307444 - SVG crash [@ nsContentIterator::NextNode]

Status: RESOLVED FIXED

(Core :: SVG, defect)

Comment 1

[Jesse Ruderman]

Attachment: testcase (not reduced)

Comment 2

[Jesse Ruderman]

Attachment: apple crash report with stack trace

Comment 3

[Boris Zbarsky [:bzbarsky]]

At the very least, the problem described in bug 278472 comment 5 is biting us here.

Do we need to get this fixed for 1.8?  If so, I better start working on bug
278472 soon...

Comment 4

[Jesse Ruderman]

> Do we need to get this fixed for 1.8?

Yes, because:
* This crash occurs frequently on every page in the W3C SVG test suite when I
use the "Stir DOM" bookmarklet, so this crash prevents me from testing all of
those pages for other crash and hang bugs.
* I'd like to make the "Stir DOM" bookmarklet public around the time of the
Firefox 1.5 release.
* Before I release the "Stir DOM" bookmarklet, it would be nice if a Firefox
release immune to the easy-to-find, exploitable crashes had already been released.

Comment 5

[Boris Zbarsky [:bzbarsky]]

OK, I'll see what I can do...

Comment 6

[Asa Dotzler [:asa]]

If you come up with a very safe fix in the next couple of days, please request
approval for the patch and we'll evaluate.

Comment 7

[Boris Zbarsky [:bzbarsky]]

Fixed by checkin for bug 278472.