19 years ago Closed 19 years ago

crash if append a an element to SVG that is inside a XUL window

Categories

(Firefox :: General, defect)

Product:
Firefox
Component:
General
Platform:
x86
Linux
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
VERIFIED DUPLICATE of bug 296086

People

(Reporter: arno, Unassigned)

References

(
URL
)

Details

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8b4) Gecko/20050809 Firefox/1.0+
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8b4) Gecko/20050809 Firefox/1.0+

If you insert some SVG inside a XUL page, and then you try to add an element
created via createElement instead of createElementNS, Firefox crashes.

Reproducible: Always

Steps to Reproduce:
1. open the testcase
2. click 


Actual Results:  
Deer park crashes

Expected Results:  
Deer park should not crash

testcase at :
http://ffsearchplugins.free.fr/bugzilla/SvgXulCrash.xul
Incident ID: 8646440
Stack Signature	nsCSSFrameConstructor::WipeContainingBlock() d5162ac2
Product ID	FirefoxTrunk
Build ID	2005082205
Trigger Time	2005-08-23 11:56:49.0
Platform	LinuxIntel
Operating System	Linux 2.6.12-1.1398_FC4
Module	firefox-bin + (001b932a)
URL visited	
User Comments	
Since Last Crash	0 sec
Total Uptime	6 sec
Trigger Reason	SIGSEGV: Segmentation Fault: (signal 11)
Source File, Line No.
/builds/tinderbox/Fx-Trunk/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp,
line 452
Stack Trace 	
nsCSSFrameConstructor::WipeContainingBlock() 
[/builds/tinderbox/Fx-Trunk/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp,
line 452]
nsCSSFrameConstructor::ContentAppended() 
[/builds/tinderbox/Fx-Trunk/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp,
line 8571]
PresShell::ContentAppended() 
[/builds/tinderbox/Fx-Trunk/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/layout/base/nsPresShell.cpp,
line 5478]
nsDocument::ContentAppended() 
[/builds/tinderbox/Fx-Trunk/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/content/base/src/nsDocument.cpp,
line 61]
nsGenericElement::InsertChildAt() 
[/builds/tinderbox/Fx-Trunk/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/content/base/src/nsGenericElement.cpp,
line 2703]
nsGenericElement::InsertBefore() 
[/builds/tinderbox/Fx-Trunk/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/content/base/src/nsGenericElement.cpp,
line 3049]
nsSVGGElement::AppendChild()
XPTC_InvokeByIndex()
XPCWrappedNative::CallMethod(XPCCallContext&, XPCWrappedNative::CallMode)() 
[/builds/tinderbox/Fx-Trunk/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp,
line 2118]
XPC_WN_CallMethod() 
[/builds/tinderbox/Fx-Trunk/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp,
line 1401]
js_Invoke() 
[/builds/tinderbox/Fx-Trunk/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/js/src/jsinterp.c,
line 1173]
js_Interpret() 
[/builds/tinderbox/Fx-Trunk/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/js/src/jsinterp.c,
line 3464]
js_Invoke() 
[/builds/tinderbox/Fx-Trunk/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/js/src/jsinterp.c,
line 1193]
js_InternalInvoke() 
[/builds/tinderbox/Fx-Trunk/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/js/src/jsinterp.c,
line 1271]
JS_CallFunctionValue() 
[/builds/tinderbox/Fx-Trunk/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/js/src/jsapi.c,
line 3926]
nsJSContext::CallEventHandler() 
[/builds/tinderbox/Fx-Trunk/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/dom/src/base/nsJSEnvironment.cpp,
line 1416]
nsJSEventListener::HandleEvent() 
[/builds/tinderbox/Fx-Trunk/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/dom/src/events/nsJSEventListener.cpp,
line 175]
nsEventListenerManager::HandleEventSubType() 
