Closed Bug 751515 Opened 13 years ago Closed 13 years ago

Crash with convertToSpecifiedUnits()

Categories

(Core :: SVG, defect)

defect
Not set
critical

Tracking

()

RESOLVED FIXED
mozilla15
Tracking Status
firefox12 --- unaffected
firefox13 --- verified
firefox14 --- verified

People

(Reporter: jruderman, Assigned: longsonr)

References

Details

(Keywords: crash, regression, testcase, Whiteboard: [qa+])

Crash Data

Attachments

(3 files)

Attached image testcase
No description provided.
Crash Signature: [@ nsSVGElement::WillChangeAngle ] [@ nsSVGAngle::ConvertToSpecifiedUnits ]
Attached patch patchSplinter Review
Assignee: nobody → longsonr
Attachment #620645 - Flags: review?(dholbert)
Depends on: 629200
Keywords: regression
Blocks: 629200
Crash Signature: [@ nsSVGElement::WillChangeAngle ] [@ nsSVGAngle::ConvertToSpecifiedUnits ] → [@ nsSVGElement::WillChangeAngle ] [@ nsSVGAngle::ConvertToSpecifiedUnits ] [@ nsSVGElement::WillChangeAngle(unsigned char)]
No longer depends on: 629200
OS: Mac OS X → All
Hardware: x86_64 → All
Version: Trunk → 13 Branch
Attachment #620645 - Flags: review?(dholbert) → review+
Status: NEW → ASSIGNED
Version: 13 Branch → Trunk
When there's regression as keyword, the version field displays the version where it first appeared in order to know the Aurora, Beta, ESR and even Release channels are affected.
I can land this tomorrow morning.
I'm ready to land it.
Target Milestone: --- → mozilla15
Flags: in-testsuite+
Status: ASSIGNED → RESOLVED
Closed: 13 years ago
Resolution: --- → FIXED
Comment on attachment 620645 [details] [diff] [review] patch [Approval Request Comment] Regression caused by (bug #): 629200 User impact if declined: Any call to convertToSpecifiedUnits on an angle created by calling createSVGAngle will crash the browser. Other methods are not affected. Testing completed (on m-c, etc.): landed on m-c with a crashtest Risk to taking this patch (and alternatives if risky): patch is small, localised and low risk. String changes made by this patch: none
Attachment #620645 - Flags: approval-mozilla-beta?
Attachment #620645 - Flags: approval-mozilla-aurora?
crash automation reproduced this on all branches/platforms with: nsSVGElement::WillChangeAngle nsSVGAngle::ConvertToSpecifiedUnits DOMSVGAngle::ConvertToSpecifiedUnits
Comment on attachment 620645 [details] [diff] [review] patch [Triage Comment] Regression in FF13 and low risk. Approved for Aurora 14 and Beta 13.
Attachment #620645 - Flags: approval-mozilla-beta?
Attachment #620645 - Flags: approval-mozilla-beta+
Attachment #620645 - Flags: approval-mozilla-aurora?
Attachment #620645 - Flags: approval-mozilla-aurora+
Whiteboard: [qa+]
Verified that Firefox 13 beta 3 does not crash when using the test case attached in the Description. Verified on Windows 7, Ubuntu 12.04 and Mac OS X 10.6: Mozilla/5.0 (Windows NT 6.1; rv:13.0) Gecko/20100101 Firefox/13.0 Mozilla/5.0 (X11; Linux i686; rv:13.0) Gecko/20100101 Firefox/13.0 Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:13.0) Gecko/20100101 Firefox/13.0
Verified that Firefox 14 beta 7 does not crash when using the test case attached in the Description. Verified on Win 7, Ubuntu 12.04 and Mac OS X 10.6: Mozilla/5.0 (Windows NT 6.1; rv:14.0) Gecko/20100101 Firefox/14.0 Mozilla/5.0 (X11; Linux i686; rv:14.0) Gecko/20100101 Firefox/14.0 Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:14.0) Gecko/20100101 Firefox/14.0
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: