Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-11-26 14:22:01 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 620034 - "ABORT: DOM wrapper's list length is out of sync" [@ mozilla::DOMSVGNumberList::Length]. r=longsonr, a=blocking.

Browse Source
This commit is contained in:
Jonathan Watt 2011-01-03 09:26:28 +00:00
parent c7eb7f1b6c
commit 999d3260be
4 changed files with 18 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
content/svg/content/src/SVGAnimatedLengthList.cpp
View File

@ -85,7 +85,7 @@ SVGAnimatedLengthList::ClearBaseValue(PRUint32 aAttrEnum)
DOMSVGAnimatedLengthList::GetDOMWrapperIfExists(this);
if (domWrapper) {
// We must send this notification *before* changing mBaseVal! (See above.)
domWrapper->InternalAnimValListWillChangeTo(SVGLengthList());
domWrapper->InternalBaseValListWillChangeTo(SVGLengthList());
}
mBaseVal.Clear();
// Caller notifies

2
content/svg/content/src/SVGAnimatedNumberList.cpp
View File

@ -85,7 +85,7 @@ SVGAnimatedNumberList::ClearBaseValue(PRUint32 aAttrEnum)
DOMSVGAnimatedNumberList::GetDOMWrapperIfExists(this);
if (domWrapper) {
// We must send this notification *before* changing mBaseVal! (See above.)
domWrapper->InternalAnimValListWillChangeTo(SVGNumberList());
domWrapper->InternalBaseValListWillChangeTo(SVGNumberList());
}
mBaseVal.Clear();
// Caller notifies

15
layout/svg/crashtests/620034-1.html Normal file
View File

@ -0,0 +1,15 @@
<!DOCTYPE html>
<script>
function boom()
{
var f = document.createElementNS("http://www.w3.org/2000/svg", "feFuncB");
var tvb = f.tableValues.baseVal;
f.setAttribute("tableValues", "3 7 5");
f.setAttribute("tableValues", "i");
tvb.numberOfItems;
}
boom();
</script>

1
layout/svg/crashtests/crashtests.list
View File

@ -101,5 +101,6 @@ load 610594-1.html
load 610954-1.html
load 612662-1.svg
load 612662-2.svg
load 620034-1.html
load 621598-1.svg