Closed Bug 751515 Opened 12 years ago Closed 12 years ago

Crash with convertToSpecifiedUnits()

Categories

(Core :: SVG, defect)

Product:
Core
Component:
SVG
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED FIXED
Milestone:
mozilla15
Tracking Flags:
Tracking Status
firefox12 --- unaffected
firefox13 --- verified
firefox14 --- verified

People

(Reporter: jruderman, Assigned: longsonr)

References

Details

(Keywords: crash, regression, testcase, Whiteboard: [qa+])

Crash Data

Attachments

(3 files)

testcase
162 bytes, image/svg+xml
Details
stack trace+
13.62 KB, text/plain
Details
patch
2.77 KB, patch
dholbert
: review+
akeybl
: approval-mozilla-aurora+
akeybl
: approval-mozilla-beta+
Details | Diff | Splinter Review
Attached image testcase — 
      No description provided.
Crash Signature: [@ nsSVGElement::WillChangeAngle ] [@ nsSVGAngle::ConvertToSpecifiedUnits ]
Attached patch patch — — Splinter Review 
Assignee: nobody → longsonr

        Attachment #620645 -
        Flags: review?(dholbert)

    
  
Depends on: 629200
Keywords: regression

    
  
Blocks: 629200
Crash Signature: [@ nsSVGElement::WillChangeAngle ] 
[@ nsSVGAngle::ConvertToSpecifiedUnits ] → [@ nsSVGElement::WillChangeAngle ] 
[@ nsSVGAngle::ConvertToSpecifiedUnits ]
[@ nsSVGElement::WillChangeAngle(unsigned char)]

          status-firefox13:
          --- → affected

          status-firefox14:
          --- → affected
No longer depends on: 629200
OS: Mac OS X → All
Hardware: x86_64 → All
Version: Trunk → 13 Branch

        Attachment #620645 -
        Flags: review?(dholbert) → review+
Status: NEW → ASSIGNED
Version: 13 Branch → Trunk

    
    

    
  
When there's regression as keyword, the version field displays the version where it first appeared in order to know the Aurora, Beta, ESR and even Release channels are affected.

    
    

    
  
I can land this tomorrow morning.

    
    

    
  
I'm ready to land it.

    
    

    
  
pushed https://hg.mozilla.org/integration/mozilla-inbound/rev/319f53d58da2
Target Milestone: --- → mozilla15

    
  
Flags: in-testsuite+

    
    

    
  
https://hg.mozilla.org/mozilla-central/rev/319f53d58da2
Status: ASSIGNED → RESOLVED
Closed: 12 years ago
Resolution: --- → FIXED

    
    

    
  
Comment on attachment 620645 [details] [diff] [review]
patch

[Approval Request Comment]
Regression caused by (bug #): 629200
User impact if declined: Any call to convertToSpecifiedUnits on an angle created by calling createSVGAngle will crash the browser. Other methods are not affected.
Testing completed (on m-c, etc.): landed on m-c with a crashtest
Risk to taking this patch (and alternatives if risky): patch is small, localised and low risk.
String changes made by this patch: none

        Attachment #620645 -
        Flags: approval-mozilla-beta?

        Attachment #620645 -
        Flags: approval-mozilla-aurora?

    
    

    
  
crash automation reproduced this on all branches/platforms with:
nsSVGElement::WillChangeAngle nsSVGAngle::ConvertToSpecifiedUnits DOMSVGAngle::ConvertToSpecifiedUnits

    
    

    
  
Comment on attachment 620645 [details] [diff] [review]
patch

[Triage Comment]
Regression in FF13 and low risk. Approved for Aurora 14 and Beta 13.

        Attachment #620645 -
        Flags: approval-mozilla-beta?

        Attachment #620645 -
        Flags: approval-mozilla-beta+

        Attachment #620645 -
        Flags: approval-mozilla-aurora?

        Attachment #620645 -
        Flags: approval-mozilla-aurora+

    
  
Whiteboard: [qa+]

    
    

    
  
Verified that Firefox 13 beta 3 does not crash when using the test case attached in the Description.

Verified on Windows 7, Ubuntu 12.04 and Mac OS X 10.6:
Mozilla/5.0 (Windows NT 6.1; rv:13.0) Gecko/20100101 Firefox/13.0
Mozilla/5.0 (X11; Linux i686; rv:13.0) Gecko/20100101 Firefox/13.0
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:13.0) Gecko/20100101 Firefox/13.0

          status-firefox13:
          fixed → verified

    
    

    
  
Verified that Firefox 14 beta 7 does not crash when using the test case attached in the Description. Verified on Win 7, Ubuntu 12.04 and Mac OS X 10.6:

Mozilla/5.0 (Windows NT 6.1; rv:14.0) Gecko/20100101 Firefox/14.0
Mozilla/5.0 (X11; Linux i686; rv:14.0) Gecko/20100101 Firefox/14.0
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:14.0) Gecko/20100101 Firefox/14.0

          status-firefox14:
          fixed → verified

          You need to log in
          before you can comment on or make changes to this bug.
        






  

    
  







  

    

      
Attachment

      

      
      
      
      
    

    

      

        

          

            
General

            

              Creator: 



            

            
Created: 

            
Updated: 

            
Size: