divide by zero crash on intel mac with universal build when viewing SVG app

RESOLVED FIXED

Status

--
critical
RESOLVED FIXED
13 years ago
10 years ago

People

(Reporter: ahayes, Assigned: mark)

Tracking

({crash, fixed1.8.1, verified1.8.0.4})

1.8 Branch
PowerPC
Mac OS X
crash, fixed1.8.1, verified1.8.0.4
Bug Flags:
blocking1.8.0.4 +

Firefox Tracking Flags

(Not tracked)

Details

(URL)

Attachments

(1 attachment, 2 obsolete attachments)

(Reporter)

Description

13 years ago
User-Agent:       Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en) AppleWebKit/418 (KHTML, like Gecko) Safari/417.9.2
Build Identifier: Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en-US; rv:1.8.0.2) Gecko/20060403 Firefox/1.5.0.2

Opening a complex SVG/HTML/JS page causes Deer Park to crash when running on an intel mac but not when running the same universal version of Deer Park on a powerPC mac. Both are running OS X 10.4.6.

 (the site is internal, I may be able to put a copy outside for a developer if the crash report isn't enough to go on)

Reproducible: Always

Steps to Reproduce:
1. Navigate to page

Actual Results:  
Browser crash

Expected Results:  
Render the content

Date/Time:      2006-04-04 11:04:56.841 -0400
OS Version:     10.4.6 (Build 8I1119)
Report Version: 4

Command: firefox-bin
Path:    /Applications/DeerPark.app/Contents/MacOS/firefox-bin
Parent:  WindowServer [84]

Version: 1.5.0.2 (1.5.0.2)

PID:    448
Thread: 0

Exception:  EXC_ARITHMETIC (0x0003)
Codes:      EXC_I386_DIV (divide by zero)

