309926 - crash [@ nsSVGFEComponentTransferElement::Filter]

Status: RESOLVED WORKSFORME

(Core :: SVG, defect)

Description

[Jesse Ruderman]

Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.9a1) Gecko/20050924
Firefox/1.6a1

Steps to reproduce:
1. Open
http://www.w3.org/Graphics/SVG/Test/20030813/svggen/filters-comptran-01-b.svg

Result: Firefox crashes [@ nsSVGFEComponentTransferElement::Filter].

Comment 1

[Jesse Ruderman]

TB9699273E

Comment 2

[Jesse Ruderman]

Attachment: simpler testcase (uses one gradient and one filter)

Comment 3

[Ria Klaassen (not reading all bugmail)]

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20050924
Firefox/1.6a1 ID:2005092408

No crash in WinXP.

Comment 4

[Boris Zbarsky [:bzbarsky]]

No crash with current Linux trunk.  Is this Mac-only or just worksforme?

Comment 5

[Jesse Ruderman]

Mac-only, I guess.  I still get a crash with Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.9a1) Gecko/20060410 Firefox/3.0a1.

Comment 6

[Jesse Ruderman]

Attachment: stack trace (mac nightly)

Comment 7

[Jesse Ruderman]

A recent stack trace shows it accessing an invalid address, which makes me worry that it might be a security hole.

Comment 8

[Jesse Ruderman]

WFM Intel Mac trunk debug.  I want to find someone to test it on PPC before I close it as WFM.

Comment 9

[Tracy Walker [:tracy]]

I don't crash with Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.9a3pre) Gecko/20070301 Minefield/3.0a3pre

Comment 10

[Jesse Ruderman]

Ok, WFM then.