722003 - "ASSERTION: null nsSVGPathGeometry frame" and crash

Status: RESOLVED FIXED

(Core :: SVG, defect)

Description

[Jesse Ruderman]

Attachment: testcase (crashes Firefox when loaded)

###!!! ASSERTION: null nsSVGPathGeometry frame: 'mMarkedFrame', file layout/svg/base/src/nsSVGMarkerFrame.cpp, line 104

(Similar symptoms to bug 713413.)

Comment 1

[Jesse Ruderman]

Attachment: stack trace

Comment 2

[Scoobidiver (away)]

Confirmed on Windows with 32-bit and 64-bit builds.

Comment 3

[Daniel Holbert [:dholbert]]

Confirmed on 32-bit Linux, too.  Doesn't crash with a nightly from 2011-07-30, so this appears to be a regression since then.

Comment 4

[Daniel Holbert [:dholbert]]

ON MOZILLA-CENTRAL:
Last good nightly: 2011-12-30
First bad nightly: 2011-12-31
Pushlog:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=1d0a814ebf12&tochange=f268da52217d

ON MOZILLA-INBOUND:
Last good nightly: 2011-12-29
First bad nightly: 2011-12-30
Pushlog:
http://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=6d443ec0dda1&tochange=26acd30cab90

Comment 5

[Daniel Holbert [:dholbert]]

There were two bugs that day that mention SVG foreignObject (which this bug's testcase uses) in their commit messages:
> baa4388f9cea	Robert O'Callahan — Bug 591718. Make getClientRects/getBoundingClientRect take transforms into account, and not treat SVG <foreignObject> as establishing a new viewport. r=mats
> 29b864db2073	Robert Longson — Bug 713413 - Fix crash when dynamically adding foreignObject as a child of non-displayed element. r=dholbert

Looks like a regression from one of those.

Comment 6

[Robert Longson [:longsonr]]

It's bug 591718. Can't call GetCanvasTMForChildren if (GetStateBits() & NS_STATE_SVG_NONDISPLAY_CHILD) not sure what to return in that case though.

Comment 7

[Robert O'Callahan (:roc) (email my personal email if necessary)]

an all-zero matrix perhaps?

Comment 8

[Robert Longson [:longsonr]]

Attachment: patch

Comment 9

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Comment on attachment 592397 [details] [diff] [review]
patch

Review of attachment 592397 [details] [diff] [review]:
-----------------------------------------------------------------

thanks!

Comment 10

[Robert Longson [:longsonr]]

pushed https://hg.mozilla.org/integration/mozilla-inbound/rev/8b7bae91f349

Comment 11

[Phil Ringnalda (:philor)]

https://hg.mozilla.org/mozilla-central/rev/8b7bae91f349