Thread 0 Crashed:
0   org.mozilla.firefox            	0x000ec693 nsImageMac::LockImagePixels(int) + 749
1   org.mozilla.firefox            	0x000ed7b1 gfxImageFrame::LockImageData() + 41
2   org.mozilla.firefox            	0x00553e5a nsSVGImageFrame::ConvertFrame(gfxIImageFrame*) + 250
3   org.mozilla.firefox            	0x00554405 nsSVGImageFrame::PaintSVG(nsISVGRendererCanvas*, nsRect const&) + 229
4   org.mozilla.firefox            	0x00509e89 nsSVGGFrame::PaintSVG(nsISVGRendererCanvas*, nsRect const&) + 313
5   org.mozilla.firefox            	0x00509e89 nsSVGGFrame::PaintSVG(nsISVGRendererCanvas*, nsRect const&) + 313
6   org.mozilla.firefox            	0x00509e89 nsSVGGFrame::PaintSVG(nsISVGRendererCanvas*, nsRect const&) + 313
7   org.mozilla.firefox            	0x00509e89 nsSVGGFrame::PaintSVG(nsISVGRendererCanvas*, nsRect const&) + 313
8   org.mozilla.firefox            	0x00509e89 nsSVGGFrame::PaintSVG(nsISVGRendererCanvas*, nsRect const&) + 313
9   org.mozilla.firefox            	0x00509e89 nsSVGGFrame::PaintSVG(nsISVGRendererCanvas*, nsRect const&) + 313
10  org.mozilla.firefox            	0x00588b30 nsSVGOuterSVGFrame::Paint(nsPresContext*, nsIRenderingContext&, nsRect const&, nsFramePaintLayer, unsigned) + 360
11  org.mozilla.firefox            	0x0047d50a nsContainerFrame::PaintChild(nsPresContext*, nsIRenderingContext&, nsRect const&, nsIFrame*, nsFramePaintLayer, unsigned) + 206
12  org.mozilla.firefox            	0x0047d091 nsContainerFrame::PaintChildren(nsPresContext*, nsIRenderingContext&, nsRect const&, nsFramePaintLayer, unsigned) + 69
13  org.mozilla.firefox            	0x004e0758 nsHTMLContainerFrame::Paint(nsPresContext*, nsIRenderingContext&, nsRect const&, nsFramePaintLayer, unsigned) + 68
14  org.mozilla.firefox            	0x0052e794 CanvasFrame::Paint(nsPresContext*, nsIRenderingContext&, nsRect const&, nsFramePaintLayer, unsigned) + 130
15  org.mozilla.firefox            	0x00111d99 PresShell::Paint(nsIView*, nsIRenderingContext&, nsRect const&) + 245
16  org.mozilla.firefox            	0x0048c98d nsView::Paint(nsIRenderingContext&, nsRect const&, unsigned, int&) + 109
17  org.mozilla.firefox            	0x001c35c8 nsViewManager::RenderDisplayListElement(DisplayListElement2*, nsIRenderingContext*) + 152
18  org.mozilla.firefox            	0x001c7424 nsViewManager::RenderViews(nsView*, nsIRenderingContext&, nsRegion const&, nsIDrawingSurface*, nsVoidArray const&) + 524
19  org.mozilla.firefox            	0x001c8a51 nsViewManager::Refresh(nsView*, nsIRenderingContext*, nsIRegion*, unsigned) + 1509
20  org.mozilla.firefox            	0x001c9978 nsViewManager::DispatchEvent(nsGUIEvent*, nsEventStatus*) + 3018
21  org.mozilla.firefox            	0x0048d53e nsIView::GetViewFor(nsIWidget*) + 78
22  org.mozilla.firefox            	0x005f1e65 nsWindow::DispatchEvent(nsGUIEvent*, nsEventStatus&) + 87
23  org.mozilla.firefox            	0x005f1efd nsWindow::DispatchWindowEvent(nsGUIEvent&, nsEventStatus&) + 35
24  org.mozilla.firefox            	0x005f350d nsWindow::UpdateWidget(nsRect&, nsIRenderingContext*) + 377
25  org.mozilla.firefox            	0x005f34f2 nsWindow::UpdateWidget(nsRect&, nsIRenderingContext*) + 350
26  org.mozilla.firefox            	0x005f34f2 nsWindow::UpdateWidget(nsRect&, nsIRenderingContext*) + 350
27  org.mozilla.firefox            	0x005f34f2 nsWindow::UpdateWidget(nsRect&, nsIRenderingContext*) + 350
28  org.mozilla.firefox            	0x005f34f2 nsWindow::UpdateWidget(nsRect&, nsIRenderingContext*) + 350
29  org.mozilla.firefox            	0x005f34f2 nsWindow::UpdateWidget(nsRect&, nsIRenderingContext*) + 350
30  org.mozilla.firefox            	0x005f34f2 nsWindow::UpdateWidget(nsRect&, nsIRenderingContext*) + 350
31  org.mozilla.firefox            	0x005f34f2 nsWindow::UpdateWidget(nsRect&, nsIRenderingContext*) + 350
32  org.mozilla.firefox            	0x005f34f2 nsWindow::UpdateWidget(nsRect&, nsIRenderingContext*) + 350
33  org.mozilla.firefox            	0x005f3926 nsWindow::PaintUpdateRectProc(unsigned short, OpaqueRgnHandle*, Rect const*, void*) + 200
34  org.mozilla.firefox            	0x005f46c1 nsWindow::HandleUpdateEvent(OpaqueRgnHandle*) + 809
35  org.mozilla.firefox            	0x005f427b nsWindow::Update() + 293
36  org.mozilla.firefox            	0x002a4d99 nsMacWindow::WindowEventHandler(OpaqueEventHandlerCallRef*, OpaqueEventRef*, void*) + 445
37  com.apple.HIToolbox            	0x92ef88e3 DispatchEventToHandlers(EventTargetRec*, OpaqueEventRef*, HandlerCallRec*) + 1093
38  com.apple.HIToolbox            	0x92ef7f68 SendEventToEventTargetInternal(OpaqueEventRef*, OpaqueEventTargetRef*, HandlerCallRec*) + 304
39  com.apple.HIToolbox            	0x92ef7e2d SendEventToEventTargetWithOptions + 55
40  com.apple.HIToolbox            	0x92eff235 ToolboxEventDispatcherHandler(OpaqueEventHandlerCallRef*, OpaqueEventRef*, void*) + 357
41  com.apple.HIToolbox            	0x92ef8c9a DispatchEventToHandlers(EventTargetRec*, OpaqueEventRef*, HandlerCallRec*) + 2044
42  com.apple.HIToolbox            	0x92ef7f68 SendEventToEventTargetInternal(OpaqueEventRef*, OpaqueEventTargetRef*, HandlerCallRec*) + 304
43  com.apple.HIToolbox            	0x92eff0c8 SendEventToEventTarget + 56
44  com.apple.HIToolbox            	0x92f42d07 ToolboxEventDispatcher + 81
45  com.apple.HIToolbox            	0x92fee258 GetOrPeekEvent + 338
46  com.apple.HIToolbox            	0x92fee074 GetNextEventMatchingMask + 462
47  com.apple.HIToolbox            	0x92fedd35 WNEInternal + 123
48  com.apple.HIToolbox            	0x92fedca3 WaitNextEvent + 57
49  org.mozilla.firefox            	0x005ea428 nsMacMessagePump::GetEvent(EventRecord&) + 82
50  org.mozilla.firefox            	0x005eb18d nsMacMessagePump::DoMessagePump() + 45
51  org.mozilla.firefox            	0x002a0c4c nsAppShell::Run() + 38
52  org.mozilla.firefox            	0x0033a642 nsAppStartup::Run() + 50
53  org.mozilla.firefox            	0x00006254 XRE_main + 5246
54  org.mozilla.firefox            	0x000030f8 main + 32
55  org.mozilla.firefox            	0x0000307e start + 270
56  org.mozilla.firefox            	0x00002f99 start + 41

