307470 - SVG/DOM infinite-recursion crash involving <svg:marker> and <svg:path>

Status: RESOLVED FIXED

(Core :: SVG, defect)

Description

[Jesse Ruderman]

Testcase crashes:
* Trunk hourly build from September 7 on Mac OS X.
* Branch nightly respin build from September 7 on Mac OS X.

Similar to bug 299204?

Comment 1

[Jesse Ruderman]

Attachment: Mostly-reduced testcase (crashes Firefox)

Comment 2

[Jesse Ruderman]

Attachment: apple crash report with stack trace showing infinite recursion

Comment 3

[tor]

Attachment: prevent infinite loops

Comment 4

[tor]

Checked in on trunk.

Comment 5

[Mike Schroepfer]

Comment on attachment 196242 [details] [diff] [review]
prevent infinite loops

Approved for 1.8b5 per bug meeting

Comment 6

[tor]

Checked in on branch:

Checking in nsSVGMarkerFrame.cpp;
/cvsroot/mozilla/layout/svg/base/src/nsSVGMarkerFrame.cpp,v  <-- 
nsSVGMarkerFrame.cpp
new revision: 1.11.2.1; previous revision: 1.11
done
Checking in nsSVGMarkerFrame.h;
/cvsroot/mozilla/layout/svg/base/src/nsSVGMarkerFrame.h,v  <--  nsSVGMarkerFrame.h
new revision: 1.6.6.1; previous revision: 1.6
done
Checking in nsSVGPathGeometryFrame.cpp;
/cvsroot/mozilla/layout/svg/base/src/nsSVGPathGeometryFrame.cpp,v  <-- 
nsSVGPathGeometryFrame.cpp
new revision: 1.27.2.1; previous revision: 1.27
done