225923 - path-curves-BE-02-ps.html crashes Moz

Status: RESOLVED WONTFIX

(Core :: SVG, defect)

Description

[Bjarne D Mathiesen]

SVG build Mac OS X 2003-47
The URL mentioned crashes Mozilla hard
Actually, I think this is an older problem first seen in my 2003-34 build
The first builds I made in july 2003 didn't display this behaviour.

I'm getting this in the Console:

colinear!
colinear!
colinear!
colinear!
*** malloc: vm_allocate(size=2147483648) failed with 3
*** malloc[19316]: error: Can't allocate region
Nov 16 23:42:46 Titanen crashdump: Crash report written to:
/Volumes/brugere/bjarnema/Library/Logs/CrashReporter/mozilla-bin.crash.log

Comment 1

[Bjarne D Mathiesen]

Attachment: crash.log from 2003-11-16 23:42:46

Comment 2

[Bjarne D Mathiesen]

Additionally, I'm gettin these 4 lines in the Console in association with every
test-case:

x_order_2: colinear!
x_order_2: colinear!
colinear!
colinear!

They might be related to the crash as described, or unrelated, but the
'colinear!' thing makes me think it's related.

Comment 3

[Alex Fritze]

I can't reproduce this problem on Windows or Linux. The above URL loads just
fine for me (also getting the colinearity warnings from libart).

Does consistently crash on MacOS or just occasionally?

Comment 4

[Bjarne D Mathiesen]

consistently - each and every time

I tested each and every link on the w3c-conformance page.
On the first run through, it just crashed when I opened that link
On the second run, I started by opening that link.
The results of this second test is what I've reported

My building notes also says that I had this problem as early as 2003-34.
It's a regression issue as the first builds I made didn't have this problem.

Comment 5

[Bjarne D Mathiesen]

Attachment: console log with svg points

this is the console log obtained after modifying
mozilla/layout/svg/renderer/src/libart/nsSVGLibartPathGeometry.cpp
lines 212-228 to
ArtSVP *
nsSVGLibartPathGeometry::GetFill()
{
  if (!GetPath()) return nsnull;  
  mFill.Build(GetPath(), mSource);
  
  return mFill.GetSvp();
}

ArtSVP *
nsSVGLibartPathGeometry::GetStroke()
{
  if (!GetPath()) return nsnull;
  mStroke.Build(GetPath(), mSource);
  
  return mStroke.GetSvp();
}

and
mozilla/layout/svg/renderer/src/libart/nsSVGLibartRegion.cpp
lines 91-96 to
nsSVGLibartRegion::nsSVGLibartRegion(ArtSVP* path)
{
  if (path) { fprintf(stderr,"svp points=%d bbox=%f %f %f %f\n",
path->segs->n_points,
  path->segs->bbox.x0, path->segs->bbox.y0, path->segs->bbox.x1,
path->segs->bbox.y1); }
  mUta = path ? art_uta_from_svp(path) : nsnull;  
}

Comment 6

[Alex Fritze]

*** Bug 234213 has been marked as a duplicate of this bug. ***

Comment 7

[Alex Fritze]

Comment on attachment 135799 [details]
console log with svg points


>svp points=2 bbox=150.000000 -48038396025285120.000000 200.000000 169.500000
>*** malloc: vm_allocate(size=2147483648) failed with 3
>*** malloc[3053]: error: Can't allocate region

So this is what's going wrong here. For some reason libart creates an svg with
weird dimensions on the Mac and uta allocation fails because the object
dimensions are too large.
I can't reproduce this on linux or windows at all, and I'm at a complete loss
as to why this only happens on Mac :-(
My guess would be that the error lies somewhere in libart, so it might be
worthwhile scanning their newsgroups.

Comment 8

[Bernd]

I can easily reproduce this under windows:
start viewer.exe ( it has a small default window)
wait the page loads resize
assert with negative images size.

viewport/viewbox will be changed
viewport/viewbox have been changed
viewport/viewbox will be changed
viewport/viewbox have been changed
viewport/viewbox will be changed
viewport/viewbox have been changed
** nsSVGTextFrame::DidSetStyleContext
** nsSVGTextFrame::DidSetStyleContext
** nsSVGTextFrame::DidSetStyleContext
** nsSVGTextFrame::DidSetStyleContext
** nsSVGTextFrame::DidSetStyleContext
** nsSVGTextFrame::DidSetStyleContext
** nsSVGTextFrame::DidSetStyleContext
** nsSVGTextFrame::DidSetStyleContext
** nsSVGTextFrame::DidSetStyleContext
** nsSVGTextFrame::DidSetStyleContext
** nsSVGTextFrame::DidSetStyleContext
** nsSVGTextFrame::DidSetStyleContext
** nsSVGTextFrame::DidSetStyleContext
** nsSVGTextFrame::DidSetStyleContext
viewport/viewbox will be changed
viewport/viewbox have been changed
viewport/viewbox will be changed
viewport/viewbox have been changed
viewport/viewbox will be changed
viewport/viewbox have been changed
SVG Viewport=(0?,0?,450.000000,450.000000)
SVG Viewbox=(0.000000,0.000000,450.000000,450.000000)
SVG Viewbox->Viewport xform [a c e] = [1.000000,   0, 0.000000]
                            [b d f] = [   0,  1.000000, 0.000000]
colinear!
colinear!
viewport/viewbox will be changed
viewport/viewbox have been changed
viewport/viewbox will be changed
viewport/viewbox have been changed
viewport/viewbox will be changed
viewport/viewbox have been changed
SVG Viewport=(0?,0?,450.000000,450.000000)
SVG Viewbox=(0.000000,0.000000,450.000000,450.000000)
SVG Viewbox->Viewport xform [a c e] = [1.000000,   0, 0.000000]
                            [b d f] = [   0,  1.000000, 0.000000]
colinear!
colinear!
WARNING: error - negative image size
, file e:/moz_src/mozilla/modules/libpr0n/src/imgContainer.cpp, line 49
###!!! ASSERTION: error - negative image size
: '0', file e:/moz_src/mozilla/gfx/src/shared/gfxImageFrame.cpp, line 52
art_render_new: x0 >= x1 (x0 = 0, x1 = 0)
###!!! ASSERTION: could not create render: 'render', file e:/moz_src/mozilla/lay
out/svg/renderer/src/libart/nsSVGLibartPathGeometry.cpp, line 262
nsStringStats
 => mAllocCount: 5639
 => mReallocCount: 570
 => mFreeCount: 4091
 => mShareCount: 7614
 => mAdoptCount: 1967
 => mAdoptFreeCount: 1938

Comment 9

[Bjarne D Mathiesen]

problem resolved in Mozilla 1.7rc2

Comment 10

[Bjarne D Mathiesen]

Reopening

I compiled moz with a .mozconfig that had the svg lines commented out so what I
was testing was the Adobe plug-in :-(

Sorry about the bug-spam :-((

Comment 11

[Jonathan Watt [:jwatt]]

Mass reassign of SVG bugs that aren't currently being worked on by Alex to
[e-mail]. If you think someone should be assigned to your bug you can
join the #svg channel on mozilla.org's IRC server ( irc://irc.mozilla.org/svg )
where you can try to convince one of the SVG hackers to work on it. We aren't
always there, so if you don't get a response straight away please try again later. 

Comment 12

[Jonathan Watt [:jwatt]]

Marking wontfix. We have no plans to continue development of the libart backend.