563481 - "ASSERTION: Want to fire mutation events, but it's not safe" with <svg:use>, <svg:symbol>

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect, P5)

Description

[Jesse Ruderman]

content/svg/content/src/crashtests/307322-1.svg triggers

###!!! ASSERTION: Want to fire mutation events, but it's not safe: '(aNode->IsNodeOfType(nsINode::eCONTENT) && static_cast<nsIContent*>(aNode)-> IsInNativeAnonymousSubtree()) || sScriptBlockerCount == sRemovableScriptBlockerCount', file /Users/jruderman/central/content/base/src/nsContentUtils.cpp, line 3537

This assertion was added in bug 429175.

Comment 1

[Jesse Ruderman]

Attachment: stack trace

Comment 4

[Timothy Nikkel (:tnikkel)]

SVG use cloned content is pretty much native anonymous except in nsCSSFrameConstructor::GetAnonymousContent we don't set the native anonymous flags, which is probably what's causing the assertion to fire.

Comment 5

[(not currently active) Ted Mielczarek]

This is showing up on the 64-bit OS X tinderbox:
http://tinderbox.mozilla.org/showlog.cgi?log=Firefox/1273150994.1273154478.14600.gz
OS X 10.6.2 mozilla-central leak test build on 2010/05/06 06:03:14

Comment 6

[Jesse Ruderman]

Based on the stack trace, that's bug 563491, not this bug.

Comment 7

[(not currently active) Ted Mielczarek]

Thanks. Couldn't find that bug because I'm not s-g. :-/

Comment 8

[Daniel Holbert [:dholbert]]

Attachment: testcase

Here's a reduced testcase (a bit simpler than 307322-1.svg -- doesn't have any recursive <use>) that triggers this assertion failure in current mozilla-central.

It seems specific to <symbol>; if the <use>-target is something other than <symbol> (like a <g> for example), the assertion-failure goes away.

Comment 9

[Firefox Bug Husbandry Bot]

https://bugzilla.mozilla.org/show_bug.cgi?id=1472046

Move all DOM bugs that haven’t been updated in more than 3 years and has no one currently assigned to P5.

If you have questions, please contact :mdaly.

Comment 10

[Robert Longson [:longsonr]]

The testcase doesn't seem to fire any assertions now. Do you want to check it in and close this Daniel?

Comment 11

[Robert Longson [:longsonr]]

Should be able to change https://dxr.mozilla.org/mozilla-central/source/dom/svg/crashtests/crashtests.list to remove the asserts(0-6) I think.

Comment 12

[Daniel Holbert [:dholbert]]

Indeed, nice catch!  Sure, I'll make that manifest tweak and close this out.

Comment 13

[Daniel Holbert [:dholbert]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/0fa0dde9256b4b47d313e70d8f227ae19cbffd82

Comment 14

[Raul Gurzau (:RaulG)]

https://hg.mozilla.org/mozilla-central/rev/0fa0dde9256b