713413 - "ASSERTION: null nsSVGPathGeometry frame" and crash

Status: RESOLVED FIXED

(Core :: SVG, defect)

Description

[Jesse Ruderman]

Attachment: testcase (crashes Firefox when loaded)

###!!! ASSERTION: null nsSVGPathGeometry frame: 'mMarkedFrame', file layout/svg/base/src/nsSVGMarkerFrame.cpp, line 104

Crash [@ nsSVGMarkerFrame::GetCanvasTM]

Comment 1

[Jesse Ruderman]

Attachment: stack trace

Comment 2

[Robert Longson [:longsonr]]

Attachment: patch

Comment 3

[Daniel Holbert [:dholbert]]

Comment on attachment 584335 [details] [diff] [review]
patch

Makes sense. It'd be nice to have a comment explaining this chunk, e.g.
> // No need to invalidate on first reflow - that will happen elsewhere.
> // (Moreover, we don't know our bounds yet, so we don't know what to invalidate.)

(assuming that that's true)

Comment 4

[Daniel Holbert [:dholbert]]

er, s/on first reflow/before first reflow/

Comment 5

[Robert Longson [:longsonr]]

pushed https://hg.mozilla.org/integration/mozilla-inbound/rev/29b864db2073

Comment 6

[Daniel Holbert [:dholbert]]

Note: I've backed out the patch that regressed this from aurora (in bug 708155 comment 12), so now mozilla12 (current trunk) is the only version to be affected by this bug.  (and it'll be fixed there once comment 5 is merged to m-c)

Comment 7

[Kyle Huey (Exited; not receiving bugmail, old account, do not use)]

https://hg.mozilla.org/mozilla-central/rev/29b864db2073

Comment 8

[Virgil Dicu [:virgil] [QA]]

Verified using today's (19.4) beta debug build on Ubuntu 11.10. No crash/assertion occurred when loading the testcase from comment 0.