Thread 1:
0   libSystem.B.dylib              	0x9001aa1c select + 12
1   libnspr4.dylib                 	0x00faf8e8 PR_Poll + 134
2   org.mozilla.firefox            	0x003b2f01 nsSocketTransportService::Poll(unsigned*) + 85
3   org.mozilla.firefox            	0x003b34e6 nsSocketTransportService::Run() + 480
4   libxpcom_core.dylib            	0x00ef1add nsThread::Main(void*) + 41
5   libnspr4.dylib                 	0x00fb0f29 PR_Select + 813
6   libSystem.B.dylib              	0x90024a27 _pthread_body + 84

Thread 2:
0   libSystem.B.dylib              	0x90049207 semaphore_timedwait_signal_trap + 7
1   libnspr4.dylib                 	0x00fac5c0 PR_Lock + 246
2   libnspr4.dylib                 	0x00fac917 PR_WaitCondVar + 75
3   libxpcom_core.dylib            	0x00ef3df0 TimerThread::Run() + 74
4   libxpcom_core.dylib            	0x00ef1add nsThread::Main(void*) + 41
5   libnspr4.dylib                 	0x00fb0f29 PR_Select + 813
6   libSystem.B.dylib              	0x90024a27 _pthread_body + 84

Thread 3:
0   libSystem.B.dylib              	0x90049207 semaphore_timedwait_signal_trap + 7
1   libnspr4.dylib                 	0x00fac5c0 PR_Lock + 246
2   libnspr4.dylib                 	0x00fac917 PR_WaitCondVar + 75
3   org.mozilla.firefox            	0x00377d21 nsIOThreadPool::ThreadFunc(void*) + 145
4   libnspr4.dylib                 	0x00fb0f29 PR_Select + 813
5   libSystem.B.dylib              	0x90024a27 _pthread_body + 84

Thread 4:
0   libSystem.B.dylib              	0x9002755c kevent + 12
1   ...ple.CoreServices.CarbonCore 	0x90ca9c14 PrivateMPEntryPoint + 51
2   libSystem.B.dylib              	0x90024a27 _pthread_body + 84

Thread 5:
0   libSystem.B.dylib              	0x900250c7 semaphore_wait_signal_trap + 7
1   ...ple.CoreServices.CarbonCore 	0x90ca9dba MPWaitOnQueue + 198
2   com.apple.DesktopServices      	0x92645fc7 TNodeSyncTask::SyncTaskProc(void*) + 143
3   ...ple.CoreServices.CarbonCore 	0x90ca9c14 PrivateMPEntryPoint + 51
4   libSystem.B.dylib              	0x90024a27 _pthread_body + 84

Thread 6:
0   libSystem.B.dylib              	0x90049207 semaphore_timedwait_signal_trap + 7
1   ...ple.CoreServices.CarbonCore 	0x90ca9dba MPWaitOnQueue + 198
2   com.apple.DesktopServices      	0x92668263 TPropertyTask::PropertyTaskProc(void*) + 101
3   ...ple.CoreServices.CarbonCore 	0x90ca9c14 PrivateMPEntryPoint + 51
4   libSystem.B.dylib              	0x90024a27 _pthread_body + 84

Thread 0 crashed with i386 Thread State:
eax: 0x00000000    ebx: 0x17df9000 ecx:0x00000000 edx: 0x00000000
edi: 0x17c24000    esi: 0x00000000 ebp:0xbfffdef8 esp: 0xbfffde70
 ss: 0x0000002f    efl: 0x00010246 eip:0x000ec693  cs: 0x00000027
 ds: 0x0000002f     es: 0x0000002f  fs:0x00000000  gs: 0x00000037

