1322852 - SVG triggers assertion: aValue.GetUnit() == eCSSUnit_Null

Status: RESOLVED FIXED

(Core :: SVG, defect, P3)

Description

[Tyson Smith [:tsmith]]

Attachment: log.txt

Assertion failure: aValue.GetUnit() == eCSSUnit_Null (malformed paint server value), at /home/worker/workspace/build/src/layout/style/nsRuleNode.cpp:9277

==31636==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7fcf4e74144e bp 0x7fff20ce97e0 sp 0x7fff20ce9700 T0)
    #0 0x7fcf4e74144d in SetSVGPaint(nsCSSValue const&, nsStyleSVGPaint const&, nsPresContext*, nsStyleContext*, nsStyleSVGPaint&, nsStyleSVGPaintType, mozilla::RuleNodeCacheConditions&) /home/worker/workspace/build/src/layout/style/nsRuleNode.cpp:9276:5
    #1 0x7fcf4e7167e2 in nsRuleNode::ComputeSVGData(void*, nsRuleData const*, nsStyleContext*, nsRuleNode*, nsRuleNode::RuleDetail, mozilla::RuleNodeCacheConditions) /home/worker/workspace/build/src/layout/style/nsRuleNode.cpp:9481:3
    #2 0x7fcf4e70d5b4 in nsRuleNode::WalkRuleTree(nsStyleStructID, nsStyleContext*) /home/worker/workspace/build/src/layout/style/nsRuleNode.cpp:2655:10
    #3 0x7fcf4daa14c4 in nsStyleSVG const* nsRuleNode::GetStyleSVG<true>(nsStyleContext*, unsigned long&) /home/worker/workspace/build/src/obj-firefox/dist/include/nsStyleStructList.h:73:1
    #4 0x7fcf4daa1393 in nsStyleSVG const* nsStyleContext::DoGetStyleSVG<true>() /home/worker/workspace/build/src/obj-firefox/dist/include/nsStyleStructList.h:73:1
    #5 0x7fcf4ecdcac9 in nsSVGUtils::GetGeometryHitTestFlags(nsIFrame*) /home/worker/workspace/build/src/layout/svg/nsSVGUtils.cpp:1753:11
    #6 0x7fcf4ecd9e07 in nsSVGPathGeometryFrame::ReflowSVG() /home/worker/workspace/build/src/layout/svg/nsSVGPathGeometryFrame.cpp:426:27
    #7 0x7fcf4ec86803 in nsSVGDisplayContainerFrame::ReflowSVG() /home/worker/workspace/build/src/layout/svg/nsSVGContainerFrame.cpp:359:7
...
see log.txt

Comment 1

[Tyson Smith [:tsmith]]

Attachment: test.html

Comment 2

[Ryan VanderMeulen [:RyanVM]]

This no longer reproduces.

INFO: First good revision: 4172b6f2400057ae42166effb0179d7a1deacdba
INFO: Last bad revision: 8c810ba464c1fe6fb33a8188fae3f6c727f92769
INFO: Pushlog:
https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=8c810ba464c1fe6fb33a8188fae3f6c727f92769&tochange=4172b6f2400057ae42166effb0179d7a1deacdba

Patch seems relevant to the assertion here. Any reason to leave this open at this point?

Comment 3

[Xidorn Quan [:xidorn] UTC+10]

I believe it doesn't reproduce because we have switched the default style engine to stylo, and this is piece of code in gecko's style system.

It may still be relevant before we actually remove gecko's style system. But since it's an old regression, it's probably not very important to fix at this moment. Let's keep it open for now and close it once we remove Gecko style system?

Comment 4

[Xidorn Quan [:xidorn] UTC+10]

Oh, you mean the assertion has been fixed by that bug, not regressed by that bug?

Then we should close it.

Comment 5

[Ryan VanderMeulen [:RyanVM]]

Thanks for checking! NI me to land a crashtest.

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/935a9beeeb2c
Add crashtest. r=me

Comment 7

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/935a9beeeb2c