1404086 - Assertion failure: inverted (Attempted to get the inverse of a non-invertible matrix) [@ gfxContext::DeviceToUser]

Status: RESOLVED FIXED

(Core :: Graphics, defect, P3)

Description

[Tyson Smith [:tsmith]]

Attachment: test_case.html

Assertion failure: inverted (Attempted to get the inverse of a non-invertible matrix), at /src/obj-firefox/dist/include/mozilla/gfx/Matrix.h:276

#0 mozilla::gfx::BaseMatrix<float>::Inverse() const /src/obj-firefox/dist/include/mozilla/gfx/Matrix.h:276:5
#1 gfxContext::DeviceToUser(mozilla::gfx::PointTyped<mozilla::gfx::UnknownUnits, double> const&) const /src/gfx/thebes/gfxContext.cpp:336:33
#2 nsLayoutUtils::GetSnappedBaselineY(nsIFrame*, gfxContext*, int, int) /src/layout/base/nsLayoutUtils.cpp:5882:20
#3 nsTextFrame::PaintText(nsTextFrame::PaintTextParams const&, nsCharClipDisplayItem const&, float) /src/layout/generic/nsTextFrame.cpp:7152:16
#4 SVGTextFrame::PaintSVG(gfxContext&, mozilla::gfx::BaseMatrix<double> const&, mozilla::image::imgDrawingParams&, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const*) /src/layout/svg/SVGTextFrame.cpp:3708:16
#5 nsDisplaySVGText::Paint(nsDisplayListBuilder*, gfxContext*) /src/layout/svg/SVGTextFrame.cpp:3150:39
#6 mozilla::FrameLayerBuilder::PaintItems(nsTArray<mozilla::FrameLayerBuilder::ClippedDisplayItem>&, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&, gfxContext*, nsDisplayListBuilder*, nsPresContext*, mozilla::gfx::IntPointTyped<mozilla::gfx::UnknownUnits> const&, float, float, int) /src/layout/painting/FrameLayerBuilder.cpp:6055:21
#7 mozilla::FrameLayerBuilder::DrawPaintedLayer(mozilla::layers::PaintedLayer*, gfxContext*, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, mozilla::layers::DrawRegionClip, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, void*) /src/layout/painting/FrameLayerBuilder.cpp:6222:19
#8 mozilla::layers::ClientPaintedLayer::PaintThebes(nsTArray<mozilla::layers::ReadbackProcessor::Update>*) /src/gfx/layers/client/ClientPaintedLayer.cpp:166:5
#9 mozilla::layers::ClientPaintedLayer::RenderLayerWithReadback(mozilla::layers::ReadbackProcessor*) /src/gfx/layers/client/ClientPaintedLayer.cpp:297:3
#10 mozilla::layers::ClientContainerLayer::RenderLayer() /src/gfx/layers/client/ClientContainerLayer.h:57:29
#11 mozilla::layers::ClientContainerLayer::RenderLayer() /src/gfx/layers/client/ClientContainerLayer.h:57:29
#12 mozilla::layers::ClientLayerManager::EndTransactionInternal(void (*)(mozilla::layers::PaintedLayer*, gfxContext*, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, mozilla::layers::DrawRegionClip, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, void*), void*, mozilla::layers::LayerManager::EndTransactionFlags) /src/gfx/layers/client/ClientLayerManager.cpp:380:13
#13 mozilla::layers::ClientLayerManager::EndTransaction(void (*)(mozilla::layers::PaintedLayer*, gfxContext*, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, mozilla::layers::DrawRegionClip, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, void*), void*, mozilla::layers::LayerManager::EndTransactionFlags) /src/gfx/layers/client/ClientLayerManager.cpp:438:3
#14 nsDisplayList::PaintRoot(nsDisplayListBuilder*, gfxContext*, unsigned int) /src/layout/painting/nsDisplayList.cpp:2351:17
#15 nsLayoutUtils::PaintFrame(gfxContext*, nsIFrame*, nsRegion const&, unsigned int, nsDisplayListBuilderMode, nsLayoutUtils::PaintFrameFlags) /src/layout/base/nsLayoutUtils.cpp:3823:12
#16 mozilla::PresShell::Paint(nsView*, nsRegion const&, unsigned int) /src/layout/base/PresShell.cpp:6454:5
#17 nsViewManager::ProcessPendingUpdatesPaint(nsIWidget*) /src/view/nsViewManager.cpp:480:19
#18 nsViewManager::ProcessPendingUpdatesForView(nsView*, bool) /src/view/nsViewManager.cpp:412:33
#19 nsViewManager::ProcessPendingUpdates() /src/view/nsViewManager.cpp:1102:5
#20 nsRefreshDriver::Tick(long, mozilla::TimeStamp) /src/layout/base/nsRefreshDriver.cpp:2082:11
#21 mozilla::RefreshDriverTimer::TickRefreshDrivers(long, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver> >&) /src/layout/base/nsRefreshDriver.cpp:307:7
#22 mozilla::RefreshDriverTimer::Tick(long, mozilla::TimeStamp) /src/layout/base/nsRefreshDriver.cpp:329:5
#23 mozilla::VsyncRefreshDriverTimer::RunRefreshDrivers(mozilla::TimeStamp) /src/layout/base/nsRefreshDriver.cpp:770:5
#24 mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::TickRefreshDriver(mozilla::TimeStamp) /src/layout/base/nsRefreshDriver.cpp:683:35
#25 mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::ParentProcessVsyncNotifier::Run() /src/layout/base/nsRefreshDriver.cpp:529:20
#26 nsThread::ProcessNextEvent(bool, bool*) /src/xpcom/threads/nsThread.cpp:1039:14
#27 NS_ProcessNextEvent(nsIThread*, bool) /src/xpcom/threads/nsThreadUtils.cpp:524:10
#28 mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /src/ipc/glue/MessagePump.cpp:97:21
#29 MessageLoop::RunInternal() /src/ipc/chromium/src/base/message_loop.cc:326:10
#30 MessageLoop::Run() /src/ipc/chromium/src/base/message_loop.cc:299:3
#31 nsBaseAppShell::Run() /src/widget/nsBaseAppShell.cpp:158:27
#32 nsAppStartup::Run() /src/toolkit/components/startup/nsAppStartup.cpp:288:30
#33 XREMain::XRE_mainRun() /src/toolkit/xre/nsAppRunner.cpp:4701:22
#34 XREMain::XRE_main(int, char**, mozilla::BootstrapConfig const&) /src/toolkit/xre/nsAppRunner.cpp:4865:8
#35 XRE_main(int, char**, mozilla::BootstrapConfig const&) /src/toolkit/xre/nsAppRunner.cpp:4960:21
#36 do_main(int, char**, char**) /src/browser/app/nsBrowserApp.cpp:236:22
#37 main /src/browser/app/nsBrowserApp.cpp:309:16
#38 __libc_start_main /build/glibc-bfm8X4/glibc-2.23/csu/../csu/libc-start.c:291
#39 _start (firefox+0x41eb24)