[/builds/tinderbox/Fx-Trunk/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/content/events/src/nsEventListenerManager.cpp,
line 1597]
nsEventListenerManager::HandleEvent() 
[/builds/tinderbox/Fx-Trunk/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/content/events/src/nsEventListenerManager.cpp,
line 1696]
nsXULElement::HandleDOMEvent() 
[/builds/tinderbox/Fx-Trunk/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2201]
PresShell::HandleEventInternal() 
[/builds/tinderbox/Fx-Trunk/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/layout/base/nsPresShell.cpp,
line 848]
PresShell::HandleEventWithTarget() 
[/builds/tinderbox/Fx-Trunk/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/layout/base/nsPresShell.cpp,
line 6283]
nsEventStateManager::CheckForAndDispatchClick() 
[/builds/tinderbox/Fx-Trunk/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/content/events/src/nsEventStateManager.cpp,
line 3040]
nsEventStateManager::PostHandleEvent() 
[/builds/tinderbox/Fx-Trunk/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/content/events/src/nsEventStateManager.cpp,
line 164]
PresShell::HandleEventInternal() 
[/builds/tinderbox/Fx-Trunk/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/layout/base/nsPresShell.cpp,
line 848]
PresShell::HandleEvent() 
[/builds/tinderbox/Fx-Trunk/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/layout/base/nsPresShell.cpp,
line 6220]
nsViewManager::HandleEvent() 
[/builds/tinderbox/Fx-Trunk/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/view/src/nsViewManager.cpp,
line 848]
nsViewManager::DispatchEvent() 
[/builds/tinderbox/Fx-Trunk/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/view/src/nsViewManager.cpp,
line 2246]
HandleEvent() 
[/builds/tinderbox/Fx-Trunk/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/view/src/nsView.cpp,
line 251]
nsCommonWidget::DispatchEvent() 
[/builds/tinderbox/Fx-Trunk/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/widget/src/gtk2/nsCommonWidget.cpp,
line 219]
nsWindow::OnButtonReleaseEvent() 
[/builds/tinderbox/Fx-Trunk/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/widget/src/gtk2/nsWindow.cpp,
line 1594]
button_release_event_cb() 
[/builds/tinderbox/Fx-Trunk/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/widget/src/gtk2/nsWindow.cpp,
line 3722]
libgtk-x11-2.0.so.0 + 0x10b352 (0x00313352)
libgobject-2.0.so.0 + 0x8bc8 (0x00a32bc8)
libgobject-2.0.so.0 + 0x185be (0x00a425be)
libgobject-2.0.so.0 + 0x19c55 (0x00a43c55)
libgobject-2.0.so.0 + 0x1a249 (0x00a44249)
libgtk-x11-2.0.so.0 + 0x1e6ac3 (0x003eeac3)
libgtk-x11-2.0.so.0 + 0x109ab7 (0x00311ab7)
libgtk-x11-2.0.so.0 + 0x109ef4 (0x00311ef4)
libgdk-x11-2.0.so.0 + 0x3bd6e (0x00c41d6e)
libglib-2.0.so.0 + 0x2507e (0x0099c07e)
libglib-2.0.so.0 + 0x28096 (0x0099f096)
libglib-2.0.so.0 + 0x28383 (0x0099f383)
libgtk-x11-2.0.so.0 + 0x1091b5 (0x003111b5)
nsAppShell::Run() 
[/builds/tinderbox/Fx-Trunk/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/widget/src/gtk2/nsAppShell.cpp,
line 141]
nsAppStartup::Run() 
[/builds/tinderbox/Fx-Trunk/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/toolkit/components/startup/src/nsAppStartup.cpp,
line 146]
XRE_main() 
[/builds/tinderbox/Fx-Trunk/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/toolkit/xre/nsAppRunner.cpp,
line 2324]
main() 
[/builds/tinderbox/Fx-Trunk/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/browser/app/nsBrowserApp.cpp,
line 62]
libc.so.6 + 0x1549f (0x0074749f)

*** This bug has been marked as a duplicate of 296086 ***
Status: UNCONFIRMED → RESOLVED
Closed: 19 years ago
Resolution: --- → DUPLICATE
Status: RESOLVED → VERIFIED
You need to log in before you can comment on or make changes to this bug.