384728 - [FIX]Crash [@ nsContentUtils::ContentIsDescendantOf] with CSS counters, <svg:use>

Status: RESOLVED FIXED

(Core :: SVG, defect)

Description

[Jesse Ruderman]

Attachment: testcase

###!!! ASSERTION: null check on startContent should be sufficient to null check nodeContent as well, since if nodeContent is for the root, startContent (which is before it) must be too: 'nodeContent || !startContent', file /Users/jruderman/trunk/mozilla/layout/base/nsCounterManager.cpp, line 145

###!!! ASSERTION: The possible descendant is null!: 'aPossibleDescendant', file /Users/jruderman/trunk/mozilla/content/base/src/nsContentUtils.cpp, line 1144

Crash
0  nsINode::GetNodeParent
1  nsContentUtils::ContentIsDescendantOf
2  nsCounterList::SetScope
...

The crash is similar to the crash in bug 383129.  The combination of <svg:use> and counters causing trouble reminds me of bug 380101.

Comment 1

[Boris Zbarsky [:bzbarsky]]

So in this case, startContent is nsSVGDefsElement and nodeContent is null.

In this case, the nsSVGGElement which is aNode->mPseudoFrame->GetContent() has no parent.  aNode->mPseudoFrame is an nsSVGGFrame* which DOES have a parent, which is a nsSVGUseFrame.

Sounds like perhaps nsSVGUseFrame::Destroy should destroy self before destroying the anon content, to avoid violating layout invariants...

Comment 2

[Boris Zbarsky [:bzbarsky]]

Attachment: Indeed, this fixes it

Comment 3

[Boris Zbarsky [:bzbarsky]]

Checked in.

Comment 4

[Jesse Ruderman]

Crashtest checked in.