308306 - Crash [@nsSVGFilterFrame::FilterPaint] when removing text inside an element that has a filter applied

Status: RESOLVED WORKSFORME

(Core :: SVG, defect)

Description

[Martijn Wargers (dead)]

See upcoming testcase. Current Mozilla trunk builds crash when clicking on the text.
Talkback ID: TB9303101G

nsSVGFilterFrame::FilterPaint 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/svg/base/src/nsSVGFilterFrame.cpp,
line 360]
nsSVGGFrame::PaintSVG 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/svg/base/src/nsSVGGFrame.cpp,
line 124]
nsSVGOuterSVGFrame::Paint 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/svg/base/src/nsSVGOuterSVGFrame.cpp,
line 842]
nsContainerFrame::PaintChild 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsContainerFrame.cpp,
line 283]
nsContainerFrame::PaintChildren 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsContainerFrame.cpp,
line 228]
nsHTMLContainerFrame::Paint 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsHTMLContainerFrame.cpp,
line 84]
CanvasFrame::Paint 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsHTMLFrame.cpp,
line 371]
PresShell::Paint 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp,
line 5645]
nsView::Paint 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/view/src/nsView.cpp, line
316]
nsViewManager::RenderDisplayListElement 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/view/src/nsViewManager.cpp,
line 1468]
nsViewManager::RenderViews 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/view/src/nsViewManager.cpp,
line 1380]
nsViewManager::Refresh 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/view/src/nsViewManager.cpp,
line 930]
nsViewManager::DispatchEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/view/src/nsViewManager.cpp,
line 2055]
HandleEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/view/src/nsView.cpp, line
174]
nsWindow::DispatchEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/widget/src/windows/nsWindow.cpp,
line 1060]
nsWindow::ProcessMessage 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/widget/src/windows/nsWindow.cpp,
line 4172]
nsWindow::WindowProc 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/widget/src/windows/nsWindow.cpp,
line 1249]
USER32.dll + 0x2a3d0 (0x77e3a3d0)
USER32.dll + 0x4750 (0x77e14750)
USER32.dll + 0x55b0 (0x77e155b0)
ntdll.dll + 0x1ff57 (0x7958ff57)
USER32.dll + 0x1e605 (0x77e2e605)
nsWindow::ProcessMessage 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/widget/src/windows/nsWindow.cpp,
line 4437]
nsWindow::WindowProc 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/widget/src/windows/nsWindow.cpp,
line 1249]
USER32.dll + 0x2a3d0 (0x77e3a3d0)
USER32.dll + 0x4605 (0x77e14605)
USER32.dll + 0xa7ba (0x77e1a7ba)
nsAppStartup::Run 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/toolkit/components/startup/src/nsAppStartup.cpp,
line 146]
main 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/browser/app/nsBrowserApp.cpp,
line 61]
KERNEL32.DLL + 0x2893d (0x7962893d)

Comment 1

[Martijn Wargers (dead)]

Attachment: testcase

Comment 2

[Stephen Donner [:stephend] Not actively reading bugmail]

I longer crash using SeaMonkey 1.1a: Mozilla/5.0 (Windows; U; Windows NT 5.1;
en-US; rv:1.9a1) Gecko/20050928 Mozilla/1.0.

Martijn, how about you?

Comment 3

[Martijn Wargers (dead)]

Yes, seems fixed somehow.