Closed Bug 713413 Opened 8 years ago Closed 8 years ago

"ASSERTION: null nsSVGPathGeometry frame" and crash

Categories

(Core :: SVG, defect, critical)

defect
Not set
critical

Tracking

()

RESOLVED FIXED
mozilla12
Tracking Status
firefox11 --- unaffected
firefox12 --- verified

People

(Reporter: jruderman, Assigned: longsonr)

References

(Blocks 1 open bug)

Details

(Keywords: assertion, regression, testcase, Whiteboard: [qa+])

Crash Data

Attachments

(3 files)

###!!! ASSERTION: null nsSVGPathGeometry frame: 'mMarkedFrame', file layout/svg/base/src/nsSVGMarkerFrame.cpp, line 104

Crash [@ nsSVGMarkerFrame::GetCanvasTM]
Attached file stack trace
Attached patch patchSplinter Review
Assignee: nobody → longsonr
Attachment #584335 - Flags: review?(dholbert)
Blocks: 708155
Blocks: 713499
Keywords: regression
Comment on attachment 584335 [details] [diff] [review]
patch

Makes sense. It'd be nice to have a comment explaining this chunk, e.g.
> // No need to invalidate on first reflow - that will happen elsewhere.
> // (Moreover, we don't know our bounds yet, so we don't know what to invalidate.)

(assuming that that's true)
Attachment #584335 - Flags: review?(dholbert) → review+
er, s/on first reflow/before first reflow/
pushed https://hg.mozilla.org/integration/mozilla-inbound/rev/29b864db2073
Target Milestone: --- → mozilla12
OS: Mac OS X → All
Hardware: x86_64 → All
Note: I've backed out the patch that regressed this from aurora (in bug 708155 comment 12), so now mozilla12 (current trunk) is the only version to be affected by this bug.  (and it'll be fixed there once comment 5 is merged to m-c)
Crash Signature: [@ nsSVGMarkerFrame::GetCanvasTM] → [@ nsSVGMarkerFrame::GetCanvasTM] [@ nsSVGMarkerFrame::GetCanvasTM()]
Whiteboard: [qa+]
Verified using today's (19.4) beta debug build on Ubuntu 11.10. No crash/assertion occurred when loading the testcase from comment 0.
You need to log in before you can comment on or make changes to this bug.