Binary Images Description:
    0x1000 -   0x90ffff org.mozilla.firefox 1.5.0.2	/Applications/DeerPark.app/Contents/MacOS/firefox-bin
  0xe13000 -   0xe97fff libmozjs.dylib 	/Applications/DeerPark.app/Contents/MacOS/libmozjs.dylib
  0xeae000 -   0xeaefff libxpcom.dylib 	/Applications/DeerPark.app/Contents/MacOS/libxpcom.dylib
  0xeb2000 -   0xf1ffff libxpcom_core.dylib 	/Applications/DeerPark.app/Contents/MacOS/libxpcom_core.dylib
  0xf80000 -   0xf85fff libplds4.dylib 	/Applications/DeerPark.app/Contents/MacOS/libplds4.dylib
  0xf8a000 -   0xf90fff libplc4.dylib 	/Applications/DeerPark.app/Contents/MacOS/libplc4.dylib
  0xf96000 -   0xfbbfff libnspr4.dylib 	/Applications/DeerPark.app/Contents/MacOS/libnspr4.dylib
  0xfcc000 -   0xfe5fff libsmime3.dylib 	/Applications/DeerPark.app/Contents/MacOS/libsmime3.dylib
 0x1808000 -  0x1823fff libssl3.dylib 	/Applications/DeerPark.app/Contents/MacOS/libssl3.dylib
 0x182b000 -  0x1880fff libnss3.dylib 	/Applications/DeerPark.app/Contents/MacOS/libnss3.dylib
 0x189c000 -  0x18abfff libxpcom_compat.dylib 	/Applications/DeerPark.app/Contents/MacOS/libxpcom_compat.dylib
 0x1a05000 -  0x1a88fff libsoftokn3.dylib 	/Applications/DeerPark.app/Contents/MacOS/libsoftokn3.dylib
 0x1eec000 -  0x1eedfff com.apple.textencoding.unicode 2.1	/System/Library/TextEncodings/Unicode Encodings.bundle/Contents/MacOS/Unicode Encodings
0x15129000 - 0x15154fff libnssckbi.dylib 	/Applications/DeerPark.app/Contents/MacOS/libnssckbi.dylib
0x8fe00000 - 0x8fe4bfff dyld 44.17	/usr/lib/dyld
0x90000000 - 0x9016efff libSystem.B.dylib 	/usr/lib/libSystem.B.dylib
0x901be000 - 0x901c0fff libmathCommon.A.dylib 	/usr/lib/system/libmathCommon.A.dylib
0x901c2000 - 0x901fefff com.apple.CoreText 1.1.0 (???)	/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/CoreText.framework/Versions/A/CoreText
0x90225000 - 0x902fafff ATS 	/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ATS.framework/Versions/A/ATS
0x9031a000 - 0x9076afff com.apple.CoreGraphics 1.258.27 (???)	/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/CoreGraphics.framework/Versions/A/CoreGraphics
0x90801000 - 0x908c9fff com.apple.CoreFoundation 6.4.5 (368.26)	/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
0x90907000 - 0x90907fff com.apple.CoreServices 10.4 (???)	/System/Library/Frameworks/CoreServices.framework/Versions/A/CoreServices
0x90909000 - 0x909fcfff libicucore.A.dylib 	/usr/lib/libicucore.A.dylib
0x90a4c000 - 0x90acbfff libobjc.A.dylib 	/usr/lib/libobjc.A.dylib
0x90af4000 - 0x90b57fff libstdc++.6.dylib 	/usr/lib/libstdc++.6.dylib
0x90bc6000 - 0x90bcdfff libgcc_s.1.dylib 	/usr/lib/libgcc_s.1.dylib
0x90bd2000 - 0x90c42fff com.apple.framework.IOKit 1.4.2 (???)	/System/Library/Frameworks/IOKit.framework/Versions/A/IOKit
0x90c57000 - 0x90c69fff libauto.dylib 	/usr/lib/libauto.dylib
0x90c6f000 - 0x90f14fff com.apple.CoreServices.CarbonCore 682.10 (679)	/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/CarbonCore.framework/Versions/A/CarbonCore
0x90f57000 - 0x90fbffff com.apple.CoreServices.OSServices 4.1	/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/OSServices.framework/Versions/A/OSServices
0x90ff7000 - 0x91035fff com.apple.CFNetwork 129.13	/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/CFNetwork.framework/Versions/A/CFNetwork
0x91047000 - 0x91057fff com.apple.WebServices 1.1.3 (1.1.0)	/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/WebServicesCore.framework/Versions/A/WebServicesCore
0x91062000 - 0x910e0fff com.apple.SearchKit 1.0.5	/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/SearchKit.framework/Versions/A/SearchKit
0x91115000 - 0x91133fff com.apple.Metadata 10.4.4 (121.36)	/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/Metadata.framework/Versions/A/Metadata
0x9113f000 - 0x9114dfff libz.1.dylib 	/usr/lib/libz.1.dylib
0x91150000 - 0x91303fff com.apple.security 4.2.1 (24989)	/System/Library/Frameworks/Security.framework/Versions/A/Security
0x913f1000 - 0x913f9fff com.apple.DiskArbitration 2.1	/System/Library/Frameworks/DiskArbitration.framework/Versions/A/DiskArbitration
0x91400000 - 0x91426fff com.apple.SystemConfiguration 1.8.5	/System/Library/Frameworks/SystemConfiguration.framework/Versions/A/SystemConfiguration
