1006502 - Firefox intermittently crashes on SVG document

Status: RESOLVED DUPLICATE of bug 892910

(Core :: Graphics, defect)

Description

[david.dailey]

User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0 (Beta/Release)
Build ID: 20140421221237

Steps to reproduce:

http://cs.sru.edu/~ddailey/fonts/saved/saved88.svg
http://cs.sru.edu/~ddailey/fonts/saved/saved87.svg


Actual results:

Firefox 29.0 just plain crashed.

Sometimes it displays the page for a moment before crashing, seemingly waiting for a mouseover event, othertimes the browser just dies.




Expected results:

I don't know if I upgraded between yesterday and now or not, but the exact same file 
http://cs.sru.edu/~ddailey/fonts/saved/saved87.svg did not crash yesterday (using Firefox from three different machines, all Windows, but likely different versions of FF, since the machines at the office don't upgrade as quickly as my home machine.

Comment 1

[Josh Matthews [:jdm]]

Could you look at the recent crashes listed in about:crashes and paste the links here?

Comment 2

[david.dailey]

I am now at the office, where my machine is running Firefox 28 -- no crash. Firefox 29 at home was where the problem was. I will a) try upgrading to Firefox 29 and if the problem recurs, then b) I will post info from about:crashes.

Comment 3

[Paul Silaghi, QA [:pauly]]

Couldn't reproduce, FF 29, Win 7 x64

Comment 4

[Robert Longson [:longsonr]]

First testcase Crashes for me FF 29, Win 7 x64

bp-e92deb3c-e808-4c9b-bb2f-986b62140506

Comment 5

[Boris Zbarsky [:bzbarsky]]

EXCEPTION_INT_DIVIDE_BY_ZERO?

Comment 6

[david.dailey]

Seems likely to crash when resizing the window. Here is a crash report (I think that's what it is anyhow)
Signature 	mozilla::gfx::CreatePartialBitmapForSurface More Reports Search
UUID 	aba41936-16df-4e12-88fe-31c852140507
Date Processed	2014-05-07 00:56:10.520799
Uptime	396
Last Crash	403 seconds before submission
Install Age 	352439 since version was first installed.
Install Time 	2014-05-02 23:00:51
Product 	Firefox
Version 	29.0
Build ID 	20140421221237
Release Channel 	release
OS 	Windows NT
OS Version 	6.1.7601 Service Pack 1
Build Architecture 	x86
Build Architecture Info 	AuthenticAMD family 16 model 10 stepping 0 | 6
Crash Reason 	EXCEPTION_INT_DIVIDE_BY_ZERO
Crash Address 	0x5ded32cd
User Comments 	
App Notes 	

AdapterVendorID: 0x1002, AdapterDeviceID: 0x6759, AdapterSubsysID: 00000000, AdapterDriverVersion: 8.784.1.0
D2D? D2D+ DWrite? DWrite+ D3D10 Layers? D3D10 Layers+ 

Processor Notes 	sp-processor05_phx1_mozilla_com.22394:2012; HybridCrashProcessor
EMCheckCompatibility 	

True

Winsock LSP 	

MSAFD Tcpip [TCP/IP] : 2 : 1 : %SystemRoot%\system32\mswsock.dll 
 MSAFD Tcpip [UDP/IP] : 2 : 2 :  
 MSAFD Tcpip [RAW/IP] : 2 : 3 : %SystemRoot%\system32\mswsock.dll 
 MSAFD Tcpip [TCP/IPv6] : 2 : 1 :  
 MSAFD Tcpip [UDP/IPv6] : 2 : 2 : %SystemRoot%\system32\mswsock.dll 
 MSAFD Tcpip [RAW/IPv6] : 2 : 3 :  
 RSVP TCPv6 Service Provider : 2 : 1 : %SystemRoot%\system32\mswsock.dll 
 RSVP TCP Service Provider : 2 : 1 :  
 RSVP UDPv6 Service Provider : 2 : 2 : %SystemRoot%\system32\mswsock.dll 
 RSVP UDP Service Provider : 2 : 2 : 

