Quitting Firefox with the testcase loaded makes it crash. A Mac debug build crashes with a random address on top of nsSVGUtils::RemoveObserver; a Mac nightly crashes with a random address on top of nsPropertyTable::GetPropertyInternal.
Regressed between 2006-05-27 and 2006-05-28 Mac trunk nightlies. Guessing that this is a regression from bug 339375, "Switch paint servers fields to properties", since the only other SVG checkin in that period was backed out.
Created attachment 229481 [details] [diff] [review] remove properties before frame is deleted
Assignee: general → tor
Status: NEW → ASSIGNED
Attachment #229481 - Flags: review?(roc)
Status: ASSIGNED → RESOLVED
Last Resolved: 12 years ago
Resolution: --- → FIXED
Whiteboard: [sg:critical] → [sg:critical] post 1.8 branch
Crashtest checked in.
Crash Signature: [@ nsSVGUtils::RemoveObserver] [@ nsPropertyTable::GetPropertyInternal]
You need to log in before you can comment on or make changes to this bug.