338301 - path inside linearGradient crashes [@ nsSVGGraphicElement::GetLocalTransformMatrix]

Status: VERIFIED FIXED

(Core :: SVG, defect)

Description

[Jesse Ruderman]

Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.9a1) Gecko/20060516 Minefield/3.0a1

0    nsSVGGraphicElement::GetLocalTransformMatrix() + 116
1    nsSVGDefsFrame::GetCanvasTM() + 128
2    nsSVGPathGeometryFrame::GetCanvasTM(nsIDOMSVGMatrix**) + 208
3    nsSVGCairoPathGeometry::GeneratePath(nsSVGPathGeometryFrame*, _cairo*, nsISVGCairoCanvas*) + 76
4    nsSVGCairoPathGeometry::GetCoveredRegion(nsSVGPathGeometryFrame*, nsISVGRendererRegion**) + 76
5    nsSVGCairoPathGeometry::Update(nsSVGPathGeometryFrame*, unsigned, nsISVGRendererRegion**) + 128
6    nsSVGPathGeometryFrame::UpdateGraphic(unsigned, int) + 152
7    nsSVGPathGeometryFrame::NotifyRedrawUnsuspended() + 48

Comment 1

[Jesse Ruderman]

Attachment: testcase

Comment 2

[Niro]

Crashes also on Win XP (PC).
Please change OS and hardware values to "All"

Comment 3

[tor]

Attachment: inherit from containerframe, instead of svgdefs

Comment 4

[tor]

Attachment: cleanup of svg container frame inheritence and code duplication

Comment 5

[Robert O'Callahan (:roc) (email my personal email if necessary)]

How hard would it be to eliminate nsISVGContainerFrame in favour of nsSVGContainerFrame? I understand that nsSVGForeignObjectFrame would have to be split into an SVG frame with an anonymous block frame. Is that all?

Comment 6

[tor]

Attachment: remove nsISVGContainerFrame

Comment 7

[Robert O'Callahan (:roc) (email my personal email if necessary)]

At some stage we should clean up the duplicated code for handling local transforms.

Comment 8

[tor]

Checked in.

Comment 9

[Stephen Donner [:stephend] Not actively reading bugmail]

Verified FIXED in build 2006-06-05-08 of SeaMonkey trunk using https://bugzilla.mozilla.org/attachment.cgi?id=222349&action=view as a testcase under Windows XP.

Comment 10

[Jesse Ruderman]

Crashtest checked in.