Closed Bug 1404086 Opened 7 years ago Closed 2 years ago

Assertion failure: inverted (Attempted to get the inverse of a non-invertible matrix) [@ gfxContext::DeviceToUser]

Categories

(Core :: Graphics, defect, P3)

defect

Tracking

()

RESOLVED FIXED
106 Branch
Tracking Status
firefox-esr52 --- wontfix
firefox-esr78 --- wontfix
firefox-esr91 --- wontfix
firefox-esr102 --- wontfix
firefox55 --- wontfix
firefox56 --- wontfix
firefox57 --- wontfix
firefox58 --- wontfix
firefox59 --- wontfix
firefox86 --- wontfix
firefox87 --- wontfix
firefox88 --- wontfix
firefox103 --- wontfix
firefox104 --- wontfix
firefox105 --- wontfix
firefox106 --- fixed

People

(Reporter: tsmith, Assigned: nical)

References

(Blocks 1 open bug)

Details

(Keywords: assertion, testcase, Whiteboard: [gfx-noted])

Attachments

(2 files)

Attached file test_case.html
Assertion failure: inverted (Attempted to get the inverse of a non-invertible matrix), at /src/obj-firefox/dist/include/mozilla/gfx/Matrix.h:276

#0 mozilla::gfx::BaseMatrix<float>::Inverse() const /src/obj-firefox/dist/include/mozilla/gfx/Matrix.h:276:5
#1 gfxContext::DeviceToUser(mozilla::gfx::PointTyped<mozilla::gfx::UnknownUnits, double> const&) const /src/gfx/thebes/gfxContext.cpp:336:33
#2 nsLayoutUtils::GetSnappedBaselineY(nsIFrame*, gfxContext*, int, int) /src/layout/base/nsLayoutUtils.cpp:5882:20
#3 nsTextFrame::PaintText(nsTextFrame::PaintTextParams const&, nsCharClipDisplayItem const&, float) /src/layout/generic/nsTextFrame.cpp:7152:16
#4 SVGTextFrame::PaintSVG(gfxContext&, mozilla::gfx::BaseMatrix<double> const&, mozilla::image::imgDrawingParams&, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const*) /src/layout/svg/SVGTextFrame.cpp:3708:16
#5 nsDisplaySVGText::Paint(nsDisplayListBuilder*, gfxContext*) /src/layout/svg/SVGTextFrame.cpp:3150:39
#6 mozilla::FrameLayerBuilder::PaintItems(nsTArray<mozilla::FrameLayerBuilder::ClippedDisplayItem>&, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&, gfxContext*, nsDisplayListBuilder*, nsPresContext*, mozilla::gfx::IntPointTyped<mozilla::gfx::UnknownUnits> const&, float, float, int) /src/layout/painting/FrameLayerBuilder.cpp:6055:21
#7 mozilla::FrameLayerBuilder::DrawPaintedLayer(mozilla::layers::PaintedLayer*, gfxContext*, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, mozilla::layers::DrawRegionClip, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, void*) /src/layout/painting/FrameLayerBuilder.cpp:6222:19
#8 mozilla::layers::ClientPaintedLayer::PaintThebes(nsTArray<mozilla::layers::ReadbackProcessor::Update>*) /src/gfx/layers/client/ClientPaintedLayer.cpp:166:5
#9 mozilla::layers::ClientPaintedLayer::RenderLayerWithReadback(mozilla::layers::ReadbackProcessor*) /src/gfx/layers/client/ClientPaintedLayer.cpp:297:3
#10 mozilla::layers::ClientContainerLayer::RenderLayer() /src/gfx/layers/client/ClientContainerLayer.h:57:29
#11 mozilla::layers::ClientContainerLayer::RenderLayer() /src/gfx/layers/client/ClientContainerLayer.h:57:29
#12 mozilla::layers::ClientLayerManager::EndTransactionInternal(void (*)(mozilla::layers::PaintedLayer*, gfxContext*, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, mozilla::layers::DrawRegionClip, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, void*), void*, mozilla::layers::LayerManager::EndTransactionFlags) /src/gfx/layers/client/ClientLayerManager.cpp:380:13
#13 mozilla::layers::ClientLayerManager::EndTransaction(void (*)(mozilla::layers::PaintedLayer*, gfxContext*, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, mozilla::layers::DrawRegionClip, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, void*), void*, mozilla::layers::LayerManager::EndTransactionFlags) /src/gfx/layers/client/ClientLayerManager.cpp:438:3
#14 nsDisplayList::PaintRoot(nsDisplayListBuilder*, gfxContext*, unsigned int) /src/layout/painting/nsDisplayList.cpp:2351:17
#15 nsLayoutUtils::PaintFrame(gfxContext*, nsIFrame*, nsRegion const&, unsigned int, nsDisplayListBuilderMode, nsLayoutUtils::PaintFrameFlags) /src/layout/base/nsLayoutUtils.cpp:3823:12
#16 mozilla::PresShell::Paint(nsView*, nsRegion const&, unsigned int) /src/layout/base/PresShell.cpp:6454:5
#17 nsViewManager::ProcessPendingUpdatesPaint(nsIWidget*) /src/view/nsViewManager.cpp:480:19
#18 nsViewManager::ProcessPendingUpdatesForView(nsView*, bool) /src/view/nsViewManager.cpp:412:33
#19 nsViewManager::ProcessPendingUpdates() /src/view/nsViewManager.cpp:1102:5
#20 nsRefreshDriver::Tick(long, mozilla::TimeStamp) /src/layout/base/nsRefreshDriver.cpp:2082:11
#21 mozilla::RefreshDriverTimer::TickRefreshDrivers(long, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver> >&) /src/layout/base/nsRefreshDriver.cpp:307:7
#22 mozilla::RefreshDriverTimer::Tick(long, mozilla::TimeStamp) /src/layout/base/nsRefreshDriver.cpp:329:5
#23 mozilla::VsyncRefreshDriverTimer::RunRefreshDrivers(mozilla::TimeStamp) /src/layout/base/nsRefreshDriver.cpp:770:5
#24 mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::TickRefreshDriver(mozilla::TimeStamp) /src/layout/base/nsRefreshDriver.cpp:683:35
#25 mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::ParentProcessVsyncNotifier::Run() /src/layout/base/nsRefreshDriver.cpp:529:20
#26 nsThread::ProcessNextEvent(bool, bool*) /src/xpcom/threads/nsThread.cpp:1039:14
#27 NS_ProcessNextEvent(nsIThread*, bool) /src/xpcom/threads/nsThreadUtils.cpp:524:10
#28 mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /src/ipc/glue/MessagePump.cpp:97:21
#29 MessageLoop::RunInternal() /src/ipc/chromium/src/base/message_loop.cc:326:10
#30 MessageLoop::Run() /src/ipc/chromium/src/base/message_loop.cc:299:3
#31 nsBaseAppShell::Run() /src/widget/nsBaseAppShell.cpp:158:27
#32 nsAppStartup::Run() /src/toolkit/components/startup/nsAppStartup.cpp:288:30
#33 XREMain::XRE_mainRun() /src/toolkit/xre/nsAppRunner.cpp:4701:22
#34 XREMain::XRE_main(int, char**, mozilla::BootstrapConfig const&) /src/toolkit/xre/nsAppRunner.cpp:4865:8
#35 XRE_main(int, char**, mozilla::BootstrapConfig const&) /src/toolkit/xre/nsAppRunner.cpp:4960:21
#36 do_main(int, char**, char**) /src/browser/app/nsBrowserApp.cpp:236:22
#37 main /src/browser/app/nsBrowserApp.cpp:309:16
#38 __libc_start_main /build/glibc-bfm8X4/glibc-2.23/csu/../csu/libc-start.c:291
#39 _start (firefox+0x41eb24)
Flags: in-testsuite?
I will have a look into it.
Assignee: nobody → vliu
Has Regression Range: --- → no

