Closed Bug 841812 Opened 7 years ago Closed 7 years ago

Crash with removeAttribute, svg.text.css-frames.enabled

Categories

(Core :: SVG, defect, critical)

defect
Not set
critical

Tracking

()

RESOLVED FIXED
mozilla21

People

(Reporter: jruderman, Assigned: heycam)

References

(Blocks 1 open bug)

Details

(Keywords: crash, testcase)

Crash Data

Attachments

(3 files)

Attached image testcase
With:
  user_pref("svg.text.css-frames.enabled", true);

Crash [@ nsSVGTextFrame2::MutationObserver::AttributeChanged]
Attached file stack
Blocks: svgtext
No longer blocks: 841225
On Windows: bp-59c4b1af-cd24-4ac3-b749-70d672130215
Crash Signature: [@ nsSVGTextFrame2::MutationObserver::AttributeChanged] → [@ nsSVGTextFrame2::MutationObserver::AttributeChanged] [@ nsSVGTextFrame2::MutationObserver::AttributeChanged(nsIDocument*, mozilla::dom::Element*, int, nsIAtom*, int) ]
OS: Mac OS X → All
Hardware: x86_64 → All
Attached patch patchSplinter Review
The <textPath> doesn't have a frame since it is inside a non-"text content element" in the <text>.
Assignee: nobody → cam
Status: NEW → ASSIGNED
Attachment #714733 - Flags: review?(roc)
https://hg.mozilla.org/mozilla-central/rev/f0737c3c8f19
Status: ASSIGNED → RESOLVED
Closed: 7 years ago
Flags: in-testsuite+
Resolution: --- → FIXED
Target Milestone: --- → mozilla21
You need to log in before you can comment on or make changes to this bug.