378771 - Crash [@ nsSVGMarkerFrame::GetCanvasTM] when clicking in document with foreignObject in marker and caret browsing on

Status: VERIFIED FIXED

(Core :: SVG, defect)

Description

[Martijn Wargers (dead)]

Attachment: testcase

See testcase, when clicking somewhere in the testcase, Mozilla crashes. You need to have caret browsing turned on.

Talkback ID: TB31533598M
nsSVGMarkerFrame::GetCanvasTM  [mozilla/layout/svg/base/src/nssvgmarkerframe.cpp, line 105]
nsSVGForeignObjectFrame::GetCanvasTM  [mozilla/layout/svg/base/src/nssvgforeignobjectframe.cpp, line 455]
nsSVGForeignObjectFrame::GetTMIncludingOffset  [mozilla/layout/svg/base/src/nssvgforeignobjectframe.cpp, line 423]
nsSVGForeignObjectFrame::FlushDirtyRegion  [mozilla/layout/svg/base/src/nssvgforeignobjectframe.cpp, line 606]
nsSVGForeignObjectFrame::InvalidateInternal  [mozilla/layout/svg/base/src/nssvgforeignobjectframe.cpp, line 621]
nsIFrame::Invalidate  [mozilla/layout/generic/nsframe.cpp, line 3703]
nsCaret::InvalidateRects  [mozilla/layout/base/nscaret.cpp, line 1124]
nsCaret::DrawAtPositionWithHint  [mozilla/layout/base/nscaret.cpp, line 624]
nsCaret::DrawCaret  [mozilla/layout/base/nscaret.cpp, line 984]
nsCaret::StartBlinking  [mozilla/layout/base/nscaret.cpp, line 553]
nsEventStateManager::SetContentCaretVisible  [mozilla/content/events/src/nseventstatemanager.cpp, line 5081]
nsEventStateManager::ResetBrowseWithCaret  [mozilla/content/events/src/nseventstatemanager.cpp, line 5137]
nsEventStateManager::PreHandleEvent  [mozilla/content/events/src/nseventstatemanager.cpp, line 890]
0x0012eec4
0x0012eca4
table
nsXPLookAndFeel::AddRef  [mozilla/widget/src/xpwidgets/nsxplookandfeel.cpp, line 53]
0x08244c8b

Comment 1

[tor]

Attachment: another nondisplay child test

Comment 2

[tor]

Checked in.

Comment 3

[Martijn Wargers (dead)]

Verified fixed, using:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a4pre) Gecko/20070427 Minefield/3.0a4pre