413174 - Crash [@ nsContentUtils::ContentIsDescendantOf] with <svg:use>, counters

Status: RESOLVED WORKSFORME

(Core :: SVG, defect)

Description

[Jesse Ruderman]

Attachment: testcase (crashes Firefox when loaded)

This crash looks similar to the crash in bug 384728.  In fact, this testcase is based on the crashtest for bug 384728.

###!!! ASSERTION: no common ancestor at all???: 'parent', file /Users/jruderman/trunk/mozilla/layout/base/nsLayoutUtils.cpp, line 358

###!!! ASSERTION: same content, different frames: 'cmp != 0', file /Users/jruderman/trunk/mozilla/layout/base/nsGenConList.cpp, line 140

###!!! ASSERTION: sorting error: 'IsLast(aNode) || NodeAfter(Next(aNode), aNode)', file /Users/jruderman/trunk/mozilla/layout/base/nsGenConList.cpp, line 198

###!!! ASSERTION: null check on startContent should be sufficient to null check nodeContent as well, since if nodeContent is for the root, startContent (which is before it) must be too: 'nodeContent || !startContent', file /Users/jruderman/trunk/mozilla/layout/base/nsCounterManager.cpp, line 145

###!!! ASSERTION: The possible descendant is null!: 'aPossibleDescendant', file /Users/jruderman/trunk/mozilla/content/base/src/nsContentUtils.cpp, line 1255

Crash in nsINode::GetNodeParent called by nsContentUtils::ContentIsDescendantOf.

Comment 1

[Boris Zbarsky [:bzbarsky]]

Someone who understands the svg:use setup will have to debug this one...  I'm not going to be able to look into this until May.

Comment 2

[Jonathan Watt [:jwatt]]

Attachment: testcase, tidied slightly

Comment 3

[Jesse Ruderman]

WFM on trunk.