After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.
Bug 621088 - Crash when rendering tests/svg1.1/svg/masking-path-04-b.svg
Crash when rendering tests/svg1.1/svg/masking-path-04-b.svg
Status: RESOLVED FIXED
Product: librsvg
Classification: Core
Component: general
unspecified
Other All
: Normal normal
: ---
Assigned To: Federico Mena Quintero
librsvg maintainers
: 630733 654642 (view as bug list)
Depends on:
Blocks:
 
 
Reported: 2010-06-09 11:43 UTC by Hiroyuki Ikezoe
Modified: 2017-09-01 15:04 UTC
See Also:
GNOME target: ---
GNOME version: ---

Attachments
Fix (5.25 KB, patch)
2010-07-08 21:29 UTC, Hiroyuki Ikezoe 		none Details | Review
Fix with test data. (10.46 KB, patch)
2010-07-08 21:32 UTC, Hiroyuki Ikezoe 		rejected Details | Review

Description Hiroyuki Ikezoe 2010-06-09 11:43:52 UTC 
Program received signal SIGABRT, Aborted.
0x00007ffff4257a75 in *__GI_raise (sig=<value optimized out>) at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
64	../nptl/sysdeps/unix/sysv/linux/raise.c: No such file or directory.
	in ../nptl/sysdeps/unix/sysv/linux/raise.c
(gdb) bt

+ Trace 222320

  • #0 *__GI_raise
    at ../nptl/sysdeps/unix/sysv/linux/raise.c line 64
  • #1 *__GI_abort
    at abort.c line 92
  • #2 __libc_message
    at ../sysdeps/unix/sysv/linux/libc_fatal.c line 189
  • #3 malloc_printerr
  • #4 *__GI___libc_free
    at malloc.c line 3738
  • #5 ??
    from /usr/lib/libpango-1.0.so.0
  • #6 g_object_unref
    from /usr/lib/libgobject-2.0.so.0
  • #7 rsvg_text_render_text
    at rsvg-text.c line 511
  • #8 _rsvg_node_text_type_children
    at rsvg-text.c line 176
  • #9 _rsvg_node_text_draw
    at rsvg-text.c line 254
  • #10 rsvg_node_draw
    at rsvg-structure.c line 69
  • #11 _rsvg_node_draw_children
    at rsvg-structure.c line 87
  • #12 rsvg_cairo_clip
    at rsvg-cairo-clip.c line 177
  • #13 rsvg_cairo_push_early_clips
    at rsvg-cairo-draw.c line 861
  • #14 rsvg_cairo_push_discrete_layer
    at rsvg-cairo-draw.c line 924
  • #15 rsvg_node_image_draw
    at rsvg-image.c line 308
  • #16 rsvg_node_draw
    at rsvg-structure.c line 69
  • #17 _rsvg_node_draw_children
    at rsvg-structure.c line 87
  • #18 rsvg_node_draw
    at rsvg-structure.c line 69
  • #19 _rsvg_node_draw_children
    at rsvg-structure.c line 87
  • #20 rsvg_node_draw
    at rsvg-structure.c line 69
  • #21 rsvg_node_svg_draw
    at rsvg-structure.c line 326
  • #22 rsvg_node_draw
    at rsvg-structure.c line 69
  • #23 rsvg_handle_render_cairo_sub
    at rsvg-cairo-render.c line 234
  • #24 rsvg_handle_get_pixbuf_sub
    at rsvg.c line 101
  • #25 pixbuf_from_data_with_size_data
    at test-display.c line 169
  • #26 main
    at test-display.c line 906 






Comment 1


Hiroyuki Ikezoe





          2010-07-08 21:29:48 UTC
        



Created attachment 165521 [details] [review]
Fix






Comment 2


Hiroyuki Ikezoe





          2010-07-08 21:32:17 UTC
        



Created attachment 165522 [details] [review]
Fix with test data.

I am sorry, the previous patch did not have test data.






Comment 3


Christian Persch





          2011-11-09 19:35:23 UTC
        



The crash was already fixed on master; the remaining bits are just the 

+ if (!clipping)
+            rsvg_bbox_insert (...)

bits. Are these required? I can't see a rendering difference with or without them in the masking-path-04-b.svg testcase.






Comment 4


Federico Mena Quintero





          2017-09-01 13:41:56 UTC
        



*** Bug 654642 has been marked as a duplicate of this bug. ***






Comment 5


Federico Mena Quintero





          2017-09-01 13:42:03 UTC
        



*** Bug 630733 has been marked as a duplicate of this bug. ***






Comment 6


Federico Mena Quintero





          2017-09-01 13:50:47 UTC
        



The reason for the crash is that rsvg_cairo_clip_render_new() creates an invalid clip_render->super --- the parent class RsvgCairoRender.  The RsvgCairoRender is left with an uninitialized bbox field.

I'm fixing this, along with text clipping in general.






Comment 7


Federico Mena Quintero





          2017-09-01 13:56:02 UTC
        



Review of attachment 165522 [details] [review]:

We don't need to special-case "is_clipping"; we need to guarantee that there is a valid bbox field in the RsvgCairoClipRender->super.

Also, we need to maintain the bbox as usual in rsvg_cairo_render_pango_layout(); otherwise clipped objects won't know their viewport size.

I'll replace this patch with an improved one.






Comment 8


Federico Mena Quintero





          2017-09-01 15:04:06 UTC
        



Fixed in the librsvg-2.40 branch in these commits:
66c0f991db5ffe3e20f8d30c629d1c71148c746f
63ddae44a21405b6cb2dae9e465574d3c48c47d9

Fixed in the master branch in these commits:
589e2dcf53bd05213bb17ed48e24d3f166e4fc92
bdc1d2c6975c7882351b3fe0401fee1448444767