298914 - [mac] Firefox crashing while trying to view http://www.opera.com/features/svg/index.dml

Status: RESOLVED FIXED

(Core :: SVG, defect)

Description

[Frederic Bezies]

User-Agent:       Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.8b2) Gecko/20050627 Firefox/1.0+
Build Identifier: Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.8b2) Gecko/20050627 Firefox/1.0+

Simple. Go to http://www.opera.com/features/svg/index.dml (Opera SVG sample
page), and try to see it...

Talkback sent : 7020422X

Reproducible: Always

Steps to Reproduce:
1.Go to http://www.opera.com/features/svg/index.dml

Actual Results:  
Crashing.

Expected Results:  
Viewing page.

SVG will be a "die-hard" feature for firefox 1.1... Seeing firefox crashing on a
SVG enabled page is sad :(

Comment 1

[Ria Klaassen (not reading all bugmail)]

WFM on WinXP.

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8b2) Gecko/20050627
Firefox/1.0+ ID:2005062701

Comment 2

[Frederic Bezies]

So, it seems to be a mac only bug ?

Tweaking summary.

Comment 3

[Frank Wein [:mcsmurf]]

The talkback stack looks useless :/, looks like symbols are missing. But for
Mac-only would speak this (from the stacktrace):
QD.186.0.0 + 0x36fa4 (0x916d0fa4)
QD.186.0.0 + 0x39df4 (0x916d3df4)
firefox-bin + 0x869d30 (0x00869d30)
[...]

I assume QD stands for Carbon QuickDraw here?

Comment 4

[jhp (no longer active)]

I can confirm on Mac OS X 10.3 with latest trunk.  Here is the top of the stack:
Thread 0 Crashed:
0   <<00000000>> 	0x91669fbc 0 + 0x91669fbc
1   <<00000000>> 	0x91669c04 0 + 0x91669c04
2   libgklayout.dylib     	0x1dc509d0 _cairo_atsui_font_text_to_glyphs + 0x124
(cairo-atsui-font.c:288)
3   libgklayout.dylib     	0x1dc3a840 _cairo_scaled_font_text_to_glyphs + 0x4c
(cairo-font.c:760)
4   libgklayout.dylib     	0x1dc237ac _cairo_gstate_text_to_glyphs + 0x6c
(cairo-gstate.c:1958)
5   libgklayout.dylib     	0x1dc11d8c cairo_text_extents + 0x140 (cairo.c:1711)
6   libgklayout.dylib     	0x1dc0a428 nsSVGCairoGlyphMetrics::Update(unsigned
int, int*) + 0x104 (nsSVGCairoGlyphMetrics.cpp:293)
7   libgklayout.dylib     	0x1db79dc4
nsSVGGlyphFrame::NotifyMetricsUnsuspended() + 0xc0 (nsSVGGlyphFrame.cpp:1241)
8   libgklayout.dylib     	0x1dba0360 nsSVGTextFrame::NotifyRedrawUnsuspended()
+ 0x1e8 (nsSVGTextFrame.cpp:694)
9   libgklayout.dylib     	0x1db8d64c nsSVGOuterSVGFrame::UnsuspendRedraw() +
0x140 (nsSVGOuterSVGFrame.cpp:1079)
10  libgklayout.dylib     	0x1db8c298
nsSVGOuterSVGFrame::DidReflow(nsPresContext*, nsHTMLReflowState const*, int) +
0x11c (nsSVGOuterSVGFrame.cpp:672)

Comment 5

[jhp (no longer active)]

Crash happens at |::ATSUDirectGetLayoutDataArrayPtrFromTextLayout()|.

Comment 6

[Frank Wein [:mcsmurf]]

i think two blocking requests are enough :)

Comment 7

[tor]

Attachment: ATSUI doesn't like empty strings

Comment 8

[tor]

Attachment: avoid leaks in bailout

Comment 9

[jhp (no longer active)]

Comment on attachment 187469 [details] [diff] [review]
avoid leaks in bailout

Are the |#if 1| and |#if 0| necessary, or can they just be removed?  Otherwise,
looks fine.

Comment 10

[tor]

Checked in.

Comment 11

[tor]

... and closed.