The default bug view has changed. See this FAQ.

"ASSERTION: null nsSVGPathGeometry frame" and crash

RESOLVED FIXED in mozilla12

Status

()

Core
SVG
--
critical
RESOLVED FIXED
5 years ago
5 years ago

People

(Reporter: Jesse Ruderman, Assigned: Robert Longson)

Tracking

(Blocks: 2 bugs, 4 keywords)

Trunk
mozilla12
assertion, crash, regression, testcase
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

(crash signature)

Attachments

(3 attachments)

(Reporter)

Description

5 years ago
Created attachment 592368 [details]
testcase (crashes Firefox when loaded)

###!!! ASSERTION: null nsSVGPathGeometry frame: 'mMarkedFrame', file layout/svg/base/src/nsSVGMarkerFrame.cpp, line 104

(Similar symptoms to bug 713413.)
(Reporter)

Comment 1

5 years ago
Created attachment 592369 [details]
stack trace

Comment 2

5 years ago
Confirmed on Windows with 32-bit and 64-bit builds.
Crash Signature: [@ nsSVGMarkerFrame::GetCanvasTM] [@ nsSVGMarkerFrame::GetCanvasTM()]
OS: Mac OS X → All
Hardware: x86_64 → All
Confirmed on 32-bit Linux, too.  Doesn't crash with a nightly from 2011-07-30, so this appears to be a regression since then.
Keywords: regression
ON MOZILLA-CENTRAL:
Last good nightly: 2011-12-30
First bad nightly: 2011-12-31
Pushlog:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=1d0a814ebf12&tochange=f268da52217d

ON MOZILLA-INBOUND:
Last good nightly: 2011-12-29
First bad nightly: 2011-12-30
Pushlog:
http://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=6d443ec0dda1&tochange=26acd30cab90
There were two bugs that day that mention SVG foreignObject (which this bug's testcase uses) in their commit messages:
> baa4388f9cea	Robert O'Callahan — Bug 591718. Make getClientRects/getBoundingClientRect take transforms into account, and not treat SVG <foreignObject> as establishing a new viewport. r=mats
> 29b864db2073	Robert Longson — Bug 713413 - Fix crash when dynamically adding foreignObject as a child of non-displayed element. r=dholbert

Looks like a regression from one of those.
(Assignee)

Comment 6

5 years ago
It's bug 591718. Can't call GetCanvasTMForChildren if (GetStateBits() & NS_STATE_SVG_NONDISPLAY_CHILD) not sure what to return in that case though.
Depends on: 591718
an all-zero matrix perhaps?
(Assignee)

Comment 8

5 years ago
Created attachment 592397 [details] [diff] [review]
patch
Assignee: nobody → longsonr
Attachment #592397 - Flags: review?(roc)
Comment on attachment 592397 [details] [diff] [review]
patch

Review of attachment 592397 [details] [diff] [review]:
-----------------------------------------------------------------

thanks!
Attachment #592397 - Flags: review?(roc) → review+
(Assignee)

Comment 10

5 years ago
pushed https://hg.mozilla.org/integration/mozilla-inbound/rev/8b7bae91f349
Flags: in-testsuite+
Target Milestone: --- → mozilla12
https://hg.mozilla.org/mozilla-central/rev/8b7bae91f349
Status: NEW → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.