628794 - Crash [@ nsIDOMElementCSSInlineStyle_GetStyle], SVG element with HTML __proto__

Status: RESOLVED FIXED

(Core :: XPConnect, defect, P1)

Description

[Jesse Ruderman]

Attachment: testcase (crashes Firefox when loaded)

Like bug 585745, but with SVG instead of MathML.

Comment 1

[Jesse Ruderman]

Only crashes in debug builds.

Comment 2

[Boris Zbarsky [:bzbarsky]]

Ugh.  I hate JS....  peter, _this_ one we could solve by having a separate base class that SVG inherits from that doesn't include GetStyle and casting to that class here (MathML, HTML, XUL would all still inherit from it).  Or I could expand the namespace check to exclude SVG.  Preferences?

Comment 3

[Peter Van der Beken [:peterv]]

I'm starting to remember why I didn't use custom unwrapping for GetStyle :-(. I'd personally go with the separate base class, but both options are fine.

Comment 4

[Johnny Stenback (:jst)]

Not blocking on this at this late of a point in the release. But I'd approve a safe fix.

Comment 5

[Boris Zbarsky [:bzbarsky]]

Attachment: SVG and HTML/XUL .style come from different interfaces.

Comment 6

[Peter Van der Beken [:peterv]]

Comment on attachment 515739 [details] [diff] [review]
SVG and HTML/XUL .style come from different interfaces.

The other option is to leave nsStyledElement as is, and name the new class nsStyledElementWithElementCSSInlineStyle.

Comment 7

[Boris Zbarsky [:bzbarsky]]

http://hg.mozilla.org/projects/cedar/rev/258a0f209565

Comment 8

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 515739 [details] [diff] [review]
SVG and HTML/XUL .style come from different interfaces.

We should probably land this crash fix on 2.0.x too.

Comment 9

[(no longer active)]

http://hg.mozilla.org/mozilla-central/rev/258a0f209565