Adapter Vendor ID 	

0x1002

Adapter Device ID 	

0x6759

Total Virtual Memory 	

4294836224

Available Virtual Memory 	

3736403968

System Memory Use Percentage 	

34

Available Page File 	

13935738880

Available Physical Memory 	

5629325312

Bugzilla - Report this bug in Firefox Core Plugins Toolkit
Related Bugs

    892910 NEW --- crash in mozilla::gfx::CreatePartialBitmapForSurface

Crashing Thread
Frame 	Module 	Signature 	Source
0 	gkmedias.dll 	mozilla::gfx::CreatePartialBitmapForSurface 	gfx/2d/HelpersD2D.h
1 	gkmedias.dll 	mozilla::gfx::DrawTargetD2D::CreateBrushForPattern(mozilla::gfx::Pattern const &,float) 	gfx/2d/DrawTargetD2D.cpp
2 	gkmedias.dll 	mozilla::gfx::DrawTargetD2D::Fill(mozilla::gfx::Path const *,mozilla::gfx::Pattern const &,mozilla::gfx::DrawOptions const &) 	gfx/2d/DrawTargetD2D.cpp
3 	xul.dll 	gfxContext::FillAzure(float) 	gfx/thebes/gfxContext.cpp
4 	xul.dll 	gfxContext::Fill() 	gfx/thebes/gfxContext.cpp
5 	xul.dll 	nsSVGPathGeometryFrame::Render(nsRenderingContext *,unsigned int,nsIFrame *) 	layout/svg/nsSVGPathGeometryFrame.cpp
6 	xul.dll 	nsSVGPathGeometryFrame::PaintSVG(nsRenderingContext *,nsIntRect const *,nsIFrame *) 	layout/svg/nsSVGPathGeometryFrame.cpp
7 	xul.dll 	nsDisplaySVGPathGeometry::Paint(nsDisplayListBuilder *,nsRenderingContext *) 	layout/svg/nsSVGPathGeometryFrame.cpp
8 	xul.dll 	mozilla::FrameLayerBuilder::PaintItems(nsTArray<mozilla::FrameLayerBuilder::ClippedDisplayItem> &,nsIntRect const &,gfxContext *,nsRenderingContext *,nsDisplayListBuilder *,nsPresContext *,nsIntPoint const &,float,float,int) 	layout/base/FrameLayerBuilder.cpp
9 	xul.dll 	mozilla::FrameLayerBuilder::DrawThebesLayer(mozilla::layers::ThebesLayer *,gfxContext *,nsIntRegion const &,mozilla::layers::DrawRegionClip,nsIntRegion const &,void *) 	layout/base/FrameLayerBuilder.cpp
10 	xul.dll 	mozilla::layers::BasicThebesLayer::PaintThebes(gfxContext *,mozilla::layers::Layer *,void (*)(mozilla::layers::ThebesLayer *,gfxContext *,nsIntRegion const &,mozilla::layers::DrawRegionClip,nsIntRegion const &,void *),void *,mozilla::layers::ReadbackProcessor *) 	gfx/layers/basic/BasicThebesLayer.cpp
11 	xul.dll 	mozilla::layers::BasicLayerManager::PaintSelfOrChildren(mozilla::layers::PaintLayerContext &,gfxContext *) 	gfx/layers/basic/BasicLayerManager.cpp
12 	xul.dll 	mozilla::layers::BasicLayerManager::PaintLayer(gfxContext *,mozilla::layers::Layer *,void (*)(mozilla::layers::ThebesLayer *,gfxContext *,nsIntRegion const &,mozilla::layers::DrawRegionClip,nsIntRegion const &,void *),void *,mozilla::layers::ReadbackProcessor *) 	gfx/layers/basic/BasicLayerManager.cpp
13 	xul.dll 	mozilla::layers::BasicLayerManager::PaintSelfOrChildren(mozilla::layers::PaintLayerContext &,gfxContext *) 	gfx/layers/basic/BasicLayerManager.cpp
14 	xul.dll 	mozilla::layers::BasicLayerManager::PaintLayer(gfxContext *,mozilla::layers::Layer *,void (*)(mozilla::layers::ThebesLayer *,gfxContext *,nsIntRegion const &,mozilla::layers::DrawRegionClip,nsIntRegion const &,void *),void *,mozilla::layers::ReadbackProcessor *) 	gfx/layers/basic/BasicLayerManager.cpp
15 	xul.dll 	xul.dll@0x1d44e0

Comment 7

[Tom Klein]

Neither link crashes for me on Win8 ff 41.

I'm marking this as a duplicate of bug 892910 - the call stacks are similar and the top two frames look to be the same, with the crash occuring on (it looks like) a divide by zero when one or the other of the width/height of newSize are zero (from Robert's crash report the crash is here: http://hg.mozilla.org/releases/mozilla-release/annotate/f60bc49e6bd5/gfx/2d/HelpersD2D.h#l573).

The patch for bug 892910 added a check to return if newSize.IsEmpty() (https://dxr.mozilla.org/mozilla-central/rev/1f4cf75c894862cf3634d6014d8de9c807a054a7/gfx/2d/HelpersD2D.h#669), so it shouldn't be possible to crash there any longer.