Closed Bug 495543 Opened 11 years ago Closed 11 years ago

"ASSERTION: non-opaque color property cannot be stringified" with svg:svg root in .xhtml document

Categories

(Core :: Layout, defect)

x86
macOS
defect
Not set

Tracking

()

VERIFIED FIXED

People

(Reporter: jruderman, Assigned: zwol)

References

(Blocks 2 open bugs)

Details

(Keywords: assertion, testcase, verified1.9.1, Whiteboard: [sg:nse])

Attachments

(2 files)

Attached file testcase
###!!! ASSERTION: non-opaque color property cannot be stringified: 'Not Reached', file /Users/jruderman/central/content/html/document/src/nsHTMLDocument.cpp, line 2405

Bug 494225 was made security-sensitive, so I'm making this one security-sensitive as well.
Group: core-security
This is perhaps why HTML5 explicitly excludes "transparent" from the set of named colors that can be used in a legacy color value (see http://www.whatwg.org/specs/web-apps/current-work/multipage/infrastructure.html#colors).  I can make that change or I can have LegacyRGBToHex() spit "transparent" back out for rgba(0,0,0,0).  What do people prefer?

(N.B. Depending on when exactly my family decides they're going to visit, I may take Monday off.)
If we're talking 1.9.1, spitting back "transparent" is the way to go.  For trunk, I'd be happy to try the html5 approach.

This is not security-sensitive, imo; we're not reading random data or anything.
Group: core-security
Whiteboard: [sg:nse]
And I believe we do want a 1.9.1 fix here.
Blocks: 488649
Flags: wanted1.9.1?
Attached patch patchSplinter Review
Here's a patch (versus trunk) that makes rgba(0,0,0,0) stringify to "transparent" in these contexts.
Assignee: nobody → zweinberg
Status: NEW → ASSIGNED
Attachment #380647 - Flags: review?(bzbarsky)
Attachment #380647 - Flags: superreview+
Attachment #380647 - Flags: review?(bzbarsky)
Attachment #380647 - Flags: review+
go ahead and land this on m-c, once it goes green nominate for 1.9.1, though it's getting down to the wire
Pushed http://hg.mozilla.org/mozilla-central/rev/8dd6961e7ea3
Status: ASSIGNED → RESOLVED
Closed: 11 years ago
Resolution: --- → FIXED
Attachment #380647 - Flags: approval1.9.1?
Comment on attachment 380647 [details] [diff] [review]
patch

This is looking pretty green (modulo known orange bustage) on m-c.
Attachment #380647 - Flags: approval1.9.1? → approval1.9.1+
Flags: wanted1.9.1? → wanted1.9.1+
verified FIXED on debug builds (no assertion seen):

Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.1pre) Gecko/20090608 Shiretoko/3.5pre ID:20090608122057

and

Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.2a1pre) Gecko/20090608 Minefield/3.6a1pre ID:20090608122028
Status: RESOLVED → VERIFIED
You need to log in before you can comment on or make changes to this bug.