1322643 - SVG triggers assertion "ToRect(strokeBBoxExtents).IsFinite() (bbox is about to go bad)"

Status: NEW

(Core :: SVG, defect, P3)

Description

[Tyson Smith [:tsmith]]

Attachment: log.txt

Assertion failure: ToRect(strokeBBoxExtents).IsFinite() (bbox is about to go bad), at /home/worker/workspace/build/src/layout/svg/nsSVGPathGeometryFrame.cpp:655

==30375==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7f88547b7fd1 bp 0x7ffd36818230 sp 0x7ffd36817c40 T0)
    #0 0x7f88547b7fd0 in nsSVGPathGeometryFrame::GetBBoxContribution(mozilla::gfx::Matrix const&, unsigned int) /home/worker/workspace/build/src/layout/svg/nsSVGPathGeometryFrame.cpp:655:7
    #1 0x7f88547b6e98 in nsSVGPathGeometryFrame::ReflowSVG() /home/worker/workspace/build/src/layout/svg/nsSVGPathGeometryFrame.cpp:434:20
    #2 0x7f8854763803 in nsSVGDisplayContainerFrame::ReflowSVG() /home/worker/workspace/build/src/layout/svg/nsSVGContainerFrame.cpp:359:7
    #3 0x7f88547b085e in nsSVGOuterSVGFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, unsigned int&) /home/worker/workspace/build/src/layout/svg/nsSVGOuterSVGFrame.cpp:450:5
    #4 0x7f8854431986 in nsLineLayout::ReflowFrame(nsIFrame*, unsigned int&, mozilla::ReflowOutput*, bool&) /home/worker/workspace/build/src/layout/generic/nsLineLayout.cpp:939:5
    #5 0x7f88544be88a in nsBlockFrame::ReflowInlineFrame(mozilla::BlockReflowInput&, nsLineLayout&, nsLineList_iterator, nsIFrame*, LineReflowStatus*) /home/worker/workspace/build/src/layout/generic/nsBlockFrame.cpp:4120:3
    #6 0x7f88544bd22d in nsBlockFrame::DoReflowInlineFrames(mozilla::BlockReflowInput&, nsLineLayout&, nsLineList_iterator, nsFlowAreaRect&, int&, nsFloatManager::SavedState*, bool*, LineReflowStatus*, bool) /home/worker/workspace/build/src/layout/generic/nsBlockFrame.cpp:3921:5
    #7 0x7f88544b4aad in nsBlockFrame::ReflowInlineFrames(mozilla::BlockReflowInput&, nsLineList_iterator, bool*) /home/worker/workspace/build/src/layout/generic/nsBlockFrame.cpp:3795:9
    #8 0x7f88544ae654 in nsBlockFrame::ReflowLine(mozilla::BlockReflowInput&, nsLineList_iterator, bool*) /home/worker/workspace/build/src/layout/generic/nsBlockFrame.cpp:2801:5
...
see log.txt

Comment 1

[Tyson Smith [:tsmith]]

Attachment: test_case.html

Comment 2

[Daniel Holbert [:dholbert]]

Looks like jwatt added this assertion in bug 1080688. Tentatively tagging him for initial thoughts/triage.

Comment 3

[Jonathan Watt [:jwatt]]

Attachment: SVG testcase

This is what we basically get after processing the previous testcase with the HTML parser. We end up with a path with a single point with massive (50e90%) stroke-width. (It's a bit weird that the bounding box isn't empty given that the default for stroke-linecap is 'butt', but adding a second point would give the same huge result. If content can trigger this assertion then we simply need to decide what we should do at that point in the code to handle infinite bbox (maybe ignore it?).

Comment 4

[Firefox Bug Husbandry Bot]

https://wiki.mozilla.org/Bug_Triage/Projects/Bug_Handling/Bug_Husbandry#Move_fix-optionals

Comment 7

[Tyson Smith [:tsmith]]

This has been detected by live site testing.