nsSVGPathGeometryFrame::DidSetStyleContext NULL pointer crash

RESOLVED FIXED

Status

()

Core
Layout
--
critical
RESOLVED FIXED
3 years ago
3 years ago

People

(Reporter: SkyLined, Unassigned)

Tracking

({crash, testcase})

41 Branch
crash, testcase
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment)

236 bytes, text/html
Details
(Reporter)

Description

3 years ago
Created attachment 8671505 [details]
repro.html

User Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:41.0) Gecko/20100101 Firefox/41.0
Build ID: 20150929144111

Steps to reproduce:

x<svg><image><script>
window.onload=function(){
  s=document.styleSheets[0];
  s.insertRule("*{margin:999pt;transition:0.1s;",0);
  s.insertRule("html{counter-reset: x", 0);
  s.insertRule("::first-line{", 0)
}
</script><style>


Actual results:

NULL pointer crash in nsSVGPathGeometryFrame::DidSetStyleContext


Expected results:

Page loads successfully.
(Reporter)

Updated

3 years ago
Severity: normal → critical
Component: Untriaged → Untriaged
Keywords: crash, testcase
Product: Firefox → Core
(Reporter)

Updated

3 years ago
Component: Untriaged → Layout
I tried nightly and release builds on mac, couldn't get it to crash.
Doesn't crash for me either. Do you have crash ids you can attach to this bug?
Flags: needinfo?(berendjanwever)
(Reporter)

Comment 3

3 years ago
Crashes release 41.0.1
https://crash-stats.mozilla.com/report/index/b5f405e2-b92a-4ee8-a99e-a05fc2151009

It also crashes Nightly 44.0a1 (2015-10-08). However, I get a popup telling me about the access violation, with only an "OK" button; not the normal crash reporter popup. After pressing "OK", I get a crashed tab page and "about:crashes" only shows the crash for release, not for Nightly.
Flags: needinfo?(berendjanwever)
Does it still crash in safe mode? With a new profile?
(Reporter)

Comment 5

3 years ago
Yes. Yes. I can get you a .dmp file if you want to debug that.
Is this fixed on trunk now? A possible fix just landed. (If you're using nightlies you may need to wait another 24 hours).
Flags: needinfo?(berendjanwever)
(Reporter)

Comment 7

3 years ago
I do not have access to a machine to test this, as I am on holiday for another week. I will look at this when I get back, if I remember. If you haven't heard from me after the 24th, please send me a reminder.
(Reporter)

Comment 8

3 years ago
I'm going to be too busy for the next few weeks to look into this.
(Reporter)

Updated

3 years ago
Flags: needinfo?(berendjanwever)
Status: NEW → RESOLVED
Last Resolved: 3 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.