337408 - svg in xul stack crashes

Status: RESOLVED WORKSFORME

(Core :: SVG, defect)

Description

[Alex Fritze]

Testcase coming up.

Comment 1

[Alex Fritze]

Attachment: testcase

Testcase crashes on mouseover in nsSVGUtils::HitTestClip(). 
The frame state bits indicate NS_STATE_SVG_CLIPPED_MASK, but the clip == null.

Comment 2

[Alex Fritze]

The following patch fixes the problem superficially (but doesn't fix whatever sinister is going on underneath):

Index: nsSVGUtils.cpp
===================================================================
--- nsSVGUtils.cpp	(revision 2252)
+++ nsSVGUtils.cpp	(working copy)
@@ -1073,8 +1073,10 @@
     nsISVGClipPathFrame *clip;
     clip = NS_STATIC_CAST(nsISVGClipPathFrame *,
                           aFrame->GetProperty(nsGkAtoms::clipPath));
-    nsCOMPtr<nsIDOMSVGMatrix> matrix = GetCanvasTM(aFrame);
-    clip->ClipHitTest(SVGFrame, matrix, x, y, &clipHit);
+    if (clip) {
+      nsCOMPtr<nsIDOMSVGMatrix> matrix = GetCanvasTM(aFrame);
+      clip->ClipHitTest(SVGFrame, matrix, x, y, &clipHit);
+    }
   }
 
   return clipHit;

Comment 3

[Robert Longson [:longsonr]]

reftest checked in.

http://lxr.mozilla.org/seamonkey/source/layout/reftests/svg/bugs/bug337408.xul

Comment 4

[Jesse Ruderman]

The test was giving me an XML parsing error; I fixed that by putting the comment after the '<?xml version="1.0"?>'.

Btw, in the future, please put crash-only tests in e.g. mozilla/layout/svg/crashtests/ instead of mozilla/layout/reftests/svg/bugs/.