414113 - Crash unloading SVG, with ASSERTION: invalid active window: 'Error', file mozilla/embedding/components/windowwatcher/src/nsWindowWatcher.cpp

Status: RESOLVED WORKSFORME

(Core :: SVG, defect)

Description

[Jonathan Watt [:jwatt]]

Attachment: SVG for testcase

I encountered this trying to write reftests for bug 404999. If SVG is embedded in HTML using <object> and the SVG sets the <object>'s 'data' attribute during its load event, we crash. The crash is preceded by the assertion:

  ASSERTION: invalid active window: 'Error', file
  mozilla/embedding/components/windowwatcher/src/nsWindowWatcher.cpp

before we go on to crash at the PR_ASSERT(eXMLContentSinkState_InEpilog != mState) in nsXMLContentSink::HandleStartElement here:

http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/content/xml/document/src/nsXMLContentSink.cpp&rev=1.430&mark=983#979

Comment 1

[Jonathan Watt [:jwatt]]

Attachment: testcase - LIVE CRASHER

Comment 2

[Jonathan Watt [:jwatt]]

This bug does not seem to exist in HTML, only SVG, so I'd guess it's something to do with the timing of the firing of the SVG 'load' event. Then again, I'd have thought the parser should be able to cope.

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Seems to WFM on WinXP SP3 on latest-trunk mozilla-central.

Comment 4

[Wayne Mery (:wsmwk)]

WFM per comment 3 and no objections posted. so => WFM