User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.8b2) Gecko/20050627 Firefox/1.0+ Build Identifier: Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.8b2) Gecko/20050627 Firefox/1.0+ Simple. Go to http://www.opera.com/features/svg/index.dml (Opera SVG sample page), and try to see it... Talkback sent : 7020422X Reproducible: Always Steps to Reproduce: 1.Go to http://www.opera.com/features/svg/index.dml Actual Results: Crashing. Expected Results: Viewing page. SVG will be a "die-hard" feature for firefox 1.1... Seeing firefox crashing on a SVG enabled page is sad :(

WFM on WinXP. Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8b2) Gecko/20050627 Firefox/1.0+ ID:2005062701

So, it seems to be a mac only bug ? Tweaking summary.

The talkback stack looks useless :/, looks like symbols are missing. But for Mac-only would speak this (from the stacktrace): QD.186.0.0 + 0x36fa4 (0x916d0fa4) QD.186.0.0 + 0x39df4 (0x916d3df4) firefox-bin + 0x869d30 (0x00869d30) [...] I assume QD stands for Carbon QuickDraw here?

I can confirm on Mac OS X 10.3 with latest trunk. Here is the top of the stack: Thread 0 Crashed: 0 <<00000000>> 0x91669fbc 0 + 0x91669fbc 1 <<00000000>> 0x91669c04 0 + 0x91669c04 2 libgklayout.dylib 0x1dc509d0 _cairo_atsui_font_text_to_glyphs + 0x124 (cairo-atsui-font.c:288) 3 libgklayout.dylib 0x1dc3a840 _cairo_scaled_font_text_to_glyphs + 0x4c (cairo-font.c:760) 4 libgklayout.dylib 0x1dc237ac _cairo_gstate_text_to_glyphs + 0x6c (cairo-gstate.c:1958) 5 libgklayout.dylib 0x1dc11d8c cairo_text_extents + 0x140 (cairo.c:1711) 6 libgklayout.dylib 0x1dc0a428 nsSVGCairoGlyphMetrics::Update(unsigned int, int*) + 0x104 (nsSVGCairoGlyphMetrics.cpp:293) 7 libgklayout.dylib 0x1db79dc4 nsSVGGlyphFrame::NotifyMetricsUnsuspended() + 0xc0 (nsSVGGlyphFrame.cpp:1241) 8 libgklayout.dylib 0x1dba0360 nsSVGTextFrame::NotifyRedrawUnsuspended() + 0x1e8 (nsSVGTextFrame.cpp:694) 9 libgklayout.dylib 0x1db8d64c nsSVGOuterSVGFrame::UnsuspendRedraw() + 0x140 (nsSVGOuterSVGFrame.cpp:1079) 10 libgklayout.dylib 0x1db8c298 nsSVGOuterSVGFrame::DidReflow(nsPresContext*, nsHTMLReflowState const*, int) + 0x11c (nsSVGOuterSVGFrame.cpp:672)

Crash happens at |::ATSUDirectGetLayoutDataArrayPtrFromTextLayout()|.

i think two blocking requests are enough :)

Comment on attachment 187469 [details] [diff] [review] avoid leaks in bailout Are the |#if 1| and |#if 0| necessary, or can they just be removed? Otherwise, looks fine.

Checked in.

... and closed.