348730 - SVG crash [@ nsSVGGradientFrame::GetGradientTransform()]

Status: VERIFIED FIXED

(Core :: SVG, defect)

Description

[Steve England [:stevee]]

1. Visit URL
2. Crash!

TB22116273Y, TB22116842E

Comment 1

[Steve England [:stevee]]

Forgot to mention, crash occurs on
Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8.1b1) Gecko/20060815 BonEcho/2.0b1 ID:2006081504

I see no crash on trunk build
Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.9a1) Gecko/20060811 Minefield/3.0a1 ID:2006081104 [cairo]

Comment 2

[Stebs]

Talkback with Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1b1) Gecko/20060815 BonEcho/2.0b1 ID:2006081403: TB22117326K
Talback with Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1b1) Gecko/20060815 BonEcho/2.0b1 ID:2006081504: TB22117657G

Comment 3

[Adam Guthrie]

Incident ID: 22117326
Stack Signature	nsSVGGradientFrame::GetGradientTransform 5fe24679
Product ID	Firefox2
Build ID	2006081403
Trigger Time	2006-08-15 08:37:38.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	firefox.exe + (003152e1)
URL visited	
User Comments	Opening an SVG
Since Last Crash	1393 sec
Total Uptime	43988 sec
Trigger Reason	Access violation
Source File, Line No.	c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/svg/base/src/nsSVGGradientFrame.cpp, line 543
Stack Trace 	
nsSVGGradientFrame::GetGradientTransform  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/svg/base/src/nsSVGGradientFrame.cpp, line 543]
nsSVGGradientFrame::GetGradientTransform  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/svg/base/src/nsSVGGradientFrame.cpp, line 568]
CairoGradient  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/svg/renderer/src/cairo/nsSVGCairoGradient.cpp, line 163]
nsSVGCairoPathGeometry::Render  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/svg/renderer/src/cairo/nsSVGCairoPathGeometry.cpp, line 356]
nsSVGPathGeometryFrame::PaintSVG  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/svg/base/src/nsSVGPathGeometryFrame.cpp, line 248]
nsSVGGFrame::PaintSVG  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/svg/base/src/nsSVGGFrame.cpp, line 134]
nsSVGGFrame::PaintSVG  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/svg/base/src/nsSVGGFrame.cpp, line 134]
nsSVGGFrame::PaintSVG  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/svg/base/src/nsSVGGFrame.cpp, line 134]
nsSVGOuterSVGFrame::Paint  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/svg/base/src/nsSVGOuterSVGFrame.cpp, line 845]
nsContainerFrame::PaintChild  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/generic/nsContainerFrame.cpp, line 283]
nsContainerFrame::PaintChildren  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/generic/nsContainerFrame.cpp, line 228]
nsHTMLContainerFrame::Paint  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/generic/nsHTMLContainerFrame.cpp, line 84]
CanvasFrame::Paint  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/generic/nsHTMLFrame.cpp, line 385]
PresShell::Paint  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 5866]
nsView::Paint  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/view/src/nsView.cpp, line 316]
nsViewManager::RenderDisplayListElement  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/view/src/nsViewManager.cpp, line 1460]
nsViewManager::RenderViews  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/view/src/nsViewManager.cpp, line 1375]
nsViewManager::Refresh  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/view/src/nsViewManager.cpp, line 930]
nsViewManager::DispatchEvent  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/view/src/nsViewManager.cpp, line 2047]
HandleEvent  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/view/src/nsView.cpp, line 174]
nsWindow::DispatchEvent  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/widget/src/windows/nsWindow.cpp, line 1348]
nsWindow::ProcessMessage  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/widget/src/windows/nsWindow.cpp, line 4562]
nsWindow::WindowProc  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/widget/src/windows/nsWindow.cpp, line 1536]
USER32.dll + 0x8734 (0x77d18734)
USER32.dll + 0x8816 (0x77d18816)
USER32.dll + 0xb4c0 (0x77d1b4c0)
USER32.dll + 0xb50c (0x77d1b50c)
ntdll.dll + 0xeae3 (0x7c91eae3)
USER32.dll + 0x8a10 (0x77d18a10)
nsAppShell::Run  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/widget/src/windows/nsAppShell.cpp, line 159]
nsAppStartup::Run  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/toolkit/components/startup/src/nsAppStartup.cpp, line 152]
main  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/browser/app/nsBrowserApp.cpp, line 61]
kernel32.dll + 0x16fd7 (0x7c816fd7)

Comment 4

[tor]

Attachment: stop the null dereference

The fun of three svg branches drifting apart...

Comment 5

[Scooter Morris]

Comment on attachment 233807 [details] [diff] [review]
stop the null dereference

Looks right to me.

Comment 6

[Mike Beltzner [:beltzner, not reading bugmail]]

Not a blocker, but we'd consider a patch.

Comment 7

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Comment on attachment 233807 [details] [diff] [review]
stop the null dereference

a=dbaron on behalf of drivers.  Please check in to MOZILLA_1_8_BRANCH and add the fixed1.8.1 keyword once you have done so.

Comment 8

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

(And you can check this in today.)

Comment 9

[tor]

Checked in on MOZILLA_1_8_BRANCH.

Comment 10

[Steve England [:stevee]]

Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8.1b2) Gecko/20060818 BonEcho/2.0b2 ID:2006081803
Now WFM