Crash with convertToSpecifiedUnits()

RESOLVED FIXED in Firefox 13

Status

()

Core
SVG
--
critical
RESOLVED FIXED
5 years ago
5 years ago

People

(Reporter: Jesse Ruderman, Assigned: Robert Longson)

Tracking

(Blocks: 1 bug, {crash, regression, testcase})

Trunk
mozilla15
crash, regression, testcase
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(firefox12 unaffected, firefox13 verified, firefox14 verified)

Details

(Whiteboard: [qa+], crash signature)

Attachments

(3 attachments)

(Reporter)

Description

5 years ago
Created attachment 620638 [details]
testcase
(Reporter)

Comment 1

5 years ago
Created attachment 620639 [details]
stack trace+

Opt: bp-00310555-9c61-45a4-81e4-de2e92120503
(Reporter)

Updated

5 years ago
Crash Signature: [@ nsSVGElement::WillChangeAngle ] [@ nsSVGAngle::ConvertToSpecifiedUnits ]
(Reporter)

Comment 2

5 years ago
http://www.w3.org/TR/SVG/types.html#__svg__SVGLength__convertToSpecifiedUnits
(Assignee)

Comment 3

5 years ago
Created attachment 620645 [details] [diff] [review]
patch
Assignee: nobody → longsonr
Attachment #620645 - Flags: review?(dholbert)
(Assignee)

Updated

5 years ago
Depends on: 629200
Keywords: regression

Updated

5 years ago
Blocks: 629200
Crash Signature: [@ nsSVGElement::WillChangeAngle ] [@ nsSVGAngle::ConvertToSpecifiedUnits ] → [@ nsSVGElement::WillChangeAngle ] [@ nsSVGAngle::ConvertToSpecifiedUnits ] [@ nsSVGElement::WillChangeAngle(unsigned char)]
status-firefox13: --- → affected
status-firefox14: --- → affected
No longer depends on: 629200
OS: Mac OS X → All
Hardware: x86_64 → All
Version: Trunk → 13 Branch
Attachment #620645 - Flags: review?(dholbert) → review+
Status: NEW → ASSIGNED
Version: 13 Branch → Trunk

Comment 4

5 years ago
When there's regression as keyword, the version field displays the version where it first appeared in order to know the Aurora, Beta, ESR and even Release channels are affected.
I can land this tomorrow morning.
(Assignee)

Comment 6

5 years ago
I'm ready to land it.
(Assignee)

Comment 7

5 years ago
pushed https://hg.mozilla.org/integration/mozilla-inbound/rev/319f53d58da2
Target Milestone: --- → mozilla15
(Assignee)

Updated

5 years ago
Flags: in-testsuite+
https://hg.mozilla.org/mozilla-central/rev/319f53d58da2
Status: ASSIGNED → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
(Assignee)

Comment 9

5 years ago
Comment on attachment 620645 [details] [diff] [review]
patch

[Approval Request Comment]
Regression caused by (bug #): 629200
User impact if declined: Any call to convertToSpecifiedUnits on an angle created by calling createSVGAngle will crash the browser. Other methods are not affected.
Testing completed (on m-c, etc.): landed on m-c with a crashtest
Risk to taking this patch (and alternatives if risky): patch is small, localised and low risk.
String changes made by this patch: none
Attachment #620645 - Flags: approval-mozilla-beta?
Attachment #620645 - Flags: approval-mozilla-aurora?

Comment 10

5 years ago
crash automation reproduced this on all branches/platforms with:
nsSVGElement::WillChangeAngle nsSVGAngle::ConvertToSpecifiedUnits DOMSVGAngle::ConvertToSpecifiedUnits
Comment on attachment 620645 [details] [diff] [review]
patch

[Triage Comment]
Regression in FF13 and low risk. Approved for Aurora 14 and Beta 13.
Attachment #620645 - Flags: approval-mozilla-beta?
Attachment #620645 - Flags: approval-mozilla-beta+
Attachment #620645 - Flags: approval-mozilla-aurora?
Attachment #620645 - Flags: approval-mozilla-aurora+
https://hg.mozilla.org/releases/mozilla-aurora/rev/ef89a868b38f
https://hg.mozilla.org/releases/mozilla-beta/rev/7b2e9d2ff7a1
status-firefox12: --- → unaffected
status-firefox13: affected → fixed
status-firefox14: affected → fixed
Whiteboard: [qa+]
Verified that Firefox 13 beta 3 does not crash when using the test case attached in the Description.

Verified on Windows 7, Ubuntu 12.04 and Mac OS X 10.6:
Mozilla/5.0 (Windows NT 6.1; rv:13.0) Gecko/20100101 Firefox/13.0
Mozilla/5.0 (X11; Linux i686; rv:13.0) Gecko/20100101 Firefox/13.0
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:13.0) Gecko/20100101 Firefox/13.0
status-firefox13: fixed → verified
Verified that Firefox 14 beta 7 does not crash when using the test case attached in the Description. Verified on Win 7, Ubuntu 12.04 and Mac OS X 10.6:

Mozilla/5.0 (Windows NT 6.1; rv:14.0) Gecko/20100101 Firefox/14.0
Mozilla/5.0 (X11; Linux i686; rv:14.0) Gecko/20100101 Firefox/14.0
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:14.0) Gecko/20100101 Firefox/14.0
status-firefox14: fixed → verified
You need to log in before you can comment on or make changes to this bug.