Comment 1

[Vincent Liu[:vliu]]

I will have a look into it.

Comment 2

[Firefox Bug Husbandry Bot]

https://wiki.mozilla.org/Bug_Triage/Projects/Bug_Handling/Bug_Husbandry#Move_fix-optionals

Comment 3

[Tyson Smith [:tsmith]]

A Pernosco session is available here: https://pernos.co/debug/J-MnW3AATlA6h5Vc9HlXJg/index.html

Comment 4

[Tyson Smith [:tsmith]]

Are you still looking in to this?

Comment 5

[BugBot [:suhaib / :marco/ :calixte]]

The bug assignee didn't login in Bugzilla in the last 7 months.
:bhood, could you have a look please?
For more information, please visit auto_nag documentation.

Comment 6

[BugBot [:suhaib / :marco/ :calixte]]

Clear a needinfo that is pending on an inactive user.

Inactive users most likely will not respond; if the missing information is essential and cannot be collected another way, the bug maybe should be closed as INCOMPLETE.

For more information, please visit auto_nag documentation.

Comment 7

[Tyson Smith [:tsmith]]

The attached test case still reproduces the issue. The fuzzer are also still reporting this issue.

:bhood, is there someone that can have a look? Or if this assertion is not providing any value perhaps downgrade it to a warning?

Comment 8

[Nicolas Silva [:nical]]

We run into an non invertible transform because while building the matrix, it is scaled by a zero scale factor that was produced here: https://searchfox.org/mozilla-central/rev/8dd35cd8f5284fbaa506aab02fe42fc87efb249e/layout/svg/SVGTextFrame.cpp#4906 with expectedTextLength also begin equal to zero. Looking at the test case, it explicitly sets the text length to zero, so I guess there's no need to seach further for reasons why we get this value.

I'm not intimate with the text layout code but my uneducated guess would be that in this case we should bail out earlier, maybe in nsTextFrame::PaintText either after checking whether the scale factor is zero (or the text length itself), or if we think that there's a lot of other wonky input that can get us in this situation, by checking early if the matrix is invertible.

Jonathan, does that sound right?

Comment 9

[Jonathan Kew [:jfkthame]]

Yeah, the text is being forcibly scaled to zero size, so we can bail out of attempting to paint -- nothing's going to be visible.

It looks to me like we could do an early-return from SVGTextFrame::PaintSVG if mLengthAdjustScaleFactor is zero, somewhere around here. (It needs to be after we've called UpdateGlyphPositioning if necessary, as that's what will set the scale factor.)

We could explicitly check in nsTextFrame::PaintText that the current matrix is invertible, but I guess that's a bit more expensive so let's try to avoid it. In general we aim to short-circuit text painting when the size computes to zero, but this case is a somewhat more obscure way to achieve that.

Comment 10

[Nicolas Silva [:nical]]

Attachment: Bug 1404086 - Early-out when the length adjust scale factor is zero. r=jfkthame

Comment 11

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/f9408b84600b
Early-out when the length adjust scale factor is zero. r=jfkthame

Comment 12

[Andreea Pavel [:apavel]]

https://hg.mozilla.org/mozilla-central/rev/f9408b84600b