Crash [@ nsSVGGFrame::GetCanvasTM] with gradient and removing transform attribute

RESOLVED FIXED

Status

()

Core
SVG
--
critical
RESOLVED FIXED
12 years ago
11 years ago

People

(Reporter: Jesse Ruderman, Assigned: longsonr)

Tracking

(Blocks: 1 bug, {crash, testcase})

Trunk
PowerPC
Mac OS X
crash, testcase
Points:
---
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

(crash signature)

Attachments

(2 attachments)

(Reporter)

Description

12 years ago
This testcase causes:

###!!! ASSERTION: null TM: 'parentTM', file /Users/admin/trunk/mozilla/layout/svg/base/src/nsSVGGFrame.cpp, line 126

###!!! ASSERTION: You can't dereference a NULL nsCOMPtr with operator->().: 'mRawPtr != 0', file ../../../../dist/include/xpcom/nsCOMPtr.h, line 849

Crash [@ nsSVGGFrame::GetCanvasTM]
(Reporter)

Comment 1

12 years ago
Created attachment 245815 [details]
testcase (crashes Firefox)
(Assignee)

Comment 2

12 years ago
Created attachment 245855 [details] [diff] [review]
patch
Assignee: general → longsonr
Status: NEW → ASSIGNED
Attachment #245855 - Flags: superreview?(tor)
Attachment #245855 - Flags: review?(tor)

Updated

12 years ago
Attachment #245855 - Flags: superreview?(tor)
Attachment #245855 - Flags: superreview+
Attachment #245855 - Flags: review?(tor)
Attachment #245855 - Flags: review+
(Assignee)

Comment 3

12 years ago
checked in
Status: ASSIGNED → RESOLVED
Last Resolved: 12 years ago
Resolution: --- → FIXED
(Reporter)

Comment 4

11 years ago
Crashtest checked in.
Flags: in-testsuite+
Crash Signature: [@ nsSVGGFrame::GetCanvasTM]
You need to log in before you can comment on or make changes to this bug.