0x91438000 - 0x9143ffff libbsm.dylib 	/usr/lib/libbsm.dylib
0x91443000 - 0x914bcfff com.apple.audio.CoreAudio 3.0.3	/System/Library/Frameworks/CoreAudio.framework/Versions/A/CoreAudio
0x9150a000 - 0x9150afff com.apple.ApplicationServices 10.4 (???)	/System/Library/Frameworks/ApplicationServices.framework/Versions/A/ApplicationServices
0x9150c000 - 0x91537fff com.apple.AE 314 (313)	/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/AE.framework/Versions/A/AE
0x9154a000 - 0x9161efff com.apple.ColorSync 4.4.6	/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ColorSync.framework/Versions/A/ColorSync
0x91657000 - 0x916d4fff com.apple.print.framework.PrintCore 4.5 (177.10)	/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/PrintCore.framework/Versions/A/PrintCore
0x91701000 - 0x917abfff com.apple.QD 3.10.8 (???)	/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/QD.framework/Versions/A/QD
0x917d1000 - 0x9181cfff com.apple.HIServices 1.5.2 (???)	/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/HIServices.framework/Versions/A/HIServices
0x9183b000 - 0x91851fff com.apple.LangAnalysis 1.6.3	/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/LangAnalysis.framework/Versions/A/LangAnalysis
0x9185d000 - 0x91877fff com.apple.FindByContent 1.5	/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/FindByContent.framework/Versions/A/FindByContent
0x91881000 - 0x918befff com.apple.LaunchServices 176	/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/LaunchServices.framework/Versions/A/LaunchServices
0x918d2000 - 0x918ddfff com.apple.speech.synthesis.framework 3.4	/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/SpeechSynthesis.framework/Versions/A/SpeechSynthesis
0x918e4000 - 0x9191bfff com.apple.ImageIO.framework 1.4.6	/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ImageIO.framework/Versions/A/ImageIO
0x9192d000 - 0x919dffff libcrypto.0.9.7.dylib 	/usr/lib/libcrypto.0.9.7.dylib
0x91a25000 - 0x91a3bfff libcups.2.dylib 	/usr/lib/libcups.2.dylib
0x91a40000 - 0x91a5cfff libJPEG.dylib 	/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ImageIO.framework/Versions/A/Resources/libJPEG.dylib
0x91a61000 - 0x91abffff libJP2.dylib 	/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ImageIO.framework/Versions/A/Resources/libJP2.dylib
0x91acf000 - 0x91ad3fff libGIF.dylib 	/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ImageIO.framework/Versions/A/Resources/libGIF.dylib
0x91ad5000 - 0x91b30fff libRaw.dylib 	/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ImageIO.framework/Versions/A/Resources/libRaw.dylib
0x91b34000 - 0x91b71fff libTIFF.dylib 	/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ImageIO.framework/Versions/A/Resources/libTIFF.dylib
0x91b77000 - 0x91b91fff libPng.dylib 	/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ImageIO.framework/Versions/A/Resources/libPng.dylib
0x91b96000 - 0x91b98fff libRadiance.dylib 	/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ImageIO.framework/Versions/A/Resources/libRadiance.dylib
0x91b9a000 - 0x91b9afff com.apple.Accelerate 1.2.1 (Accelerate 1.2.1)	/System/Library/Frameworks/Accelerate.framework/Versions/A/Accelerate
0x91b9c000 - 0x91c22fff com.apple.vImage 2.3	/System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vImage.framework/Versions/A/vImage
0x91c29000 - 0x91c29fff com.apple.Accelerate.vecLib 3.2.1 (vecLib 3.2.1)	/System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vecLib.framework/Versions/A/vecLib
0x91c2b000 - 0x91c70fff libvMisc.dylib 	/System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vecLib.framework/Versions/A/libvMisc.dylib
0x91c78000 - 0x91c9dfff libvDSP.dylib 	/System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vecLib.framework/Versions/A/libvDSP.dylib
0x91ca4000 - 0x92227fff libBLAS.dylib 	/System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vecLib.framework/Versions/A/libBLAS.dylib
0x92264000 - 0x92616fff libLAPACK.dylib 	/System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vecLib.framework/Versions/A/libLAPACK.dylib
0x92643000 - 0x926c7fff com.apple.DesktopServices 1.3.3	/System/Library/PrivateFrameworks/DesktopServicesPriv.framework/Versions/A/DesktopServicesPriv
