Last Comment Bug 722003 - "ASSERTION: null nsSVGPathGeometry frame" and crash
: "ASSERTION: null nsSVGPathGeometry frame" and crash
: assertion, crash, regression, testcase
Product: Core
Classification: Components
Component: SVG (show other bugs)
: Trunk
: All All
: -- critical (vote)
: mozilla12
Assigned To: Robert Longson
: Jet Villegas (:jet)
Depends on: 591718
Blocks: 326633 343943
  Show dependency treegraph
Reported: 2012-01-27 23:54 PST by Jesse Ruderman
Modified: 2012-01-29 11:11 PST (History)
5 users (show)
longsonr: in‑testsuite+
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---

testcase (crashes Firefox when loaded) (283 bytes, image/svg+xml)
2012-01-27 23:54 PST, Jesse Ruderman
no flags Details
stack trace (6.85 KB, text/plain)
2012-01-27 23:54 PST, Jesse Ruderman
no flags Details
patch (1.88 KB, patch)
2012-01-28 06:24 PST, Robert Longson
roc: review+
Details | Diff | Splinter Review

Description Jesse Ruderman 2012-01-27 23:54:34 PST
Created attachment 592368 [details]
testcase (crashes Firefox when loaded)

###!!! ASSERTION: null nsSVGPathGeometry frame: 'mMarkedFrame', file layout/svg/base/src/nsSVGMarkerFrame.cpp, line 104

(Similar symptoms to bug 713413.)
Comment 1 Jesse Ruderman 2012-01-27 23:54:53 PST
Created attachment 592369 [details]
stack trace
Comment 2 Scoobidiver (away) 2012-01-28 00:22:03 PST
Confirmed on Windows with 32-bit and 64-bit builds.
Comment 3 Daniel Holbert [:dholbert] 2012-01-28 00:37:13 PST
Confirmed on 32-bit Linux, too.  Doesn't crash with a nightly from 2011-07-30, so this appears to be a regression since then.
Comment 4 Daniel Holbert [:dholbert] 2012-01-28 00:45:57 PST
Last good nightly: 2011-12-30
First bad nightly: 2011-12-31

Last good nightly: 2011-12-29
First bad nightly: 2011-12-30
Comment 5 Daniel Holbert [:dholbert] 2012-01-28 00:47:47 PST
There were two bugs that day that mention SVG foreignObject (which this bug's testcase uses) in their commit messages:
> baa4388f9cea	Robert O'Callahan — Bug 591718. Make getClientRects/getBoundingClientRect take transforms into account, and not treat SVG <foreignObject> as establishing a new viewport. r=mats
> 29b864db2073	Robert Longson — Bug 713413 - Fix crash when dynamically adding foreignObject as a child of non-displayed element. r=dholbert

Looks like a regression from one of those.
Comment 6 Robert Longson 2012-01-28 01:59:34 PST
It's bug 591718. Can't call GetCanvasTMForChildren if (GetStateBits() & NS_STATE_SVG_NONDISPLAY_CHILD) not sure what to return in that case though.
Comment 7 Robert O'Callahan (:roc) (email my personal email if necessary) 2012-01-28 03:28:51 PST
an all-zero matrix perhaps?
Comment 8 Robert Longson 2012-01-28 06:24:16 PST
Created attachment 592397 [details] [diff] [review]
Comment 9 Robert O'Callahan (:roc) (email my personal email if necessary) 2012-01-28 12:38:40 PST
Comment on attachment 592397 [details] [diff] [review]

Review of attachment 592397 [details] [diff] [review]:

Comment 11 Phil Ringnalda (:philor) 2012-01-29 11:11:16 PST

Note You need to log in before you can comment on or make changes to this bug.