307308 - SVG crash [@ _cairo_image_surface_acquire_dest_image]

Status: VERIFIED FIXED

(Core :: SVG, defect)

Description

[Jesse Ruderman]

Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.9a1) Gecko/20050906
Firefox/1.6a1

Viewing http://www.carto.net/papers/svg/samples/clipmask.shtml crashes Firefox.
 Interestingly, if I open the page in a background tab, Firefox doesn't crash
until I switch to that tab.

TB9104935K

Comment 1

[tor]

Attachment: pass scratch space instead of NULL to acquite/release_dest_image

Comment 2

[Vladimir Vukicevic [:vlad] [:vladv] (needinfo me, slow to respond)]

Comment on attachment 195112 [details] [diff] [review]
pass scratch space instead of NULL to acquite/release_dest_image

r=vladimir; please get this in to cairo CVS as well.

Comment 3

[Jesse Ruderman]

http://www.carto.net/papers/svg/samples/patterns.shtml crashes in the same way.

Comment 4

[tor]

Checked in on trunk and cairo cvs.

Comment 5

[Christian :Biesinger (don't email me, ping me on IRC)]

shouldn't the release_dest_image call use extra, rather than &extra?

Comment 6

[tor]

Yes.  Fixed in trunk and cairo cvs.

Comment 7

[Asa Dotzler [:asa]]

Comment on attachment 195112 [details] [diff] [review]
pass scratch space instead of NULL to acquite/release_dest_image

Lockdown for beta one happened last night and we've got candidates in hand so
this will need to wait until first thing in beta two.

Comment 8

[tor]

Checked in on branch.

Comment 9

[Jesse Ruderman]

Verified fixed on the Gecko 1.8 branch: Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.8) Gecko/20051108 Firefox/1.5.