Are you still looking in to this?

Flags: needinfo?(vincent.liu1013)

The bug assignee didn't login in Bugzilla in the last 7 months.
:bhood, could you have a look please?
For more information, please visit auto_nag documentation.

Assignee: vincent.liu1013 → nobody
Flags: needinfo?(bhood)
Flags: needinfo?(bhood)

Clear a needinfo that is pending on an inactive user.

Inactive users most likely will not respond; if the missing information is essential and cannot be collected another way, the bug maybe should be closed as INCOMPLETE.

For more information, please visit auto_nag documentation.

Flags: needinfo?(vincent.liu1013)
Status: NEW → RESOLVED
Closed: 2 years ago
Resolution: --- → INCOMPLETE

The attached test case still reproduces the issue. The fuzzer are also still reporting this issue.

:bhood, is there someone that can have a look? Or if this assertion is not providing any value perhaps downgrade it to a warning?

Status: RESOLVED → REOPENED
Flags: needinfo?(bhood)
Resolution: INCOMPLETE → ---
Flags: needinfo?(nical.bugzilla)
Flags: needinfo?(bhood)

We run into an non invertible transform because while building the matrix, it is scaled by a zero scale factor that was produced here: https://searchfox.org/mozilla-central/rev/8dd35cd8f5284fbaa506aab02fe42fc87efb249e/layout/svg/SVGTextFrame.cpp#4906 with expectedTextLength also begin equal to zero. Looking at the test case, it explicitly sets the text length to zero, so I guess there's no need to seach further for reasons why we get this value.

I'm not intimate with the text layout code but my uneducated guess would be that in this case we should bail out earlier, maybe in nsTextFrame::PaintText either after checking whether the scale factor is zero (or the text length itself), or if we think that there's a lot of other wonky input that can get us in this situation, by checking early if the matrix is invertible.

Jonathan, does that sound right?

Flags: needinfo?(jfkthame)

Yeah, the text is being forcibly scaled to zero size, so we can bail out of attempting to paint -- nothing's going to be visible.

It looks to me like we could do an early-return from SVGTextFrame::PaintSVG if mLengthAdjustScaleFactor is zero, somewhere around here. (It needs to be after we've called UpdateGlyphPositioning if necessary, as that's what will set the scale factor.)

We could explicitly check in nsTextFrame::PaintText that the current matrix is invertible, but I guess that's a bit more expensive so let's try to avoid it. In general we aim to short-circuit text painting when the size computes to zero, but this case is a somewhat more obscure way to achieve that.

Flags: needinfo?(jfkthame)
Assignee: nobody → nical.bugzilla
Flags: needinfo?(nical.bugzilla)
Pushed by nsilva@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/f9408b84600b
Early-out when the length adjust scale factor is zero. r=jfkthame
Status: REOPENED → RESOLVED
Closed: 2 years ago2 years ago
Resolution: --- → FIXED
Target Milestone: --- → 106 Branch
Flags: in-testsuite? → in-testsuite+
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: