<svg:text stroke-width="50%"> causes crash [@ nsSVGUtils::CoordToFloat]

RESOLVED FIXED

Status

()

--
critical
RESOLVED FIXED
12 years ago
10 years ago

People

(Reporter: jruderman, Assigned: tor)

Tracking

(Blocks: 1 bug, {crash, testcase})

Trunk
PowerPC
Mac OS X
crash, testcase
Points:
---
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

(crash signature)

Attachments

(2 attachments)

(Reporter)

Description

12 years ago
#0  0x0732f52c in nsSVGUtils::CoordToFloat (aPresContext=0x270498d0, aContent=0x270737f0, aCoord=@0x2dbb2f0) at /Users/admin/trunk/mozilla/layout/svg/base/src/nsSVGUtils.cpp:148
#1  0x0730f684 in nsSVGGeometryFrame::GetStrokeWidth (this=0x2dbb074) at /Users/admin/trunk/mozilla/layout/svg/base/src/nsSVGGeometryFrame.cpp:163
#2  0x0730fac4 in nsSVGGeometryFrame::HasStroke (this=0x2dbb074) at /Users/admin/trunk/mozilla/layout/svg/base/src/nsSVGGeometryFrame.cpp:241

CoordToFloat is passed an aContent that is an nsTextNode.  CoordToFloat's "case eStyleUnit_Percent" branch tries to QI aContent to nsIDOMSVGElement and then crashes dereferencing a null pointer.
(Reporter)

Comment 1

12 years ago
Created attachment 229432 [details]
testcase
(Reporter)

Updated

12 years ago
Blocks: 344905
(Assignee)

Comment 2

12 years ago
Created attachment 229484 [details] [diff] [review]
make sure we give the right context for glyph frames
Assignee: general → tor
Status: NEW → ASSIGNED
Attachment #229484 - Flags: review?(scootermorris)

Comment 3

12 years ago
Comment on attachment 229484 [details] [diff] [review]
make sure we give the right context for glyph frames

Looks right to me.
Attachment #229484 - Flags: review?(scootermorris) → review+
(Assignee)

Updated

12 years ago
Attachment #229484 - Flags: superreview?(roc)
Attachment #229484 - Flags: superreview?(roc) → superreview+
(Assignee)

Comment 4

12 years ago
Checked in.
Status: ASSIGNED → RESOLVED
Last Resolved: 12 years ago
Resolution: --- → FIXED
(Reporter)

Comment 5

11 years ago
Crashtest checked in.
Flags: in-testsuite?
(Reporter)

Updated

11 years ago
Flags: in-testsuite? → in-testsuite+
Crash Signature: [@ nsSVGUtils::CoordToFloat]
You need to log in before you can comment on or make changes to this bug.