0x92703000 - 0x92935fff com.apple.Foundation 6.4.5 (567.26)	/System/Library/Frameworks/Foundation.framework/Versions/C/Foundation
0x92a41000 - 0x92b1ffff libxml2.2.dylib 	/usr/lib/libxml2.2.dylib
0x92b3c000 - 0x92c29fff libiconv.2.dylib 	/usr/lib/libiconv.2.dylib
0x92c39000 - 0x92c50fff libGL.dylib 	/System/Library/Frameworks/OpenGL.framework/Versions/A/Libraries/libGL.dylib
0x92c5b000 - 0x92cb2fff libGLU.dylib 	/System/Library/Frameworks/OpenGL.framework/Versions/A/Libraries/libGLU.dylib
0x92cc6000 - 0x92cc6fff com.apple.Carbon 10.4 (???)	/System/Library/Frameworks/Carbon.framework/Versions/A/Carbon
0x92cc8000 - 0x92cd8fff com.apple.ImageCapture 3.0.3	/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/ImageCapture.framework/Versions/A/ImageCapture
0x92ce6000 - 0x92ceefff com.apple.speech.recognition.framework 3.5	/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/SpeechRecognition.framework/Versions/A/SpeechRecognition
0x92cf4000 - 0x92cf9fff com.apple.securityhi 2.0.1 (24742)	/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/SecurityHI.framework/Versions/A/SecurityHI
0x92cff000 - 0x92d90fff com.apple.ink.framework 101.2.1 (71)	/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/Ink.framework/Versions/A/Ink
0x92da4000 - 0x92da7fff com.apple.help 1.0.3 (32.1)	/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/Help.framework/Versions/A/Help
0x92daa000 - 0x92dc7fff com.apple.openscripting 1.2.5 (???)	/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/OpenScripting.framework/Versions/A/OpenScripting
0x92dd7000 - 0x92dddfff com.apple.print.framework.Print 5.1 (192.3)	/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/Print.framework/Versions/A/Print
0x92de3000 - 0x92e46fff com.apple.htmlrendering 66.1 (1.1.3)	/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HTMLRendering.framework/Versions/A/HTMLRendering
0x92e6a000 - 0x92eabfff com.apple.NavigationServices 3.4.4 (3.4.3)	/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/NavigationServices.framework/Versions/A/NavigationServices
0x92ed2000 - 0x92edffff com.apple.audio.SoundManager 3.9.1	/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/CarbonSound.framework/Versions/A/CarbonSound
0x92ee6000 - 0x92eebfff com.apple.CommonPanels 1.2.3 (73)	/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/CommonPanels.framework/Versions/A/CommonPanels
0x92ef0000 - 0x931e2fff com.apple.HIToolbox 1.4.6 (???)	/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox
0x932e7000 - 0x932f2fff com.apple.opengl 1.4.9	/System/Library/Frameworks/OpenGL.framework/Versions/A/OpenGL
0x93361000 - 0x93361fff com.apple.Cocoa 6.4 (???)	/System/Library/Frameworks/Cocoa.framework/Versions/A/Cocoa
0x93363000 - 0x93a1cfff com.apple.AppKit 6.4.5 (824.35)	/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit
0x93d9d000 - 0x93e17fff com.apple.CoreData 90	/System/Library/Frameworks/CoreData.framework/Versions/A/CoreData
0x93e50000 - 0x93f10fff com.apple.audio.toolbox.AudioToolbox 1.4.2	/System/Library/Frameworks/AudioToolbox.framework/Versions/A/AudioToolbox
0x93f4f000 - 0x93f4ffff com.apple.audio.units.AudioUnit 1.4.2	/System/Library/Frameworks/AudioUnit.framework/Versions/A/AudioUnit
0x93f51000 - 0x940fffff com.apple.QuartzCore 1.4.7	/System/Library/Frameworks/QuartzCore.framework/Versions/A/QuartzCore
0x9414d000 - 0x9418efff libsqlite3.0.dylib 	/usr/lib/libsqlite3.0.dylib
0x94196000 - 0x941cffff libGLImage.dylib 	/System/Library/Frameworks/OpenGL.framework/Versions/A/Libraries/libGLImage.dylib
0x9434a000 - 0x94359fff libCGATS.A.dylib 	/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/CoreGraphics.framework/Versions/A/Resources/libCGATS.A.dylib
0x94360000 - 0x9436bfff libCSync.A.dylib 	/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/CoreGraphics.framework/Versions/A/Resources/libCSync.A.dylib
0x943b7000 - 0x943d1fff libRIP.A.dylib 	/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/CoreGraphics.framework/Versions/A/Resources/libRIP.A.dylib
0x943d7000 - 0x94688fff com.apple.QuickTime 7.0.4	/System/Library/Frameworks/QuickTime.framework/Versions/A/QuickTime

