234519 - crash if stroke-width:0 and a stroke:color is given

Status: RESOLVED FIXED

(Core :: SVG, defect)

Description

[Justus Piater]

User-Agent:       
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7a) Gecko/20040207

SVG-enabled Mozilla crashes on the following code:

<?xml version="1.0"?>
<svg xmlns="http://www.w3.org/2000/svg"
  width="11.9in" height="6.8in" viewBox="5120 1198 14232 8104">
  <g>
    <polyline points="8400,2836 10240,2836 10240,3246 8400,3246 8400,2836 "
      style="stroke-width:0; stroke:black"/>
  </g>
</svg>

If I remove either 'stroke-width:0' or 'stroke:black', it works.

Reproducible: Always
Steps to Reproduce:
1. Put the above SVG code fragment into a file.
2. Load this file into Mozilla.
Actual Results:  
Mozilla's GUI freezes, and one of the mozilla-bin threads occupies all available
CPU and, incrementally, all available memory. The process needs to be killed.

Expected Results:  
Draw a filled rectangle.

This is an SVG-enabled Mozilla build that I downloaded today from mozilla.org.

Comment 1

[Christian :Biesinger (don't email me, ping me on IRC)]

Attachment: testcase (CRASHES)

I get a crash, somewhere in libart

tried to get a stack, gdb didn't like that though and got an internal error

Comment 2

[Robert Mohr]

Confirming on 'Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7a) Gecko/20040214
Firebird/0.8.0+' that I compiled myself.

Comment 3

[Alex Fritze]

Trivial fix to nsSVGStroke.cpp checked in (don't build path for stroke-width==0).