338312 - Moving SVG element that uses a gradient fill out of the <svg:svg> kills Firefox

Status: RESOLVED FIXED

(Core :: SVG, defect)

Description

[Jesse Ruderman]

This is with a trunk nightly (2006-05-17) on Mac.  It makes Firefox crash in a way that doesn't trigger the Mac OS X crash reporter dialog, but does trigger Talkback.  "pure virtual method called" is printed on the console, even outside of a debugger.

gdb says:

Program received signal SIGABRT, Aborted.
0x90047e4c in kill ()
(gdb) bt
#0  0x90047e4c in kill ()
#1  0x9012dff4 in abort ()
#2  0x00435410 in nsTransactionManager::Unlock ()
#3  0x00435454 in nsTransactionManager::Unlock ()
#4  0x00068184 in nsTransactionManagerModule_NSGetModule ()
#5  0x007a0b80 in nsSVGGeometryFrame::QueryInterface ()
#6  0x2c001b6c in nsQueryInterfaceWithError::operator() ()
#7  0x2c001ccc in nsCOMPtr_base::assign_from_qi_with_error ()
#8  0x2c003a24 in NS_GetWeakReference ()
#9  0x0050caec in nsSVGValue::RemoveObserver ()
#10 0x007a0c84 in nsSVGGeometryFrame::~nsSVGGeometryFrame ()
#11 0x007e1268 in nsSVGPathGeometryFrame::~nsSVGPathGeometryFrame ()
#12 0x009f6aa8 in MOZ_Z__length_code ()
#13 0x0022af84 in nsFrame::Destroy ()
#14 0x00592624 in nsFrameList::DestroyFrame ()
#15 0x0065b420 in nsSVGOuterSVGFrame::RemoveFrame ()
#16 0x002d9a68 in nsCSSFrameConstructor::ContentRemoved ()

Talkback (TB18794268Q) says:

libSystem.B.dylib.88.1.5 + 0x47e4c (0x90047e4c)
libSystem.B.dylib.88.1.5 + 0x12dff4 (0x9012dff4)
__cxxabiv1::__unexpected()   CompareCacheHashEntryPtr::CompareCacheHashEntryPtr()   nsSVGGeometryFrame::QueryInterface() 
...      (rest of the stack looks the same)

Marking as security-sensitive because Editor code (nsTransactionManager) and SSL code (CompareCacheHashEntryPtr) don't belong at the top of these stacks.

Comment 1

[Jesse Ruderman]

Attachment: testcase

Comment 2

[tor]

Attachment: remove observers in Destroy instead of destructor

Comment 3

[tor]

Checked in.

Comment 4

[Daniel Veditz [:dveditz]]

Was this Mac-only? I couldn't reproduce on an old trunk or 1.8 branch on windows, but the fix isn't platform-specific.

qawanted: Need to test this on 1.5.0.x and Bon Echo Mac builds and see if we need this fix on the 1.8 branches.

Comment 5

[tor]

(In reply to comment #4)
> Was this Mac-only? I couldn't reproduce on an old trunk or 1.8 branch on
> windows, but the fix isn't platform-specific.

This crash was the side effect of reworking the svg code on the trunk.

Comment 6

[Daniel Veditz [:dveditz]]

Thanks! removing 1.8-branch nominations

Comment 7

[Jesse Ruderman]

Crashtest checked in.