Model: MacBookPro1,1, BootROM MBP11.0044.B02, 2 processors, Intel Core Duo, 2 GHz, 1 GB
Graphics: ATI Radeon X1600, ATY,RadeonX1600, PCIe, 256 MB
Memory Module: DIMM1/BANK 1, 1 GB, DDR2 SDRAM, 667 MHz
AirPort: spairport_wireless_card_type_airport_extreme (0x168C, 0x86), 0.1.17
Bluetooth: Version 1.7.3f4, 2 service, 0 devices, 1 incoming serial ports
Network Service: AirPort, AirPort, en1
Serial ATA Device: FUJITSU MHV2100BH, 93.16 GB
Parallel ATA Device: MATSHITADVD-R   UJ-857
USB Device: Built-in iSight, Micron, Up to 480 Mb/sec, 500 mA
USB Device: Apple Internal Keyboard / Trackpad, Apple Computer, Up to 12 Mb/sec, 500 mA
USB Device: Macally Optical iceJr, Macally Peripherals, Up to 1.5 Mb/sec, 500 mA
USB Device: Bluetooth HCI, Up to 12 Mb/sec, 500 mA
USB Device: IR Receiver, Apple Computer, Inc., Up to 12 Mb/sec, 500 mA
(Reporter)

Comment 1

13 years ago
Just some additional info, the version of DeerPark I'm using is the one listed on the Mac:Intel page of the wiki and obtained here:

http://ftp.mozilla.org/pub/mozilla.org/firefox/tinderbox-builds/maya-Test-1.8.0-Uni/firefox-1.5.0.2.en-US.mac.dmg

I'm not sure if this bug should be filed under the 1.8 branch or not. Sorry.
Could you put a copy outside for me? I might to reduce it to a single testcase.
But first I need to check if it also crashes on current trunk build.
Ok, I've tried on Firefox1.5.0.1 and current trunk build. Neither of them are crashing for me. I'm on windows.
So I guess this is some sort of issue for Firefox under Intel Mac?
(Reporter)

Comment 4

13 years ago
Thanks Martijn. We're working towards an open source release of the atlas framework we are developing but we're not there yet. Our developer is away for some time and I'm unable to reduce this to a simple test case, but I have put up an example of what works and what doesn't so people can reproduce this.

http://devel0.gcrc.carleton.ca/~amoshayes/atlas/pages/

I remember reading elsewhere that something about PPC "handles" divide by zero whereas on intel it doesn't and that it was an issue when porting for universal mac binaries. Note that Firefox 1.5.0.1 does not crash on my content on Windows (or on PPC mac)... so I'm guessing it has something to do with some mac specific rendering code in there somewhere that is only now showing its divide by zero bugs thanks to the switch.
Adjusting Version, cc:ing some Mac folks, requesting a 1.8.0.3 block, confirming based on Phil's reproduction of this crash on another site.
Status: UNCONFIRMED → NEW
Ever confirmed: true
Flags: blocking1.8.0.3?
Version: Trunk → 1.8 Branch

Comment 6

13 years ago
Reproducer URL -- this will crash your Intel Mac: http://taschenorakel.de/mathias/tmp/evoappmnt-glossy.svg

Comment 7

13 years ago
At shaver's urging, I tried again with Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.8.0.2) Gecko/20060308 Firefox/1.5.0.2 under Rosetta -- no crash.

To recap our findings to date:

- The crash does not occur with Universal binaries on PPC Macs

- The crash does not occur with PPC binaries running under Rosetta on Intel Macs

- The crash occurs with Universal binaries running on Intel Macs
(Assignee)

Comment 8

13 years ago
Probably this:

http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/gfx/src/mac/nsImageMac.cpp&rev=1.79.4.1&mark=582-584#572

Those are the only potentially-evil divides in nsImageMac, unless widths and heights ever find themselves zero.  I'll take a look at this later tonight when I'm home and in front of an x86 Mac.
(Assignee)

Updated

13 years ago
Assignee: general → mark
Component: SVG → GFX: Mac
(Assignee)

Comment 9

13 years ago
Created attachment 217245 [details] [diff] [review]
Match PPC behavior on x86

This prevents the crash on x86 and makes it match the ppc behavior, but I don't think that the ppc behavior was right in the first place.  Matching the ppc behavior is, of course, the safest approach.  It seems to me like |alpha| and |255| are reversed here.  As it stands now, the assignment overflows (for an 8-bit quantity) and gives useless results when |alpha| != 0 or 255.

http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/gfx/src/mac/nsImageMac.cpp&rev=1.79.4.1&mark=582-584#572

Javier, you wrote the code in question (bug 283091), what do you think?
(Assignee)

Comment 10

13 years ago
Created attachment 217248 [details] [diff] [review]
What I think it should do
Attachment #217248 - Flags: review?(jhpedemonte)
(Assignee)

Updated

13 years ago
Attachment #217248 - Attachment description: What I think it should doo → What I think it should do
Comment on attachment 217245 [details] [diff] [review]
Match PPC behavior on x86

The point of this code is to go from a pre-multiplied value to the separate channels, so this first patch is correct.  It should not overflow, since we are first casting to a 32-bit value before doing the operations.
Attachment #217245 - Flags: review+

Updated

13 years ago
Attachment #217248 - Flags: review?(jhpedemonte) → review-
(Assignee)

Comment 12

13 years ago
Comment on attachment 217245 [details] [diff] [review]
Match PPC behavior on x86

Oh, I didn't realize that the values were premultiplied, I thought that this was doing the inverse operation.  Since they're premultiplied, there's no range problem (but there is a tiny bit of truncation).
Attachment #217245 - Flags: superreview?(shaver)
(Assignee)

Comment 13

13 years ago
(the truncation is a result of working with premultiplied values, and there's nothing we can do about it here.  shouldn't matter by the time it hits the display anyway.)

