1209525 - Assertion failure: inverted (Attempted to get the inverse of a non-invertible matrix), at c:\users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\include\mozilla/gfx/Matrix.h:215

Status: RESOLVED FIXED

(Core :: SVG, defect)

Description

[Carsten Book [:Tomcat]]

Found via bughunter and reproduced on a windows 7 debug build.

Steps to reproduce:
Load https://yadi.sk/d/A_GSZmPHH6Xrk
--> 

Assertion failure: inverted (Attempted to get the inverse of a non-invertible matrix), at c:\users\m
ozilla\debug-builds\mozilla-central\firefox-debug\dist\include\mozilla/gfx/Matrix.h:215
#01: mozilla::dom::SVGRectElement::GetGeometryBounds (c:\users\mozilla\debug-builds\mozilla-central\
dom\svg\svgrectelement.cpp:155)
#02: nsSVGPathGeometryFrame::GetBBoxContribution (c:\users\mozilla\debug-builds\mozilla-central\layo
ut\svg\nssvgpathgeometryframe.cpp:515)
#03: nsSVGPathGeometryFrame::ReflowSVG (c:\users\mozilla\debug-builds\mozilla-central\layout\svg\nss
vgpathgeometryframe.cpp:404)
#04: nsSVGDisplayContainerFrame::ReflowSVG (c:\users\mozilla\debug-builds\mozilla-central\layout\svg
\nssvgcontainerframe.cpp:361)
#05: nsSVGDisplayContainerFrame::ReflowSVG (c:\users\mozilla\debug-builds\mozilla-central\layout\svg
\nssvgcontainerframe.cpp:361)
#06: nsSVGOuterSVGFrame::Reflow (c:\users\mozilla\debug-builds\mozilla-central\layout\svg\nssvgouter
svgframe.cpp:458)
#07: nsContainerFrame::ReflowChild (c:\users\mozilla\debug-builds\mozilla-central\layout\generic\nsc
ontainerframe.cpp:1003)
#08: nsCanvasFrame::Reflow (c:\users\mozilla\debug-builds\mozilla-central\layout\generic\nscanvasfra
me.cpp:690)
#09: nsContainerFrame::ReflowChild (c:\users\mozilla\debug-builds\mozilla-central\layout\generic\nsc
ontainerframe.cpp:1003)
#10: nsHTMLScrollFrame::ReflowScrolledFrame (c:\users\mozilla\debug-builds\mozilla-central\layout\ge
neric\nsgfxscrollframe.cpp:529)
#11: nsHTMLScrollFrame::ReflowContents (c:\users\mozilla\debug-builds\mozilla-central\layout\generic
\nsgfxscrollframe.cpp:660)
#12: nsHTMLScrollFrame::Reflow (c:\users\mozilla\debug-builds\mozilla-central\layout\generic\nsgfxsc
rollframe.cpp:876)
#13: nsContainerFrame::ReflowChild (c:\users\mozilla\debug-builds\mozilla-central\layout\generic\nsc
ontainerframe.cpp:1045)
#14: ViewportFrame::Reflow (c:\users\mozilla\debug-builds\mozilla-central\layout\generic\nsviewportf
rame.cpp:217)
#15: PresShell::DoReflow (c:\users\mozilla\debug-builds\mozilla-central\layout\base\nspresshell.cpp:
9076)
#16: PresShell::ProcessReflowCommands (c:\users\mozilla\debug-builds\mozilla-central\layout\base\nsp
resshell.cpp:9242)
#17: PresShell::FlushPendingNotifications (c:\users\mozilla\debug-builds\mozilla-central\layout\base
\nspresshell.cpp:4137)
#18: PresShell::FlushPendingNotifications (c:\users\mozilla\debug-builds\mozilla-central\layout\base
\nspresshell.cpp:3978)
#19: mozilla::image::SVGDocumentWrapper::FlushLayout (c:\users\mozilla\debug-builds\mozilla-central\
image\svgdocumentwrapper.cpp:398)
#20: mozilla::image::VectorImage::OnSVGDocumentLoaded (c:\users\mozilla\debug-builds\mozilla-central
\image\vectorimage.cpp:1196)
