Last Comment Bug 319107 - One SVG file crashes firefox 1.5 [@ nsSVGGradientFrame::GetNextGradient]
: One SVG file crashes firefox 1.5 [@ nsSVGGradientFrame::GetNextGradient]
Status: RESOLVED FIXED
[rft-dl]
: fixed1.8.1, verified1.8.0.2
Product: Core
Classification: Components
Component: SVG (show other bugs)
: Trunk
: All All
: -- critical (vote)
: ---
Assigned To: Scooter Morris
: Hixie (not reading bugmail)
Mentors:
: 328569 (view as bug list)
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2005-12-04 23:25 PST by Emmanuel Touzery
Modified: 2006-03-02 15:55 PST (History)
10 users (show)
dveditz: blocking1.8.0.2+
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
this svg file crashes firefox 1.5 every time. it was produced by inkscape. (6.45 KB, text/plain)
2005-12-04 23:26 PST, Emmanuel Touzery
no flags Details
CRASHER!! correct mimetype: opening this attachment should crash firefox (6.45 KB, image/svg+xml)
2005-12-05 05:35 PST, Emmanuel Touzery
no flags Details
very small svg file which crash Firefox 1.5 (289 bytes, image/svg+xml)
2005-12-11 08:24 PST, Florian
no flags Details
Patch for crash (899 bytes, patch)
2006-01-02 13:26 PST, Scooter Morris
tor: review-
Details | Diff | Splinter Review
Make sure to set aNextGrad to nsnull (925 bytes, patch)
2006-01-04 13:17 PST, Scooter Morris
tor: review+
benjamin: approval‑branch‑1.8.1+
mtschrep: approval1.8.0.1-
dveditz: approval1.8.0.2+
Details | Diff | Splinter Review

Description Emmanuel Touzery 2005-12-04 23:25:08 PST
User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8) Gecko/20051111 Firefox/1.5
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8) Gecko/20051111 Firefox/1.5

I attach a SVG file which crashes firefox 1.5 every time on both linux x86 (firefox 1.5 binary from mozilla.org) and windows XP.

Reproducible: Always
Comment 1 Emmanuel Touzery 2005-12-04 23:26:09 PST
Created attachment 205008 [details]
this svg file crashes firefox 1.5 every time. it was produced by inkscape.
Comment 2 Ria Klaassen (not reading all bugmail) 2005-12-05 05:27:01 PST
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8) Gecko/20051204 Firefox/1.5
I get no crash (see only some text) :) 
Comment 3 Emmanuel Touzery 2005-12-05 05:32:29 PST
if you just see the text that's because I set the mimetype of the attachment in bugzilla to text/plain (there was no choice for svg).
Save the attachment to your local disk (for instance copy the text in notepad), name the file "test.svg", make sure the first line contains the <?xml (first line shoudn't be empty) and open in firefox (drag & drop the file on a firefox window). that should crash firefox.
Comment 4 Emmanuel Touzery 2005-12-05 05:35:30 PST
Created attachment 205037 [details]
CRASHER!! correct mimetype: opening this attachment should crash firefox

