786693 - segmentation fault for special inline svg constellation

Status: RESOLVED DUPLICATE of bug 767056

(Core :: SVG, defect)

Description

[ThomasW]

Attachment: Reduced test case: div with inline svg and onther div, special style attributes

==Steps to reproduce:==
* Open attached reduced test case on a i686 Linux installation with
  * Firefox 15.0 on 32 bit Linux
    tested revision 450143d2d810, no add-ons or plugins installed
  * Firefox 16.0 on 32 bit Linux
    tested revision c4e1ca772267, no add-ons or plugins installed

== What happens==
* Firefox crashes (segmentation fault)


This could not be reproduced with a Windows installation. For Linux it seems to be fixed in versions 17 (Aurora revision 02ba8b87cc48) and 18 (revision 418955e7c3a9).

Comment 1

[Jesper Hansen]

Upping importance but I don't know where this belongs and know it'll resolve itself in 12 weeks.

Comment 2

[Matthias Versen [:Matti]]

Please provide a sracktrace or a crash ID from about:crashes.

This will only help to find the bug that fixed the issue and will not change anything.
Marking wfm

Comment 3

[ThomasW]

Attachment: Testcase with pure SVG that only containins a single path and crashes FF 15 to 18; problem seems to be viewBox

This seems to be more severe than initially thought. This test case actually crashes all above mentioned Firefox revision of versions 15 to 18, but not 14.01 (revision e5728a4e106c) (only on Linux, only 32bit tested).

Comment 4

[ThomasW]

Attachment: stacktrace for testcase https://bugzilla.mozilla.org/attachment.cgi?id=656465

Comment 5

[ThomasW]

(In reply to ThomasW from comment #4)
> Created attachment 657172 [details]
> stacktrace for testcase https://bugzilla.mozilla.org/attachment.cgi?id=656465

I should have said this is for the current Firefox 15. If stacktraces for 16-18 are needed, I can supply them as well.

I hope it's O.K. to set this to UNCONFIRMED again instead of RESOLVED. As the second test case also affects the latest development version I don't think this can be regarded as RESOLVED. Unfortunately, my bug description saying "special inline svg constellation" turns out to be mischosen as the actual issue seems to be with the viewBox attribute, not inline SVG.

Comment 6

[Robert Longson [:longsonr]]

This is probably a duplicate of bug 767056. There are builds available from a link in bug 780828 comment 13 that have a fix for that/this issue.

Comment 7

[ThomasW]

(In reply to Robert Longson from comment #6)
> This is probably a duplicate of bug 767056. There are builds available from
> a link in bug 780828 comment 13 that have a fix for that/this issue.

You're indeed right. This fixes the issue with the second file[1]. (The first one was working in 18 anyway, but not in the 15 and 16.)

[1] https://bugzilla.mozilla.org/attachment.cgi?id=657057

Comment 8

[Jonathan Watt [:jwatt]]

Thanks for the bug report ThomasW.

Comment 9

[Jonathan Watt [:jwatt]]

By the way, the SVG team could really do with some help catching problems like this _before_ they reach the release builds. We don't seem to have enough people testing SVG before that stage right now. The Beta builds are very stable (get virtually no changes before release), so if you'd be willing to use Beta or Aurora builds for your day-to-day browsing and report any regressions that you notice, that would be a great help. If you're interested, you can find
Beta/Aurora builds here:

http://www.mozilla.org/en-US/firefox/channel/

Comment 10

[ThomasW]

(In reply to Jonathan Watt [:jwatt] from comment #9)
> By the way, the SVG team could really do with some help catching problems
> like this _before_ they reach the release builds. We don't seem to have
> enough people testing SVG before that stage right now. The Beta builds are
> very stable (get virtually no changes before release), so if you'd be
> willing to use Beta or Aurora builds for your day-to-day browsing and report
> any regressions that you notice, that would be a great help.

I'm now on the Beta channel.

Comment 11

[Jonathan Watt [:jwatt]]

Fantastic, thanks Thomas!