Comment 14

13 years ago
Crash, important for UB.  a=timr for drivers.
Flags: blocking1.8.0.3? → blocking1.8.0.3+
Do we protect against width and height being zero?  It'd be good for an SVG person to weigh in on that.
Comment on attachment 217245 [details] [diff] [review]
Match PPC behavior on x86

sr=shaver, requesting approval
Attachment #217245 - Flags: superreview?(shaver)
Attachment #217245 - Flags: superreview+
Attachment #217245 - Flags: approval1.8.0.3?
I don't think so:

http://lxr.mozilla.org/seamonkey/source/layout/svg/base/src/nsSVGImageFrame.cpp#318

tor?

Since SVG scales, and since width/height are floats (not ints), maybe we want to bail out of painting if width or height are less than 1 device pixel. Then again the image should probably be contributing to that one pixel.
Although maybe this line indicates there must be some sort of check:

http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/layout/svg/base/src/nsSVGImageFrame.cpp&rev=1.24&mark=413#413

I don't know this code.
(Assignee)

Comment 19

13 years ago
Comment on attachment 217245 [details] [diff] [review]
Match PPC behavior on x86

This patch is bad too, because it does not advance tmp.  The |else| branch needs to do |tmp += 3|.
Attachment #217245 - Attachment is obsolete: true
Attachment #217245 - Flags: approval1.8.0.3?
(Assignee)

Updated

13 years ago
Attachment #217248 - Attachment is obsolete: true
(Assignee)

Comment 20

13 years ago
Created attachment 217426 [details] [diff] [review]
Include pointer adjustment
Attachment #217426 - Flags: review?(jhpedemonte)

Updated

13 years ago
Attachment #217426 - Flags: review?(jhpedemonte) → review+
(Assignee)

Updated

13 years ago
Attachment #217426 - Flags: superreview?(shaver)
(Assignee)

Updated

13 years ago
Attachment #217426 - Flags: review?(vladimir)
Comment on attachment 217426 [details] [diff] [review]
Include pointer adjustment

r=me
Attachment #217426 - Flags: review?(vladimir) → review+
(Assignee)

Comment 22

13 years ago
Comment on attachment 217426 [details] [diff] [review]
Include pointer adjustment

shaver gave sr+ in an e-mail.
Attachment #217426 - Flags: superreview?(shaver)
Attachment #217426 - Flags: superreview+
Attachment #217426 - Flags: approval1.8.0.3?
Attachment #217426 - Flags: approval-branch-1.8.1+
(Assignee)

Comment 23

13 years ago
Checked in on the trunk.
Status: NEW → RESOLVED
Last Resolved: 13 years ago
Resolution: --- → FIXED
(Assignee)

Comment 24

13 years ago
*** Bug 333282 has been marked as a duplicate of this bug. ***
(Assignee)

Comment 25

13 years ago
Not SVG-only, see duped bug 333282.
(Assignee)

Comment 26

13 years ago
Fixed on 1.8.1
Keywords: fixed1.8.1
Comment on attachment 217426 [details] [diff] [review]
Include pointer adjustment

approved for 1.8.0 branch, a=dveditz for drivers
Attachment #217426 - Flags: approval1.8.0.3? → approval1.8.0.3+
(Assignee)

Comment 28

13 years ago
Checked in, 1_8_0 for 1.8.0.3
Keywords: fixed1.8.0.3
verified on the Intel Mac using a UB build on the 1.5.0.x branch using Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en-US; rv:1.8.0.4) Gecko/20060504 Firefox/1.5.0.4. I do not crash using the URL specified in Comment 6.

I did note that the graphic does look different in the UB build then it does running a PPC build (not under Rosetta)
Keywords: fixed1.8.0.4 → verified1.8.0.4
(Assignee)

Comment 30

13 years ago
Marcia, is it different in a bad or broken way?  (I'm not in front of an x86 Mac now and can't check.)

Comment 31

12 years ago
*** Bug 338775 has been marked as a duplicate of this bug. ***
Keywords: crash
Product: Core → Core Graveyard
You need to log in before you can comment on or make changes to this bug.