467323 - Crash [@ nsSVGFEDisplacementMapElement::Filter]

Status: VERIFIED FIXED

(Core :: SVG, defect, P2)

Description

[Jesse Ruderman]

Attachment: testcase (can crash Firefox when loaded)

###!!! ASSERTION: stride mismatch: 'input->mImage.mImage->Stride() == primitive->mImage.mImage->Stride()', file /Users/jruderman/central/layout/svg/base/src/nsSVGFilterInstance.cpp, line 492

Bug 448243 also triggers this assertion.  This testcase not only triggers the assertion, but also makes Firefox draw random pixels and/or dereference bogus addresses [@ nsSVGFEDisplacementMapElement::Filter].

The testcase is simply layout/reftests/svg/filters/feDisplacementMap-2.svg with one less element.

Comment 1

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Seems to have been fixed by the checkin for bug 448243.

Comment 2

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

...which is now fixed on 1.9.1 as well.

Comment 3

[Marcia Knous [:marcia]]

verified fixed using Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.1b3pre) Gecko/20081230 Shiretoko/3.1b3pre. Updating keyword.

verified fixed on the trunk as well using Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.2a1pre) Gecko/20081230 Minefield/3.2a1pre

Comment 4

[Daniel Veditz [:dveditz]]

Want this for 1.9.0; not needed for 1.8 which doesn't have svg filters.

Comment 5

[Samuel Sidler (old account; do not CC)]

Assigning this to roc since he owns bug 448243, which this bug is fixed by.

Comment 6

[Daniel Veditz [:dveditz]]

I don't crash with this testcase in 1.9.0.12pre, looks like we don't need this.

Comment 7

[Jesse Ruderman]

Crashtest: http://hg.mozilla.org/mozilla-central/rev/c38d6ec28c45