307254 - Firefox crashes when attempting to view attached SVG image (involves XRenderCompositeTrapezoids)

Status: RESOLVED WORKSFORME

(Core :: SVG, defect)

Description

[Jeff Walden [:Waldo]]

Comment 1

[Jeff Walden [:Waldo]]

Attachment: SVG file that causes crash

This image will crash both branch and trunk Firefox builds.

Comment 2

[tor]

Works fine on GDI+, unhappy with cairo.  Could be this, as we're trying to toss
~200K trapezoids at the X server.

  https://bugs.freedesktop.org/show_bug.cgi?id=4135

Comment 3

[Jeff Walden [:Waldo]]

Attachment: Reduced version of previous attachment, fwiw

That bug does indeed look like the problem; the error message reported there is
certainly present here.

Comment 4

[jonathan chetwynd]

wfm on os x

Comment 5

[tor]

*** Bug 356372 has been marked as a duplicate of this bug. ***

Comment 6

[Mats Palmgren (inactive)]

*** Bug 357844 has been marked as a duplicate of this bug. ***

Comment 7

[Mats Palmgren (inactive)]

*** Bug 351999 has been marked as a duplicate of this bug. ***

Comment 8

[Adam Guthrie]

Tweaking summary and pasting a snippet from the stack to improve searchability. 

#0  0xffffe410 in __kernel_vsyscall ()
#1  0xb747fbc4 in writev () from /lib/tls/i686/cmov/libc.so.6
#2  0xb77634e3 in _X11TransSocketWritev (ciptr=0xffffffe0, buf=0xffffffe0, size=-32) at Xtranssock.c:2181
#3  0xb7763736 in _X11TransWritev (ciptr=0x1, buf=0xffffffe0, size=-32) at Xtrans.c:911
#4  0xb776876f in _XSend (dpy=0x80740c8, data=0xaef7f008 "\031\004", size=7942440) at ../../src/XlibInt.c:1422
#5  0xb78b20ea in XRenderCompositeTrapezoids (dpy=0x80740c8, op=<value optimized out>, src=65014016, dst=65013818, maskFormat=0x818c6d8, xSrc=<value optimized out>, ySrc=<value optimized out>, traps=0xaef7f008, ntrap=0) at ../../src/Trap.c:67
#6  0xb7f4c6d5 in _cairo_xlib_surface_composite_trapezoids (op=CAIRO_OPERATOR_OVER, pattern=0xbfbfaec0, abstract_dst=0x8efb9f8, antialias=CAIRO_ANTIALIAS_DEFAULT, src_x=0, src_y=0, dst_x=0, dst_y=0, width=196, height=319, traps=0xaef7f008, num_traps=198561) at /moz/trunk/mozilla/gfx/cairo/cairo/src/cairo-xlib-surface.c:1639
#7  0xb7f3550c in _cairo_surface_composite_trapezoids (op=CAIRO_OPERATOR_OVER, pattern=0xbfbfaec0, dst=0x8efb9f8, antialias=CAIRO_ANTIALIAS_DEFAULT, src_x=0, src_y=0, dst_x=0, dst_y=0, width=196, height=319, traps=0xaef7f008, num_traps=198561) at /moz/trunk/mozilla/gfx/cairo/cairo/src/cairo-surface.c:1449

Comment 9

[Robert Longson [:longsonr]]

*** Bug 363905 has been marked as a duplicate of this bug. ***

Comment 10

[Martin Walch]

same problem with
http://upload.wikimedia.org/wikipedia/commons/b/be/Gletscherspuren.svg

As you can see in the gentoo bugzilla, it crashes for some builds of Firefox 2.0.0.1 and for some it does not.
http://bugs.gentoo.org/show_bug.cgi?id=160763

Comment 11

[Stan Shebs]

Attachment: Patch working around X server bug

Here's a Cairo patch that works around the problem by making multiple X calls. Crude, but effective with all the crashers that people have sent in.

Comment 14

[Dave Barton]

same problem with:
http://openclipart.org/people/MeNext/MeNext_Motorbike.svg
crashes FF 2.0.3 on SuSE 10.1
renders OK in FF for Windows and Mac

Comment 17

[Jonathan Watt [:jwatt]]

The Version field here is set to 1.8 Branch. Is this also a problem on trunk builds?

Comment 18

[Helder "Lthere" Magalhães]

Bug seems fixed as of now. Opened both attachment "Reduced version of previous attachment, fwiw" and link of comment 14 (comment 10's link seems broken), in both Windows and Linux, without experiencing any crash.

Performance and progressive rendering make hunting outdated bugs quite pleasant in current Firefox 3 builds! :-)

Versions:
Firefox 2 (Windows) - Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.13) Gecko/20080311 Firefox/2.0.0.13
Firefox 3 (Windows) - Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9pre) Gecko/2008040305 Minefield/3.0pre
Firefox 2 (Linux) - Mozilla/5.0 (X11; U; Linux i686; pt-PT; rv:1.8.1.13) Gecko/20080325 Ubuntu/7.10 (gutsy) Firefox/2.0.0.13
Firefox 3 (Linux) - Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9pre) Gecko/2008040304 Minefield/3.0pre

Comment 19

[Martin Walch]

(In reply to comment #18)
> attachment, fwiw" and link of comment 14 (comment 10's link seems broken), in

the file has moved to
http://upload.wikimedia.org/wikipedia/commons/4/4a/Receding_glacier-de.svg

works fine with Firefox 2.0.0.13 as well as with Firefox 3.0 Beta 5 on Gentoo GNU/Linux

Comment 20

[Robert Longson [:longsonr]]

As far as I know this crash is caused by a bug in the X server.

Some X servers crash, some don't. Those reporting things are OK now, have you experienced this problem in the past with the same X server version you had then?

Comment 21

[Jeff Walden [:Waldo]]

I for one won't be able to retest this any time soon, as I don't have a Linux VM handy.  :-\

Comment 22

[Helder "Lthere" Magalhães]

(In reply to comment #20)
> Some X servers crash, some don't. Those reporting things are OK now, have you
> experienced this problem in the past with the same X server version you had
> then?

Humm, I see... Unfortunately, I only stumbled across this issue recently, therefore I never experienced the crash at all.

Nevertheless, I believe that this could have been caused by some cairo issue that was fixed in recent updates, but now I'm just guessing! Maybe downloading older builds may help testing this hypothesis - for example, version 2.0.3 is reported in comment 14 as experiencing the symptom. I haven't got SuSE 10.1 available, though...

IMHO this could be marked "works for me" or "fixed" until someone is able to reproduce the crash again - after a delay to allow additional feedback for comment 20, of course! :-)

Comment 23

[Jesse Ruderman]

WFM using Firefox trunk on Ubuntu 9.10.

Comment 24

[Martin Walch]

Also works for me now with current Gentoo/amd64.