Closed Bug 1212971 Opened 9 years ago Closed 9 years ago

nsSVGPathGeometryFrame::DidSetStyleContext NULL pointer crash

Categories

(Core :: Layout, defect)

41 Branch
defect
Not set
critical

Tracking

()

RESOLVED FIXED

People

(Reporter: abbGZcvu_bugzilla.mozilla.org, Unassigned)

Details

(Keywords: crash, testcase)

Attachments

(1 file)

Attached file repro.html
User Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:41.0) Gecko/20100101 Firefox/41.0
Build ID: 20150929144111

Steps to reproduce:

x<svg><image><script>
window.onload=function(){
  s=document.styleSheets[0];
  s.insertRule("*{margin:999pt;transition:0.1s;",0);
  s.insertRule("html{counter-reset: x", 0);
  s.insertRule("::first-line{", 0)
}
</script><style>


Actual results:

NULL pointer crash in nsSVGPathGeometryFrame::DidSetStyleContext


Expected results:

Page loads successfully.
Severity: normal → critical
Keywords: crash, testcase
Product: Firefox → Core
Component: Untriaged → Layout
I tried nightly and release builds on mac, couldn't get it to crash.
Doesn't crash for me either. Do you have crash ids you can attach to this bug?
Flags: needinfo?(berendjanwever)
Crashes release 41.0.1
https://crash-stats.mozilla.com/report/index/b5f405e2-b92a-4ee8-a99e-a05fc2151009

It also crashes Nightly 44.0a1 (2015-10-08). However, I get a popup telling me about the access violation, with only an "OK" button; not the normal crash reporter popup. After pressing "OK", I get a crashed tab page and "about:crashes" only shows the crash for release, not for Nightly.
Flags: needinfo?(berendjanwever)
Does it still crash in safe mode? With a new profile?
Yes. Yes. I can get you a .dmp file if you want to debug that.
Is this fixed on trunk now? A possible fix just landed. (If you're using nightlies you may need to wait another 24 hours).
Flags: needinfo?(berendjanwever)
I do not have access to a machine to test this, as I am on holiday for another week. I will look at this when I get back, if I remember. If you haven't heard from me after the 24th, please send me a reminder.
I'm going to be too busy for the next few weeks to look into this.
Flags: needinfo?(berendjanwever)
Status: NEW → RESOLVED
Closed: 9 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: