Closed Bug 841812 Opened 12 years ago Closed 12 years ago

Crash with removeAttribute, svg.text.css-frames.enabled

Categories

(Core :: SVG, defect)

defect
Not set
critical

Tracking

()

RESOLVED FIXED
mozilla21

People

(Reporter: jruderman, Assigned: heycam)

References

Details

(Keywords: crash, testcase)

Crash Data

Attachments

(3 files)

Attached image testcase
With: user_pref("svg.text.css-frames.enabled", true); Crash [@ nsSVGTextFrame2::MutationObserver::AttributeChanged]
Attached file stack
Blocks: svgtext
No longer blocks: 841225
Crash Signature: [@ nsSVGTextFrame2::MutationObserver::AttributeChanged] → [@ nsSVGTextFrame2::MutationObserver::AttributeChanged] [@ nsSVGTextFrame2::MutationObserver::AttributeChanged(nsIDocument*, mozilla::dom::Element*, int, nsIAtom*, int) ]
OS: Mac OS X → All
Hardware: x86_64 → All
Attached patch patchSplinter Review
The <textPath> doesn't have a frame since it is inside a non-"text content element" in the <text>.
Assignee: nobody → cam
Status: NEW → ASSIGNED
Attachment #714733 - Flags: review?(roc)
Status: ASSIGNED → RESOLVED
Closed: 12 years ago
Flags: in-testsuite+
Resolution: --- → FIXED
Target Milestone: --- → mozilla21
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: