367368 - <svg:circle> kills firefox: "cairo-pen.c:323: failed assertion `i < pen->num_vertices'"

Status: RESOLVED FIXED

(Core :: SVG, defect)

Description

[Jesse Ruderman]

Attachment: testcase

Loading this testcase kills Firefox (Mac trunk debug) with the message:

mozilla/gfx/cairo/cairo/src/cairo-pen.c:323: failed assertion `i < pen->num_vertices'

Could this be a regression from bug 367273?

Comment 1

[Robert Longson [:longsonr]]

(In reply to comment #0)
> Created an attachment (id=251937) [details]
> testcase
> 
> Loading this testcase kills Firefox (Mac trunk debug) with the message:
> 
> mozilla/gfx/cairo/cairo/src/cairo-pen.c:323: failed assertion `i <
> pen->num_vertices'
> 
> Could this be a regression from bug 367273?
> 

Did you really mean this bug number? It's some kind of UI thing.

Comment 2

[tor]

Regression caused by bug 367031.

Comment 3

[Jonathan Watt [:jwatt]]

The patch for bug 367031 was backed out. Should we just close this or try and figure out if the crash is something we could encounter on valid code paths?

Comment 4

[Robert Longson [:longsonr]]

Perhaps we could add the testcase to bug 367031 with a note to say whatever fix we do should be tested against that.

Comment 5

[Jonathan Watt [:jwatt]]

This bug is in its depends field so I'll be doing that anyway.

Comment 6

[Jonathan Watt [:jwatt]]

I added the test as http://lxr.mozilla.org/seamonkey/source/layout/reftests/svg/bugs/bug367368.xhtml