Closed Bug 414772 Opened 12 years ago Closed 10 years ago
<path d="M4e-356"> makes debug Firefox exit saying "Zero passed to d2b" (prdtoa
Loading this SVG testcase in a Mac trunk debug build makes Firefox exit, saying "Zero passed to d2b". Seems harmless in a nightly. Found by a fuzzer written by olliej. #0 0x900102d4 in exit () #1 0x005ba28d in d2b (d=0, e=0xbfffcc48, bits=0xbfffcc44) at /Users/jruderman/trunk/mozilla/nsprpub/pr/src/misc/prdtoa.c:1353 #2 0x005badf0 in PR_strtod (s00=0x3d98a542 "e-356", se=0xbfffcd3c) at /Users/jruderman/trunk/mozilla/nsprpub/pr/src/misc/prdtoa.c:2031 #3 0x1837a41e in nsSVGDataParser::MatchNumber (this=0xbfffd034, aX=0xbfffce20) at /Users/jruderman/trunk/mozilla/content/svg/content/src/nsSVGDataParser.cpp:184 ...
also crashes 1.9.1 and 1.9.0 windows debug builds.
blocking1.9.1: --- → ?
not a crash in opt builds, this is a PR_ASSERT() that's otherwise handled.
blocking1.9.1: ? → ---
There are two Bug("Zero passed to d2b"); statements in the d2b() function in prdtoa.c. The one at line 1353 of prdtoa.c, rev. 4.5 has been deleted in the latest version of dtoa.c from the upstream, so we can just delete it. To review this patch, search for b->wds = (x = z) ? 2 : 1; in the latest version of dtoa.c (http://www.netlib.org/fp/dtoa.c) and verify that there is no Bug("Zero passed to d2b"); following it (after the "else"). I believe this change is this one in the dtoa.c "changes" file: http://www.netlib.org/fp/changes Mon Mar 16 00:32:43 MDT 2009 ... dtoa.c and gdtoa/misc.c: Remove a buggy test activated with -DDEBUG.
Attachment #402851 - Flags: review?
Attachment #402851 - Flags: review? → review?(jruderman)
Attachment #402851 - Flags: review?(jruderman) → review+
Sure, if you think my review is ok for a change to this file.
But netlib's lack of a real repository or changelog is disturbing. What other fixes have we missed over the years?
I checked in the patch on the NSPR trunk (NSPR 4.8.1). Checking in prdtoa.c; /cvsroot/mozilla/nsprpub/pr/src/misc/prdtoa.c,v <-- prdtoa.c new revision: 4.9; previous revision: 4.8 done
Severity: critical → normal
Status: NEW → RESOLVED
Closed: 10 years ago
OS: Mac OS X → All
Hardware: x86 → All
Resolution: --- → FIXED
Target Milestone: --- → 4.8.1
I have to remove the "M" from "M4e-356" to make the NSPR test program exit with "Zero passed to d2b". Jesse, do you know why? Checking in dtoa.c; /cvsroot/mozilla/nsprpub/pr/tests/dtoa.c,v <-- dtoa.c new revision: 1.8; previous revision: 1.7 done
The "M" is a SVG pathdata "moveto". http://www.w3.org/TR/SVG/paths.html#PathData
Summary: <path d="M4e-356"> makes Firefox exit saying "Zero passed to d2b" (prdtoa.c) → <path d="M4e-356"> makes debug Firefox exit saying "Zero passed to d2b" (prdtoa.c)
You need to log in before you can comment on or make changes to this bug.