SVG Pattern crash [@ nsSVGUtils::RemoveObserver] [@ nsPropertyTable::GetPropertyInternal]

RESOLVED FIXED

Status

()

Core
SVG
--
critical
RESOLVED FIXED
12 years ago
11 years ago

People

(Reporter: Jesse Ruderman, Assigned: tor)

Tracking

(Blocks: 1 bug, {crash, regression, testcase})

Trunk
PowerPC
Mac OS X
crash, regression, testcase
Points:
---
Dependency tree / graph
Bug Flags:
wanted1.8.1.x -
wanted1.8.0.x -
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [sg:critical] post 1.8 branch, crash signature)

Attachments

(3 attachments)

(Reporter)

Description

12 years ago
Quitting Firefox with the testcase loaded makes it crash.  A Mac debug build crashes with a random address on top of nsSVGUtils::RemoveObserver; a Mac nightly crashes with a random address on top of nsPropertyTable::GetPropertyInternal.
(Reporter)

Comment 1

12 years ago
Created attachment 229329 [details]
testcase
(Reporter)

Comment 2

12 years ago
Regressed between 2006-05-27 and 2006-05-28 Mac trunk nightlies.  Guessing that this is a regression from bug 339375, "Switch paint servers fields to properties", since the only other SVG checkin in that period was backed out.
Blocks: 339375
Flags: blocking1.9a1?
Keywords: regression
Whiteboard: [sg:critical]
(Reporter)

Comment 3

12 years ago
Created attachment 229330 [details]
stack trace (mac debug)
(Reporter)

Updated

12 years ago
Blocks: 344905
(Assignee)

Comment 4

12 years ago
Created attachment 229481 [details] [diff] [review]
remove properties before frame is deleted
Assignee: general → tor
Status: NEW → ASSIGNED
Attachment #229481 - Flags: review?(roc)
Attachment #229481 - Flags: superreview+
Attachment #229481 - Flags: review?(roc)
Attachment #229481 - Flags: review+
(Assignee)

Comment 5

12 years ago
Checked in.
Status: ASSIGNED → RESOLVED
Last Resolved: 12 years ago
Resolution: --- → FIXED
Whiteboard: [sg:critical] → [sg:critical] post 1.8 branch
Group: security
Flags: wanted1.8.1.x-
Flags: wanted1.8.0.x-

Updated

11 years ago
Flags: blocking1.9a1?
(Reporter)

Comment 6

11 years ago
Crashtest checked in.
Flags: in-testsuite+
Crash Signature: [@ nsSVGUtils::RemoveObserver] [@ nsPropertyTable::GetPropertyInternal]
You need to log in before you can comment on or make changes to this bug.