485544 - [SMIL] crash visiting page [@ nsGenericElement::FindAttrValueIn(int, nsIAtom*, nsIAtom* const* const*, nsCaseTreatment) ]

Status: RESOLVED FIXED

(Core :: SVG, defect)

Description

[Peter van der Woude [:Peter6]]

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2a1pre) Gecko/20090327 Minefield/3.6a1pre ID:20090327061159

SMIL enabled (svg.smil.enabled is true)

repro:
open FF
open url

result:
crash
http://crash-stats.mozilla.com/report/index/fee8dfc0-c7b9-4250-b044-d6d602090327
http://crash-stats.mozilla.com/report/index/414a5c36-fd36-4962-a727-127262090327?p=1

Comment 1

[Marco Perez [:mpk]]

WFM here. Well, at least my build doesn't crash. But it won't display the
red square either. Test animate-elem-22-b works fine. My build (on FreeBSD)
is:
Mozilla/5.0 (X11; U; FreeBSD i386; en-US; rv:1.9.2a1pre) Gecko/20090327 Minefield/3.6a1pre

Comment 2

[(mostly gone) XtC4UaLL [:xtc4uall]]

Signature	nsGenericElement::FindAttrValueIn(int, nsIAtom*, nsIAtom* const* const*, nsCaseTreatment)
UUID	fee8dfc0-c7b9-4250-b044-d6d602090327
Time 	2009-03-27 09:25:42.926382
Uptime	15
Last Crash	166500 seconds before submission
Product	Firefox
Version	3.6a1pre
Build ID	20090327061159
Branch	1.9.2
OS	Windows NT
OS Version	5.1.2600 Service Pack 3
CPU	x86
CPU Info	GenuineIntel family 6 model 15 stepping 6
Crash Reason	EXCEPTION_ACCESS_VIOLATION
Crash Address	0x1
Frame 	Module 	Signature 	Source
0 	xul.dll 	nsGenericElement::FindAttrValueIn(int,nsIAtom*,nsIAtom* const* const*,nsCaseTreatment) 	content/base/src/nsGenericElement.cpp:4523
1 	xul.dll 	nsSVGAnimationElement::GetTargetAttributeType() 	content/svg/content/src/nsSVGAnimationElement.cpp:141
2 	xul.dll 	nsSMILAnimationController::GetCompositorKeyForAnimation(nsISMILAnimationElement*,nsSMILCompositorKey&) 	content/smil/nsSMILAnimationController.cpp:446
3 	xul.dll 	nsSMILAnimationController::AddAnimationToCompositorTable(nsISMILAnimationElement*,nsTHashtable<nsSMILCompositor>*) 	content/smil/nsSMILAnimationController.cpp:411
4 	xul.dll 	nsSMILAnimationController::SampleAnimation(nsPtrHashKey<nsISMILAnimationElement>*,void*) 	content/smil/nsSMILAnimationController.cpp:375
5 	xul.dll 	nsTHashtable<nsIdentifierMapEntry::ChangeCallbackEntry>::s_EnumStub(PLDHashTable*,PLDHashEntryHdr*,unsigned int,void*) 	obj-firefox/dist/include/xpcom/nsTHashtable.h:420
6 	xul.dll 	PL_DHashTableEnumerate 	obj-firefox/xpcom/build/pldhash.c:754
7 	xul.dll 	nsTHashtable<nsPtrHashKey<nsISMILAnimationElement> >::EnumerateEntries(PLDHashOperator (*)(nsPtrHashKey<nsISMILAnimationElement>*,void*),void*) 	obj-firefox/dist/include/xpcom/nsTHashtable.h:241
8 	xul.dll 	nsSMILAnimationController::DoSample(int) 	content/smil/nsSMILAnimationController.cpp:317
9 	xul.dll 	nsSMILAnimationController::FlushResampleRequests() 	obj-firefox/dist/include/content/nsSMILAnimationController.h:92
10 	xul.dll 	nsSVGElement::FlushAnimations() 	content/svg/content/src/nsSVGElement.cpp:1696
11 	xul.dll 	nsSVGElement::GetAnimatedLengthValues(float*,...) 	content/svg/content/src/nsSVGElement.cpp:1206
12 	xul.dll 	nsSVGCircleElement::ConstructPath(gfxContext*) 	content/svg/content/src/nsSVGCircleElement.cpp:153
13 	xul.dll 	nsSVGPathGeometryFrame::UpdateCoveredRegion() 	layout/svg/base/src/nsSVGPathGeometryFrame.cpp:251
14 	xul.dll 	nsSVGOuterSVGFrame::UpdateAndInvalidateCoveredRegion(nsIFrame*) 	layout/svg/base/src/nsSVGOuterSVGFrame.cpp:650
15 	xul.dll 	nsSVGUtils::UpdateGraphic(nsISVGChildFrame*) 	layout/svg/base/src/nsSVGUtils.cpp:594
16 	xul.dll 	nsSVGPathGeometryFrame::NotifyRedrawUnsuspended() 	layout/svg/base/src/nsSVGPathGeometryFrame.cpp:316
17 	xul.dll 	nsSVGDisplayContainerFrame::NotifyRedrawUnsuspended() 	layout/svg/base/src/nsSVGContainerFrame.cpp:252
18 	xul.dll 	nsSVGOuterSVGFrame::UnsuspendRedraw() 	layout/svg/base/src/nsSVGOuterSVGFrame.cpp:704
19 	xul.dll 	nsSVGOuterSVGFrame::DidReflow(nsPresContext*,nsHTMLReflowState const*,int) 	layout/svg/base/src/nsSVGOuterSVGFrame.cpp:411
20 	xul.dll 	nsContainerFrame::FinishReflowChild(nsIFrame*,nsPresContext*,nsHTMLReflowState const*,nsHTMLReflowMetrics const&,int,int,unsigned int) 	layout/generic/nsContainerFrame.cpp:935
21 	xul.dll 	CanvasFrame::Reflow(nsPresContext*,nsHTMLReflowMetrics&,nsHTMLReflowState const&,unsigned int&) 	layout/generic/nsHTMLFrame.cpp:660
22 	xul.dll 	nsContainerFrame::ReflowChild(nsIFrame*,nsPresContext*,nsHTMLReflowMetrics&,nsHTMLReflowState const&,int,int,unsigned int,unsigned int&,nsOverflowContinuationTracker*) 	layout/generic/nsContainerFrame.cpp:821
23 	xul.dll 	nsIFrame::IntrinsicSize::IntrinsicSize() 	layout/generic/nsIFrame.h:1305
24 	xul.dll 	SearchTable 	obj-firefox/xpcom/build/pldhash.c:472
25 		@0x545f

Comment 3

[Robert Longson [:longsonr]]

Attachment: patch

Comment 4

[Jonathan Watt [:jwatt]]

Comment on attachment 369815 [details] [diff] [review]
patch

r=jwatt

The push rules have changed - you only need one review in general now, so you're good to push.

Comment 5

[Robert Longson [:longsonr]]

checked in http://hg.mozilla.org/mozilla-central/rev/b2f58d805964