693484 - crash [@ mozilla::SVGPathData::ConstructPath ]

Status: RESOLVED FIXED

(Core :: SVG, defect)

Description

[Naoki Hirata :nhirata (please use needinfo instead of cc)]

Crash from Socorro : 
https://crash-stats.mozilla.com/report/index/7bf25cf4-2d8e-4f1f-b2b3-7b6742111006
------------------------------------------
Frame 	Module 	Signature [Expand] 	Source
0 	libmozalloc.so 	mozalloc_abort 	memory/mozalloc/mozalloc_abort.cpp:66
1 	libc.so 	__swrite 	
2 	libxul.so 	libxul.so@0xe6be75 	
3 	libxul.so 	mozilla::SVGPathData::ConstructPath 	content/svg/content/src/SVGPathData.cpp:392
4 	libxul.so 	nsAString_internal::MutatePrep 	xpcom/string/src/nsTSubstring.cpp:163
5 	libxul.so 	nsAString_internal::ReplacePrepInternal 	xpcom/string/src/nsTSubstring.cpp:221
6 	libxul.so 	nsAString_internal::ReplacePrep 	nsTSubstring.h:685
7 	libxul.so 	nsAString_internal::Assign 	nsCharTraits.h:218
8 	libxul.so 	nsCOMPtr_base::assign_with_AddRef 	obj-firefox/xpcom/build/nsCOMPtr.cpp:90
9 	libxul.so 	nsWebSocket::ParseURL 	content/base/src/nsWebSocket.cpp:1124
10 	libxul.so 	nsWebSocket::Init 	content/base/src/nsWebSocket.cpp:1467
11 	libxul.so 	nsWebSocket::Initialize 	content/base/src/nsWebSocket.cpp:806
12 	libxul.so 	nsDOMConstructor::Construct 	dom/base/nsDOMClassInfo.cpp:5357
13 	libxul.so 	nsDOMConstructorSH::Construct 	dom/base/nsDOMClassInfo.cpp:10478
14 	libxul.so 	XPC_WN_Helper_Construct 	js/src/xpconnect/src/xpcwrappednativejsops.cpp:1084
15 	libxul.so 	js::Interpret 	js/src/jscntxtinlines.h:317
16 	libxul.so 	js::RunScript 	js/src/jsinterp.cpp:585
17 	libxul.so 	js::Invoke 	js/src/vm/Stack.h:984
18 	libxul.so 	JS_CallFunctionValue 	js/src/jscntxt.h:1283
19 	libxul.so 	nsJSContext::CallEventHandler 	dom/base/nsJSEnvironment.cpp:1946
20 	libxul.so 	nsGlobalWindow::RunTimeout 	nsCOMPtr.h:896
21 	libxul.so 	nsGlobalWindow::TimerCallback 	nsAutoPtr.h:907
22 	libxul.so 	nsTimerImpl::Fire 	xpcom/threads/nsTimerImpl.cpp:425
23 	libxul.so 	nsTimerEvent::Run 	nsAutoPtr.h:907
24 	libxul.so 	nsThread::ProcessNextEvent 	xpcom/threads/nsThread.cpp:631
25 	libxul.so 	NS_ProcessNextEvent_P 	obj-firefox/xpcom/build/nsThreadUtils.cpp:245
26 	libxul.so 	mozilla::ipc::MessagePump::Run 	ipc/glue/MessagePump.cpp:134
27 	libxul.so 	mozilla::ipc::MessagePumpForChildProcess::Run 	ipc/glue/MessagePump.cpp:230
28 	libxul.so 	MessageLoop::RunInternal 	ipc/chromium/src/base/message_loop.cc:209
29 	libxul.so 	MessageLoop::Run 	ipc/chromium/src/base/message_loop.cc:487
30 	libxul.so 	nsBaseAppShell::Run 	widget/src/xpwidgets/nsBaseAppShell.cpp:191
31 	libxul.so 	XRE_RunAppShell 	toolkit/xre/nsEmbedFunctions.cpp:677
32 	libxul.so 	mozilla::ipc::MessagePumpForChildProcess::Run 	ipc/glue/MessagePump.cpp:222
33 	libxul.so 	MessageLoop::RunInternal 	ipc/chromium/src/base/message_loop.cc:209
34 	libxul.so 	MessageLoop::Run 	ipc/chromium/src/base/message_loop.cc:487
35 	libxul.so 	XRE_InitChildProcess 	nsAutoPtr.h:155
36 	libmozutils.so 	ChildProcessInit 	other-licenses/android/APKOpen.cpp:787
37 	plugin-container 	main 	ipc/app/MozillaRuntimeMainAndroid.cpp:69
38 	libc.so 	__libc_init 	

App Notes :App Notes 	WebGL? EGL? EGL+
GL Context? GL Context+
WebGL+
xpcom_runtime_abort(###!!! ABORT: NULL actor value passed to non-nullable param: file /builds/slave/m-cen-lnx-andrd-ntly/build/obj-firefox/ipc/ipdl/PNeckoChild.cpp, line 909)

Note : Stack does not match signature grouping of : https://crash-stats.mozilla.com/report/list?range_value=7&range_unit=days&date=2011-10-10%2013%3A00%3A00&signature=mozalloc_abort%20|%20__swrite&version=Fennec%3A10.0a1

Comment 1

[Martijn Wargers (dead)]

Attachment: unminimized testcase

I get these kind of (oom?) crashes with this unminimized testcase on the LG Optimus Black.

Comment 2

[Robert Longson [:longsonr]]

Fixed by bug 854108