"ASSERTION: null nsSVGPathGeometry frame" and crash

RESOLVED FIXED in Firefox 12

Status

()

--
critical
RESOLVED FIXED
7 years ago
7 years ago

People

(Reporter: jruderman, Assigned: longsonr)

Tracking

(Blocks: 1 bug, {assertion, regression, testcase})

Trunk
mozilla12
assertion, regression, testcase
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(firefox11 unaffected, firefox12 verified)

Details

(Whiteboard: [qa+], crash signature)

Attachments

(3 attachments)

(Reporter)

Description

7 years ago
Created attachment 584236 [details]
testcase (crashes Firefox when loaded)

###!!! ASSERTION: null nsSVGPathGeometry frame: 'mMarkedFrame', file layout/svg/base/src/nsSVGMarkerFrame.cpp, line 104

Crash [@ nsSVGMarkerFrame::GetCanvasTM]
(Reporter)

Comment 1

7 years ago
Created attachment 584237 [details]
stack trace
(Assignee)

Comment 2

7 years ago
Created attachment 584335 [details] [diff] [review]
patch
Assignee: nobody → longsonr
Attachment #584335 - Flags: review?(dholbert)
(Assignee)

Updated

7 years ago
Blocks: 708155
(Assignee)

Updated

7 years ago
Blocks: 713499
(Assignee)

Updated

7 years ago
Keywords: regression
Comment on attachment 584335 [details] [diff] [review]
patch

Makes sense. It'd be nice to have a comment explaining this chunk, e.g.
> // No need to invalidate on first reflow - that will happen elsewhere.
> // (Moreover, we don't know our bounds yet, so we don't know what to invalidate.)

(assuming that that's true)
Attachment #584335 - Flags: review?(dholbert) → review+
er, s/on first reflow/before first reflow/
(Assignee)

Comment 5

7 years ago
pushed https://hg.mozilla.org/integration/mozilla-inbound/rev/29b864db2073
Target Milestone: --- → mozilla12
OS: Mac OS X → All
Hardware: x86_64 → All
Note: I've backed out the patch that regressed this from aurora (in bug 708155 comment 12), so now mozilla12 (current trunk) is the only version to be affected by this bug.  (and it'll be fixed there once comment 5 is merged to m-c)
status-firefox11: --- → unaffected
https://hg.mozilla.org/mozilla-central/rev/29b864db2073
Status: NEW → RESOLVED
Last Resolved: 7 years ago
Resolution: --- → FIXED
status-firefox12: --- → fixed

Updated

7 years ago
Crash Signature: [@ nsSVGMarkerFrame::GetCanvasTM] → [@ nsSVGMarkerFrame::GetCanvasTM] [@ nsSVGMarkerFrame::GetCanvasTM()]
Whiteboard: [qa+]
Verified using today's (19.4) beta debug build on Ubuntu 11.10. No crash/assertion occurred when loading the testcase from comment 0.
status-firefox12: fixed → verified
You need to log in before you can comment on or make changes to this bug.