Closed Bug 337408 Opened 16 years ago Closed 14 years ago

svg in xul stack crashes

Categories

(Core :: SVG, defect)

x86
Windows XP
defect
Not set
critical

Tracking

()

RESOLVED WORKSFORME

People

(Reporter: alex, Unassigned)

References

Details

Attachments

(1 file)

495 bytes, text/plain
Details
Testcase coming up.
Attached file testcase
Testcase crashes on mouseover in nsSVGUtils::HitTestClip(). 
The frame state bits indicate NS_STATE_SVG_CLIPPED_MASK, but the clip == null.
The following patch fixes the problem superficially (but doesn't fix whatever sinister is going on underneath):

Index: nsSVGUtils.cpp
===================================================================
--- nsSVGUtils.cpp	(revision 2252)
+++ nsSVGUtils.cpp	(working copy)
@@ -1073,8 +1073,10 @@
     nsISVGClipPathFrame *clip;
     clip = NS_STATIC_CAST(nsISVGClipPathFrame *,
                           aFrame->GetProperty(nsGkAtoms::clipPath));
-    nsCOMPtr<nsIDOMSVGMatrix> matrix = GetCanvasTM(aFrame);
-    clip->ClipHitTest(SVGFrame, matrix, x, y, &clipHit);
+    if (clip) {
+      nsCOMPtr<nsIDOMSVGMatrix> matrix = GetCanvasTM(aFrame);
+      clip->ClipHitTest(SVGFrame, matrix, x, y, &clipHit);
+    }
   }
 
   return clipHit;
Severity: normal → critical
reftest checked in.

http://lxr.mozilla.org/seamonkey/source/layout/reftests/svg/bugs/bug337408.xul
Status: NEW → RESOLVED
Closed: 14 years ago
Resolution: --- → WORKSFORME
Flags: in-testsuite+
The test was giving me an XML parsing error; I fixed that by putting the comment after the '<?xml version="1.0"?>'.

Btw, in the future, please put crash-only tests in e.g. mozilla/layout/svg/crashtests/ instead of mozilla/layout/reftests/svg/bugs/.
Depends on: 421473
You need to log in before you can comment on or make changes to this bug.