459759 - Crash [@ nsSVGMarkerFrame::GetCanvasTM]

Status: VERIFIED FIXED

(Core :: SVG, defect)

Description

[Jesse Ruderman]

Attachment: testcase (crashes Firefox when loaded)

###!!! ASSERTION: null nsSVGPathGeometry frame: 'mMarkedFrame', file layout/svg/base/src/nsSVGMarkerFrame.cpp, line 112

Crash [@ nsSVGMarkerFrame::GetCanvasTM] (nsSVGMarkerFrame.cpp:114)

Comment 1

[Boris Zbarsky [:bzbarsky]]

I don't see how we can possibly assert that mMarkedFrame is non-null here.  What's making sure it is?

Comment 2

[Robert Longson [:longsonr]]

Attachment: patch

The assert is valid, we need to protect ourselves from trying to determine the covered region of something that isn't drawn directly like the contents of a marker.

Comment 3

[Robert Longson [:longsonr]]

checked in 17e8145c4996

Comment 4

[Marcia Knous [:marcia]]

verified fixed using Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.1b2pre) Gecko/20081017 Minefield/3.1b2pre and  Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1b2pre) Gecko/20081017 Minefield/3.1b2pre.

Comment 5

[Marcia Knous [:marcia]]

verified fixed on the 1.9.1 branch using Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.1b3pre) Gecko/20090106 Shiretoko/3.1b3pre and the equivalent Mac build. adding verified keyword.