Last Comment Bug 751515 - Crash with convertToSpecifiedUnits()
: Crash with convertToSpecifiedUnits()
Status: RESOLVED FIXED
[qa+]
: crash, regression, testcase
Product: Core
Classification: Components
Component: SVG (show other bugs)
: Trunk
: All All
: -- critical (vote)
: mozilla15
Assigned To: Robert Longson
:
Mentors:
Depends on:
Blocks: 326633 629200
  Show dependency treegraph
 
Reported: 2012-05-03 03:32 PDT by Jesse Ruderman
Modified: 2012-06-14 07:44 PDT (History)
8 users (show)
longsonr: in‑testsuite+
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---
unaffected
verified
verified


Attachments
testcase (162 bytes, image/svg+xml)
2012-05-03 03:32 PDT, Jesse Ruderman
no flags Details
stack trace+ (13.62 KB, text/plain)
2012-05-03 03:32 PDT, Jesse Ruderman
no flags Details
patch (2.77 KB, patch)
2012-05-03 04:19 PDT, Robert Longson
dholbert: review+
akeybl: approval‑mozilla‑aurora+
akeybl: approval‑mozilla‑beta+
Details | Diff | Splinter Review

Description Jesse Ruderman 2012-05-03 03:32:23 PDT
Created attachment 620638 [details]
testcase
Comment 1 Jesse Ruderman 2012-05-03 03:32:59 PDT
Created attachment 620639 [details]
stack trace+

Opt: bp-00310555-9c61-45a4-81e4-de2e92120503
Comment 3 Robert Longson 2012-05-03 04:19:11 PDT
Created attachment 620645 [details] [diff] [review]
patch
Comment 4 Scoobidiver (away) 2012-05-03 09:39:24 PDT
When there's regression as keyword, the version field displays the version where it first appeared in order to know the Aurora, Beta, ESR and even Release channels are affected.
Comment 5 Jonathan Watt [:jwatt] (back in October - email directly if necessary) 2012-05-03 13:18:21 PDT
I can land this tomorrow morning.
Comment 6 Robert Longson 2012-05-03 13:28:17 PDT
I'm ready to land it.
Comment 9 Robert Longson 2012-05-04 13:54:48 PDT
Comment on attachment 620645 [details] [diff] [review]
patch

[Approval Request Comment]
Regression caused by (bug #): 629200
User impact if declined: Any call to convertToSpecifiedUnits on an angle created by calling createSVGAngle will crash the browser. Other methods are not affected.
Testing completed (on m-c, etc.): landed on m-c with a crashtest
Risk to taking this patch (and alternatives if risky): patch is small, localised and low risk.
String changes made by this patch: none
Comment 10 Bob Clary [:bc:] 2012-05-04 18:17:07 PDT
crash automation reproduced this on all branches/platforms with:
nsSVGElement::WillChangeAngle nsSVGAngle::ConvertToSpecifiedUnits DOMSVGAngle::ConvertToSpecifiedUnits
Comment 11 Alex Keybl [:akeybl] 2012-05-06 19:05:08 PDT
Comment on attachment 620645 [details] [diff] [review]
patch

[Triage Comment]
Regression in FF13 and low risk. Approved for Aurora 14 and Beta 13.
Comment 13 Simona B [:simonab ] -PTO- back Sept 5th 2012-05-16 02:47:24 PDT
Verified that Firefox 13 beta 3 does not crash when using the test case attached in the Description.

Verified on Windows 7, Ubuntu 12.04 and Mac OS X 10.6:
Mozilla/5.0 (Windows NT 6.1; rv:13.0) Gecko/20100101 Firefox/13.0
Mozilla/5.0 (X11; Linux i686; rv:13.0) Gecko/20100101 Firefox/13.0
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:13.0) Gecko/20100101 Firefox/13.0
Comment 14 Simona B [:simonab ] -PTO- back Sept 5th 2012-06-14 07:44:09 PDT
Verified that Firefox 14 beta 7 does not crash when using the test case attached in the Description. Verified on Win 7, Ubuntu 12.04 and Mac OS X 10.6:

Mozilla/5.0 (Windows NT 6.1; rv:14.0) Gecko/20100101 Firefox/14.0
Mozilla/5.0 (X11; Linux i686; rv:14.0) Gecko/20100101 Firefox/14.0
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:14.0) Gecko/20100101 Firefox/14.0

Note You need to log in before you can comment on or make changes to this bug.