Bug 269891 - crash in stroke-dasharray sharing. r+sr=bzbarsky

content/base/src/nsRuleNode.cpp

@@ -1229,7 +1229,9 @@ nsRuleNode::GetSVGData(nsStyleContext* aContext)
   nsRuleData ruleData(eStyleStruct_SVG, mPresContext, aContext);
   ruleData.mSVGData = &svgData;
 
-  return WalkRuleTree(eStyleStruct_SVG, aContext, &ruleData, &svgData);
+  const nsStyleStruct *res = WalkRuleTree(eStyleStruct_SVG, aContext, &ruleData, &svgData);
+  svgData.mStrokeDasharray = nsnull; // We are sharing with some style rule.  It really owns the data.
+  return res;
 }
 
 const nsStyleStruct*

content/html/style/src/nsCSSStruct.cpp

@@ -1213,7 +1213,7 @@ nsCSSSVG::nsCSSSVG(const nsCSSSVG& aCopy)
       mStopColor(aCopy.mStopColor),
       mStopOpacity(aCopy.mStopOpacity),
       mStroke(aCopy.mStroke),
-      mStrokeDasharray(aCopy.mStrokeDasharray),
+      mStrokeDasharray(nsnull),
       mStrokeDashoffset(aCopy.mStrokeDashoffset),
       mStrokeLinecap(aCopy.mStrokeLinecap),
       mStrokeLinejoin(aCopy.mStrokeLinejoin),

layout/style/nsCSSStruct.cpp

@@ -1213,7 +1213,7 @@ nsCSSSVG::nsCSSSVG(const nsCSSSVG& aCopy)
       mStopColor(aCopy.mStopColor),
       mStopOpacity(aCopy.mStopOpacity),
       mStroke(aCopy.mStroke),
-      mStrokeDasharray(aCopy.mStrokeDasharray),
+      mStrokeDasharray(nsnull),
       mStrokeDashoffset(aCopy.mStrokeDashoffset),
       mStrokeLinecap(aCopy.mStrokeLinecap),
       mStrokeLinejoin(aCopy.mStrokeLinejoin),

layout/style/nsRuleNode.cpp

@@ -1229,7 +1229,9 @@ nsRuleNode::GetSVGData(nsStyleContext* aContext)
   nsRuleData ruleData(eStyleStruct_SVG, mPresContext, aContext);
   ruleData.mSVGData = &svgData;
 
-  return WalkRuleTree(eStyleStruct_SVG, aContext, &ruleData, &svgData);
+  const nsStyleStruct *res = WalkRuleTree(eStyleStruct_SVG, aContext, &ruleData, &svgData);
+  svgData.mStrokeDasharray = nsnull; // We are sharing with some style rule.  It really owns the data.
+  return res;
 }
 
 const nsStyleStruct*