952270 - Crash [@ nsSVGTextFrame2::GetTextPath]

Status: VERIFIED FIXED

(Core :: SVG, defect)

Description

[Jesse Ruderman]

Attachment: testcase (crashes Firefox when loaded)

The testcase is based on layout/reftests/svg/textPath-02.svg and removing the "d" attribute from the <path> element.

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/4f086025350f
user:        Jonathan Watt
date:        Mon Nov 18 01:29:06 2013 +0000
summary:     Bug 930577 - Convert much of the SVG code for calculating path lengths and position at an offset along a path to Moz2D. r=heycam

Comment 1

[Jesse Ruderman]

Nightly: bp-c9e0bca8-19c0-45b2-87b3-0623d2131219

Comment 2

[Cameron McCormack (:heycam)]

We should just be null checking |path| in there.

Comment 3

[Cameron McCormack (:heycam)]

Attachment: patch

Comment 4

[Cameron McCormack (:heycam)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/02825fe8a05a

Comment 5

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/02825fe8a05a

Comment 6

[Robert Longson [:longsonr]]

Comment on attachment 8350340 [details] [diff] [review]
patch

[Approval Request Comment]
Bug caused by (feature/regressing bug #): bug 930577
User impact if declined: some SVG pages will cause a browser crash
Testing completed (on m-c, etc.): landed on m-c with patch
Risk to taking this patch (and alternatives if risky): pretty small it's just a nullptr check
String or IDL/UUID changes made by this patch: none

Comment 7

[Robert Longson [:longsonr]]

read "landed on m-c with patch" as "landed on m-c with test" of course :-)

Comment 8

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/4ecd4f2ba149

Comment 9

[Robert Longson [:longsonr]]

crashtest was part of patch.

Comment 10

[Paul Silaghi, QA [:pauly]]

Reproduced in nightly 2013-12-19.
Verified fixed 29.0a1 (2014-01-09), win 7 x64