535403 - Crash with SMIL & XMLHttpRequest at the same time [@ GetPresContextForElement ]

Status: RESOLVED FIXED

(Core :: SVG, defect)

Description

[Marek Raida]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.3a1pre) Gecko/20091216 Minefield/3.7a1pre
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.3a1pre) Gecko/20091216 Minefield/3.7a1pre

Almost 100%ly sure crash when SVG document loaded + SMIL animations + XMLHttpRequest running

Example crash ID & StactTrace
http://crash-stats.mozilla.com/report/index/bp-6a2df6f8-f954-448c-8b43-321f52091216

0  	xul.dll  	GetPresContextForElement  	 content/smil/nsSMILCSSValueType.cpp:298
1 	xul.dll 	nsSMILCSSValueType::ValueFromString 	content/smil/nsSMILCSSValueType.cpp:312
2 	xul.dll 	nsSMILCSSProperty::GetBaseValue 	content/smil/nsSMILCSSProperty.cpp:117
3 	xul.dll 	nsSMILAnimationFunction::WillReplace 	content/smil/nsSMILAnimationFunction.cpp:347
4 	xul.dll 	nsSMILCompositor::ComposeAttribute 	content/smil/nsSMILCompositor.cpp:157

Does NOT happen when     svg.smil.enabled = false

Reproducible: Always

Steps to Reproduce:
1. Open given URL http://localhost/cavern/090/cavern.svg
2. If browser is still running, try to reload page several times
3. It crashes for me in 9 from 10 cases
Actual Results:  
browser crash

Expected Results:  
browser running

Comment 1

[Daniel Holbert [:dholbert]]

(In reply to comment #0)
> 1. Open given URL http://localhost/cavern/090/cavern.svg

I think you mean http://svg.kvalitne.cz/cavern/090/cavern.svg  :)

I just reproduced this, loading that URL, and then reloading while it was still loading. --> Crash.

Comment 2

[Daniel Holbert [:dholbert]]

I think the patch that I just posted on Bug 535004 fixes this bug, too.

Comment 3

[Daniel Holbert [:dholbert]]

Here's a crash report for this crash on my Linux machine:
http://crash-stats.mozilla.com/report/index/1e05a51a-ed32-4eca-9a90-cb8cb2091216

Comment 4

[Daniel Holbert [:dholbert]]

(In reply to comment #2)
> I think the patch that I just posted on Bug 535004 fixes this bug, too.

Actually, this crash here is on a null document pointer, not a null window pointer -- I get this message in a debug build:
{
###!!! ABORT: any target element that's actively being animated must be in a document: 'doc', file ../../../mozilla/content/smil/nsSMILCSSProperty.cpp, line 59
}

I think my patch in bug 534975 fixes this issue, though.

Comment 5

[Daniel Holbert [:dholbert]]

(In reply to comment #4)
> I think my patch in bug 534975 fixes this issue, though.

Landed that patch last week, and this indeed appears fixed in today's nightly:
Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.3a1pre) Gecko/20091228 Minefield/3.7a1pre

Resolving.