1160471 - Firefox crashes when manipulating an SVG file

Status: RESOLVED FIXED

(Core :: SVG, defect)

Description

[Peter Szabó]

Attachment: Open Index.html in Firefox and see the browser crashing

User Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36

Steps to reproduce:

I was manipulating an SVG file with JavaScript


Actual results:

The browser crashes


Expected results:

The browser should not crash :)

Comment 1

[Matthias Versen [:Matti]]

I can confirm a OOM crash with Firefox37 on Windows7

Comment 2

[Robert Longson [:longsonr]]

Can you add the report ids (including the bp) from about:crashes please

Comment 3

[Peter Szabó]

bp-88c9c843-6655-4edc-975c-800072150501
bp-7ae723e7-7701-4145-aed3-5c5ed2150427
bp-965591ac-1fb1-4dec-84d5-d741a2150427
bp-cfff3941-ead8-4f8d-959e-255192150427
bp-406148ca-a4ca-403d-9e1e-d52922150427

Comment 4

[Alice0775 White]

Pushlog:
https://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=92f737230338&tochange=af0931327e49

Triggered by: Bug 651858

Comment 5

[Alice0775 White]

Sorry,
it should be Bug 930577

Comment 6

[Jonathan Watt [:jwatt]]

Peter, would you be able to reduce your testcase to something considerably smaller by incrementally chopping bits out of it until you can no longer remove any more without the crash failing to occur?

Comment 7

[Peter Szabó]

Attachment: testcase.zip

Comment 8

[Jonathan Watt [:jwatt]]

That's much better, but I'm not familiar with DrawSVGPlugin or TweenMax. Can you also get rid of those?

Comment 9

[Peter Szabó]

Unfortunately neither I'm familiar with those libraries. They are third-party libraries from http://greensock.com/drawSVG

Comment 10

[Jonathan Watt [:jwatt]]

But I assume you wrote the code:

  TweenMax.staggerTo("#main-line-10", 0, {drawSVG: 0}, 0);

Can you explain what that does? The staggerTo part seems to essentially do some sort of step from one value to another, but the {drawSVG: 0} part and what the value is changing to is not at all clear.

Comment 11

[Peter Szabó]

I wanted to create an animation, which draws the paths of an SVG image.

To achieve that, I "initialize" the SVG by calling the mentioned function to display "0%" of the given SVG path.

Then I call TweenMax.staggerTo("#main-line-10", 0.5, {drawSVG: "100%"}, 0.1); to slowly draw the full path.

Basically something similar to this: http://codepen.io/netgfx/pen/OPNOgM

I was able to draw other SVG paths, only the one in the attached HTML file is causing the browser to crash.

Comment 12

[Jonathan Watt [:jwatt]]

Attachment: reduced testcase (WATCH OUT! HANG/CRASH!)

Does this still cause issues on Windows?

Comment 13

[Peter Szabó]

Yes, It does.

Comment 14

[Jonathan Watt [:jwatt]]

Great, thanks for your help reducing the testcase.

Bas, can you take a look at what's going wrong with the path measuring code?

Comment 15

[Jonathan Watt [:jwatt]]

It seems that the patch in bug 1134549 fixes this.

Comment 16

[B. Dahse]

I can no longer reproduce in Ubuntu 15.10, now that the patch referred to in comment 15 was pushed in https://hg.mozilla.org/mozilla-central/rev/3e73fc0dfb01