Closed
Bug 1128169
Opened 10 years ago
Closed 3 months ago
Assertion failure: ToRect(strokeBBoxExtents).IsFinite() (bbox is about to go bad)
Categories
(Core :: SVG, defect)
Tracking
()
RESOLVED
DUPLICATE
of bug 1322643
People
(Reporter: bakamarimoo, Unassigned)
Details
(Keywords: assertion, testcase)
Attachments
(2 files, 1 obsolete file)
testcase-17.svg
User Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:35.0) Gecko/20100101 Firefox/35.0
Build ID: 20150125221831
Steps to reproduce:
./20150131033837_debug/firefox -no-remote -profile profile/ confirmed/2/testcase-17.svg 2>&1 | tee trace-17.txt
Actual results:
Assertion failure: ToRect(strokeBBoxExtents).IsFinite() (bbox is about to go bad), at /builds/slave/m-cen-l64-asan-d-0000000000000/build/src/layout/svg/nsSVGPathGeometryFrame.cpp:594
Expected results:
!assertion failure
testcase triggers a tab crash and assertion failure in latest nightly asan debug build
|
||
Comment 3•10 years ago
|
||
It's not a security issue, AFAICT. And it doesn't crash (other than debug builds)
so I think we can make this bug public.
|
||
Comment 4•10 years ago
|
||
The stroke-width is simply bigger than a float can hold (though not too big for a double) hence the assert fires.
Attachment #8557500 -
Attachment is obsolete: true
|
||
Updated•10 years ago
|
Group: core-security
|
||
Updated•2 years ago
|
Severity: normal → S3
|
|
||
Updated•3 months ago
|
You need to log in
before you can comment on or make changes to this bug.
Description
•