#21: mozilla::image::SVGLoadEventListener::HandleEvent (c:\users\mozilla\debug-builds\mozilla-centra
l\image\vectorimage.cpp:225)
#22: mozilla::EventListenerManager::HandleEventSubType (c:\users\mozilla\debug-builds\mozilla-centra
l\dom\events\eventlistenermanager.cpp:1011)
#23: mozilla::EventListenerManager::HandleEventInternal (c:\users\mozilla\debug-builds\mozilla-centr
al\dom\events\eventlistenermanager.cpp:1139)
#24: mozilla::EventListenerManager::HandleEvent (c:\users\mozilla\debug-builds\mozilla-central\firef
ox-debug\dist\include\mozilla\eventlistenermanager.h:350)
#25: mozilla::EventTargetChainItem::HandleEvent (c:\users\mozilla\debug-builds\mozilla-central\dom\e
vents\eventdispatcher.cpp:226)
#26: mozilla::EventTargetChainItem::HandleEventTargetChain (c:\users\mozilla\debug-builds\mozilla-ce
ntral\dom\events\eventdispatcher.cpp:317)
#27: mozilla::EventDispatcher::Dispatch (c:\users\mozilla\debug-builds\mozilla-central\dom\events\ev
entdispatcher.cpp:655)
#28: mozilla::EventDispatcher::DispatchDOMEvent (c:\users\mozilla\debug-builds\mozilla-central\dom\e
vents\eventdispatcher.cpp:719)
#29: nsINode::DispatchEvent (c:\users\mozilla\debug-builds\mozilla-central\dom\base\nsinode.cpp:1295
)
#30: mozilla::AsyncEventDispatcher::Run (c:\users\mozilla\debug-builds\mozilla-central\dom\events\as
ynceventdispatcher.cpp:53)
#31: nsThread::ProcessNextEvent (c:\users\mozilla\debug-builds\mozilla-central\xpcom\threads\nsthrea
d.cpp:960)
#32: NS_ProcessNextEvent (c:\users\mozilla\debug-builds\mozilla-central\xpcom\glue\nsthreadutils.cpp
:277)
#33: mozilla::ipc::MessagePump::Run (c:\users\mozilla\debug-builds\mozilla-central\ipc\glue\messagep
ump.cpp:95)
#34: MessageLoop::RunInternal (c:\users\mozilla\debug-builds\mozilla-central\ipc\chromium\src\base\m
essage_loop.cc:234)
#35: MessageLoop::RunHandler (c:\users\mozilla\debug-builds\mozilla-central\ipc\chromium\src\base\me
ssage_loop.cc:228)
#36: MessageLoop::Run (c:\users\mozilla\debug-builds\mozilla-central\ipc\chromium\src\base\message_l
oop.cc:202)
#37: nsBaseAppShell::Run (c:\users\mozilla\debug-builds\mozilla-central\widget\nsbaseappshell.cpp:15
8)
#38: nsAppShell::Run (c:\users\mozilla\debug-builds\mozilla-central\widget\windows\nsappshell.cpp:18
0)
#39: nsAppStartup::Run (c:\users\mozilla\debug-builds\mozilla-central\toolkit\components\startup\nsa
ppstartup.cpp:282)
#40: XREMain::XRE_mainRun (c:\users\mozilla\debug-builds\mozilla-central\toolkit\xre\nsapprunner.cpp
:4298)
#41: XREMain::XRE_main (c:\users\mozilla\debug-builds\mozilla-central\toolkit\xre\nsapprunner.cpp:43
91)
#42: XRE_main (c:\users\mozilla\debug-builds\mozilla-central\toolkit\xre\nsapprunner.cpp:4493)
#43: do_main (c:\users\mozilla\debug-builds\mozilla-central\browser\app\nsbrowserapp.cpp:212)
#44: NS_internal_main (c:\users\mozilla\debug-builds\mozilla-central\browser\app\nsbrowserapp.cpp:39
9)
#45: wmain (c:\users\mozilla\debug-builds\mozilla-central\toolkit\xre\nswindowswmain.cpp:138)
#46: __tmainCRTStartup (f:\dd\vctools\crt\crtw32\startup\crt0.c:255)
#47: BaseThreadInitThunk[kernel32 +0x4ee1c]
#48: RtlInitializeExceptionChain[ntdll +0x637eb]
#49: RtlInitializeExceptionChain[ntdll +0x637be]

