381804 - Crash [@ gfxQuartzSurface::~gfxQuartzSurface] with <svg:text> and <svg:pattern>

Status: RESOLVED DUPLICATE of bug 378583

(Core :: SVG, defect)

Description

[Jesse Ruderman]

Attachment: testcase (crashes Firefox when loaded)

Loading the testcase in a nightly or a debug build triggers a crash [@ gfxQuartzSurface::~gfxQuartzSurface].  A debug build outputs some assertions before the crash:

###!!! ASSERTION: Surface size too large (would overflow)!: 'Error', gfx/thebes/src/gfxASurface.cpp, line 291
###!!! ASSERTION: gfxASurface::AddRef without mSurface: 'mSurface != nsnull', gfx/thebes/src/gfxASurface.cpp, line 66
###!!! ASSERTION: gfxASurface::CairoSurface called with mSurface == nsnull!: 'mSurface != nsnull', file ../../../dist/include/thebes/gfxASurface.h, line 98
###!!! ASSERTION: gfxASurface::Release without mSurface: 'mSurface != nsnull', gfx/thebes/src/gfxASurface.cpp, line 87

Comment 1

[Robert Longson [:longsonr]]

Crashes windows too.

Is nsSVGPatternFrame::PaintPattern missing an addref?

Comment 2

[Jonathan Watt [:jwatt]]

The ref count looks okay to me. What seems to be a problem is that the gfxWindowsSurface ctor simply returns early when the requested surface size is too large. As a result we end up with a gfxWindowsSurface object (non-null, so the null check doesn't catch it) that hasn't been constructed properly and things go pear shaped from there.

Comment 4

[Jesse Ruderman]

This testcase still causes an assertion (but not a crash).  See bug 385228.