i left the other attachment to make it easy to get the faulty SVG for local experiments (if the browser crashes it's annoying to get the file contents)
Comment 5 Ria Klaassen (not reading all bugmail) 2005-12-05 06:18:10 PST
OK..
Trunk: TB12620259X
Branch: TB12620314E
Comment 6 timeless 2005-12-05 09:07:58 PST
Incident ID: 12620259
Stack Signature	nsSVGGradientFrame::GetNextGradient 4d0a92fd
Product ID	FirefoxTrunk
Build ID	2005120405
Trigger Time	2005-12-05 06:15:07.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	firefox.exe + (0029de80)
URL visited	
User Comments	
Since Last Crash	19 sec
Total Uptime	27739 sec
Trigger Reason	Access violation
Source File, Line No.	c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/svg/base/src/nsSVGGradientFrame.cpp, line 621
Stack Trace 	
nsSVGGradientFrame::GetNextGradient  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/svg/base/src/nsSVGGradientFrame.cpp, line 621]
nsSVGGradientFrame::GetNextGradient  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/svg/base/src/nsSVGGradientFrame.cpp, line 626]
nsSVGRadialGradientFrame::PrivateGetCx  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/svg/base/src/nsSVGGradientFrame.cpp, line 947]
nsSVGLinearGradientFrame::GetX1  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/svg/base/src/nsSVGGradientFrame.cpp, line 1122]
CairoRadialGradient  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/svg/renderer/src/cairo/nsSVGCairoGradient.cpp, line 122]
CairoGradient  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/svg/renderer/src/cairo/nsSVGCairoGradient.cpp, line 157]
nsSVGCairoPathGeometry::Render  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/svg/renderer/src/cairo/nsSVGCairoPathGeometry.cpp, line 359]
nsSVGPathGeometryFrame::PaintSVG  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/svg/base/src/nsSVGPathGeometryFrame.cpp, line 286]
nsSVGOuterSVGFrame::Paint  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/svg/base/src/nsSVGOuterSVGFrame.cpp, line 829]
nsContainerFrame::PaintChild  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsContainerFrame.cpp, line 283]
nsContainerFrame::PaintChildren  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsContainerFrame.cpp, line 228]
nsHTMLContainerFrame::Paint  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsHTMLContainerFrame.cpp, line 84]
CanvasFrame::Paint  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsHTMLFrame.cpp, line 373]
PresShell::Paint  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 5480]
nsView::Paint  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/view/src/nsView.cpp, line 318]
nsViewManager::RenderDisplayListElement  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/view/src/nsViewManager.cpp, line 1468]
nsViewManager::RenderViews  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/view/src/nsViewManager.cpp, line 1380]
nsViewManager::Refresh  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/view/src/nsViewManager.cpp, line 930]
nsViewManager::DispatchEvent  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/view/src/nsViewManager.cpp, line 2047]
HandleEvent  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/view/src/nsView.cpp, line 176]
nsWindow::DispatchEvent  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/widget/src/windows/nsWindow.cpp, line 1162]
nsWindow::ProcessMessage  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/widget/src/windows/nsWindow.cpp, line 4284]
nsWindow::WindowProc  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/widget/src/windows/nsWindow.cpp, line 1351]
USER32.dll + 0x8709 (0x77d18709)
USER32.dll + 0x87eb (0x77d187eb)
USER32.dll + 0xb368 (0x77d1b368)
USER32.dll + 0xb3b4 (0x77d1b3b4)
ntdll.dll + 0xeae3 (0x7c90eae3)
USER32.dll + 0x89e8 (0x77d189e8)
nsAppShell::Run  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/widget/src/windows/nsAppShell.cpp, line 159]
nsAppStartup::Run  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/toolkit/components/startup/src/nsAppStartup.cpp, line 162]
main  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/browser/app/nsBrowserApp.cpp, line 61]
kernel32.dll + 0x16d4f (0x7c816d4f)
Comment 7 Samuel Sidler (old account; do not CC) 2005-12-05 12:48:06 PST
Crashes on Mac as well.
Comment 8 Leon Sha 2005-12-06 23:15:23 PST
I can see this crash on firefox 1.5. But not in trunk. I believe this has been fixed by another bug.
Comment 9 Ria Klaassen (not reading all bugmail) 2005-12-07 00:37:35 PST
(In reply to comment #8)
> I can see this crash on firefox 1.5. But not in trunk. I believe this has been
> fixed by another bug.
>
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20051206 Firefox/1.6a1 ID:2005120605
Still get a crash in the latest trunk: TB12691988Q
Have you tried it with a new profile? 
Comment 10 timeless 2005-12-07 00:43:44 PST
erm, picking trunk because that's what the talkback incident i quoted said. (i probably misgrabbed the version from comment 0).
Comment 11 Leon Sha 2005-12-07 01:07:04 PST
(In reply to comment #9)
> Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20051206
> Firefox/1.6a1 ID:2005120605
> Still get a crash in the latest trunk: TB12691988Q
> Have you tried it with a new profile? 
> 

Mozilla/5.0 (X11; U; SunOS i86pc; en-US; rv:1.9a1) Gecko/20051125 Firefox/1.6a1
I thought it is a platform independed bug.
With a new profile and not crash.
Comment 12 Emmanuel Touzery 2005-12-07 05:21:19 PST
(In reply to comment #11)
> I thought it is a platform independed bug.
> With a new profile and not crash.
> 

no crash, so what happens? the SVG is displayed? if you get text you clicked the wrong link. you must click the link "CRASHER!!".
The svg should look like three people in circle, colored in green.
Comment 13 Leon Sha 2005-12-07 18:52:36 PST
(In reply to comment #12)
> no crash, so what happens? the SVG is displayed? if you get text you clicked
> the wrong link. you must click the link "CRASHER!!".
> The svg should look like three people in circle, colored in green.
> 
Yes. The SVG is displayed.
And I did not click the wrong link.
The other link is text/plain. I can only see the text.
Also the "CRASHER!!" link crashed my firefox 1.5.
Comment 14 Florian 2005-12-11 07:51:32 PST
This SVG Image does the same:
http://www.phobeus.de/hosting/flo/images/FirefoxCrash.svg

