308615 - Infinite recursion crash with <svg:pattern> loop

Status: VERIFIED FIXED

(Core :: SVG, defect)

Description

[Jesse Ruderman]

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20050914
Firefox/1.6a1

TB9365977Z

Comment 1

[Jesse Ruderman]

Attachment: simple testcase

Comment 2

[Jesse Ruderman]

See also bug 307322 and bug 278201.  Is there a general solution to the hangs
and crashes that occur due to reference loops?

Comment 3

[Scooter Morris]

Attachment: Catch pattern loop and degenerate sizes

Comment 4

[Scooter Morris]

Attachment: nsSVGPatternFrame should inherit from nsSVGDefsFrame -- also check for degenerate paths

Comment 5

[tor]

This still won't handle the two pattern loop case, will it?

Comment 6

[Scooter Morris]

Attachment: Same patch as previous, but add checking for multiple different patterns looping

Comment 7

[Stephen Donner [:stephend] Not actively reading bugmail]

(In reply to comment #6)
> Created an attachment (id=196826) [edit]
> Same patch as previous, but add checking for multiple different patterns
> looping

Are you planning to seek reviews for this patch?  My hope is it simply fell off
the radar...

Comment 8

[Scooter Morris]

(In reply to comment #7)
> (In reply to comment #6)
> > Created an attachment (id=196826) [edit] [edit]
> > Same patch as previous, but add checking for multiple different patterns
> > looping
> 
> Are you planning to seek reviews for this patch?  My hope is it simply fell off
> the radar...

Not really.  I'm holding off asking for reviews until after we past the 1.5b2
deadlines.  Most of the SVG team (i.e. tor & jwatt) are really buried with some
critical fixes to Windows Cairo and other 1.5-related things.  I'm also working
on a combined patch that fixes this problem as well as a couple of other
patterns issues.

Comment 9

[Stephen Donner [:stephend] Not actively reading bugmail]

https://bugzilla.mozilla.org/attachment.cgi?id=196117&action=view no longer crashes for me in build 2005-12-14-09, SeaMonkey trunk on Windows XP

Comment 10

[Jesse Ruderman]

WFM Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20051214 Firefox/1.6a1

Scooter, is the patch in comment 6 still worthwhile?

Comment 11

[Scooter Morris]

Fixed by checkin to bug 308917

Comment 12

[Stephen Donner [:stephend] Not actively reading bugmail]

Verified FIXED using build 2006-02-10-10, Windows XP SeaMonkey trunk (no crash).

Comment 13

[Jesse Ruderman]

Crashtest checked in.