Closed Bug 467323 Opened 11 years ago Closed 11 years ago

Crash [@ nsSVGFEDisplacementMapElement::Filter]

Categories

(Core :: SVG, defect, P2, critical)

x86
macOS
defect

Tracking

()

VERIFIED FIXED

People

(Reporter: jruderman, Assigned: roc)

References

(Blocks 1 open bug)

Details

(4 keywords, Whiteboard: [sg:moderate][depends on 448243])

Crash Data

Attachments

(1 file)

###!!! ASSERTION: stride mismatch: 'input->mImage.mImage->Stride() == primitive->mImage.mImage->Stride()', file /Users/jruderman/central/layout/svg/base/src/nsSVGFilterInstance.cpp, line 492

Bug 448243 also triggers this assertion.  This testcase not only triggers the assertion, but also makes Firefox draw random pixels and/or dereference bogus addresses [@ nsSVGFEDisplacementMapElement::Filter].

The testcase is simply layout/reftests/svg/filters/feDisplacementMap-2.svg with one less element.
Flags: blocking1.9.1?
Flags: blocking1.9.1? → blocking1.9.1+
Seems to have been fixed by the checkin for bug 448243.
Status: NEW → RESOLVED
Closed: 11 years ago
Resolution: --- → FIXED
Whiteboard: [depends on 448243]
Flags: in-testsuite?
...which is now fixed on 1.9.1 as well.
Keywords: fixed1.9.1
verified fixed using Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.1b3pre) Gecko/20081230 Shiretoko/3.1b3pre. Updating keyword.

verified fixed on the trunk as well using Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.2a1pre) Gecko/20081230 Minefield/3.2a1pre
Status: RESOLVED → VERIFIED
Want this for 1.9.0; not needed for 1.8 which doesn't have svg filters.
Flags: wanted1.9.0.x+
Flags: wanted1.8.1.x-
Flags: blocking1.9.0.8+
Whiteboard: [depends on 448243] → [sg:moderate][depends on 448243]
Assigning this to roc since he owns bug 448243, which this bug is fixed by.
Assignee: nobody → roc
Flags: blocking1.9.0.8+ → blocking1.9.0.9?
Flags: blocking1.9.0.10?
Flags: blocking1.9.0.12?
I don't crash with this testcase in 1.9.0.12pre, looks like we don't need this.
Flags: wanted1.9.0.x-
Flags: wanted1.9.0.x+
Flags: blocking1.9.0.12?
Group: core-security
Crashtest: http://hg.mozilla.org/mozilla-central/rev/c38d6ec28c45
Flags: in-testsuite? → in-testsuite+
Crash Signature: [@ nsSVGFEDisplacementMapElement::Filter]
You need to log in before you can comment on or make changes to this bug.