(I used Inkscape too, to create this Image, but I changed some things with a usual text editor)
Comment 15 Florian 2005-12-11 08:24:28 PST
Created attachment 205553 [details]
very small svg file which crash Firefox 1.5

I reduced the size my svg file down to ten lines of code:

<?xml version="1.0" encoding="UTF-8"?>
<svg
	xmlns="http://www.w3.org/2000/svg"
	xmlns:xlink="http://www.w3.org/1999/xlink">
	<defs>
 		<linearGradient id="crashpart1"/>
		<radialGradient xlink:href="#crashpart1" id="crashpart2" />
	</defs>
	<rect style="fill:url(#crashpart2);" />
</svg>
Comment 16 Ria Klaassen (not reading all bugmail) 2005-12-11 08:34:42 PST
(In reply to comment #15)

That crashes indeed :)
Comment 17 timeless 2005-12-11 08:49:18 PST
please change the summary to describe the minimal crasher :)
Comment 18 Scooter Morris 2006-01-02 13:26:43 PST
Created attachment 207366 [details] [diff] [review]
Patch for crash
Comment 19 tor 2006-01-03 22:13:29 PST
Comment on attachment 207366 [details] [diff] [review]
Patch for crash

I think you also need to set aNextGrad to nsnull.
Comment 20 Scooter Morris 2006-01-04 13:10:38 PST
(In reply to comment #19)
> (From update of attachment 207366 [details] [diff] [review] [edit])
> I think you also need to set aNextGrad to nsnull.
> 

The return value for GetNextGradient is always checked, so there is little chance of a problem, but I agree that its a good discipline in any case.
Comment 21 Scooter Morris 2006-01-04 13:17:40 PST
Created attachment 207543 [details] [diff] [review]
Make sure to set aNextGrad to nsnull
Comment 22 Mike Schroepfer 2006-01-10 18:22:14 PST
Comment on attachment 207543 [details] [diff] [review]
Make sure to set aNextGrad to nsnull

Please land on trunk and target the 1.8.0.2 release.
Comment 23 Scooter Morris 2006-01-13 10:21:12 PST
Checked in on trunk:

cvs commit layout/svg/base/src/nsSVGGradientFrame.cpp
Checking in layout/svg/base/src/nsSVGGradientFrame.cpp;
/cvsroot/mozilla/layout/svg/base/src/nsSVGGradientFrame.cpp,v  <--  nsSVGGradientFrame.cpp
new revision: 1.21; previous revision: 1.20
done
Comment 24 Benjamin Smedberg AWAY UNTIL 2-AUG-2016 [:bsmedberg] 2006-01-30 13:20:14 PST
Comment on attachment 207543 [details] [diff] [review]
Make sure to set aNextGrad to nsnull

Approving vicariously for tor ;-)
Comment 25 Scooter Morris 2006-02-03 14:59:55 PST
Checked in on branch:
Checking in layout/svg/base/src/nsSVGGradientFrame.cpp;
/cvsroot/mozilla/layout/svg/base/src/nsSVGGradientFrame.cpp,v  <--  nsSVGGradientFrame.cpp
new revision: 1.14.2.6; previous revision: 1.14.2.5
done
Comment 26 Daniel Veditz [:dveditz] 2006-02-22 00:34:24 PST
Comment on attachment 207543 [details] [diff] [review]
Make sure to set aNextGrad to nsnull

approved for 1.8.0 branch, a=dveditz
Comment 27 Scooter Morris 2006-02-23 19:02:57 PST
Checked in on 1.8.0 branch
Comment 28 Ria Klaassen (not reading all bugmail) 2006-02-25 10:14:13 PST
*** Bug 328569 has been marked as a duplicate of this bug. ***
Comment 29 Jay Patel [:jay] 2006-03-02 15:55:30 PST
v.fixed on 1.8.0 branch with Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.0.1) Gecko/20060302 Firefox/1.5.0.1, no crash with either test svg file (saved first locally and image loaded fine, second small svg loads fine but I can't see it).

Note You need to log in before you can comment on or make changes to this bug.