Comment 1

[Tom Klein]

Attachment: Patch v1

I'm not sure where the offending svg is, but I did verify that the one that causes the crash has mViewportWidth = mViewportHeight = 0 in SVGSVGElement, so GetViewBoxTransform returns an all-zeroes matrix, so SVGSVGElement::PrependLocalTransformsTo returns an all-zeroes matrix to nsSVGUtils::GetCTM, which assigns it to the non-scaling-stroke transform in nsSVGUtils::GetNonScalingStrokeTransform, and then GetGeometryBounds causes the assertion when it tries to invert it.

The new crashtest produces the same backtrace on failure as above.

Comment 2

[Robert Longson [:longsonr]]

Comment on attachment 8667711 [details] [diff] [review]
Patch v1

I think we should deal with this in the caller rather than in every called method. I.e return bbox if nsSVGUtils::GetNonScalingStrokeTransform returns something singular in nsSVGPathGeometryFrame::GetBBoxContribution

Comment 3

[Robert Longson [:longsonr]]

And make the called methods just assert that they aren't passed something singular.

Comment 4

[Tom Klein]

Attachment: Patch v2

Comment 5

[Robert Longson [:longsonr]]

Comment on attachment 8667906 [details] [diff] [review]
Patch v2

>-    gotSimpleBounds = element->GetGeometryBounds(&simpleBounds,
>-                                                 strokeOptions,
>-                                                 aToBBoxUserspace,
>-                                                 &moz2dUserToOuterSVG);
>+    if (!moz2dUserToOuterSVG.IsSingular()) {
>+      gotSimpleBounds = element->GetGeometryBounds(&simpleBounds,
>+                                                   strokeOptions,
>+                                                   aToBBoxUserspace,
>+                                                   &moz2dUserToOuterSVG);
>+    } else {
>+      return bbox;
>+    }

Write it this way instead.

+    if (moz2dUserToOuterSVG.IsSingular()) {
+      return bbox;
+    }
+    gotSimpleBounds = element->GetGeometryBounds(&simpleBounds,
+                                                 strokeOptions,
+                                                 aToBBoxUserspace,
+                                                 &moz2dUserToOuterSVG);

r=longsonr with that change

Comment 6

[Tom Klein]

Attachment: Patch v3

Comment 7

[Tom Klein]

Thanks Robert!

https://treeherder.mozilla.org/#/jobs?repo=try&revision=b54f6deebf4d

Comment 8

[Pulsebot]

https://hg.mozilla.org/integration/mozilla-inbound/rev/5be97c635fbd

Comment 9

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/5be97c635fbd

Comment 10

[Robert Longson [:longsonr]]

Comment on attachment 8667920 [details] [diff] [review]
Patch v3

Approval Request Comment
[Feature/regressing bug #]: bug 1092125
[User impact if declined]: Possibly very little. It's nore that we don't want a function to be called with data it is not equipped to handle properly and then go down unexpected code paths.
[Describe test coverage new/current, TreeHerder]: includes reftest
[Risks and why]: could end up with the wrong bounds, unlikely to have visible consequences though.
[String/UUID change made/needed]: none

Comment 11

[Liz Henry (:lizzard) (relman/hg->git project)]

Comment on attachment 8667920 [details] [diff] [review]
Patch v3

Approved for aurora uplift; regressed in 43

Comment 12

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/d90ef52f0c34