1511564 - Interesting: Assertion failure: gradientUnits == SVG_UNIT_TYPE_OBJECTBOUNDINGBOX || gradientUnits == SVG_UNIT_TYPE_USERSPACEONUSE, at src/layout/svg/nsSVGGradientFrame.cpp:223

Status: RESOLVED DUPLICATE of bug 1687195

(Core :: SVG, defect, P2)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Reduced with m-c:
BuildID=20181130200939
SourceStamp=950f6d29da967b9999ce709e94bf35b244f79100

Assertion failure: gradientUnits == SVG_UNIT_TYPE_OBJECTBOUNDINGBOX || gradientUnits == SVG_UNIT_TYPE_USERSPACEONUSE, at src/layout/svg/nsSVGGradientFrame.cpp:223

#0 nsSVGGradientFrame::GetPaintServerPattern(nsIFrame*, mozilla::gfx::DrawTarget const*, mozilla::gfx::BaseMatrix<double> const&, nsStyleSVGPaint nsStyleSVG::*, float, mozilla::image::imgDrawingParams&, mozilla::gfx::RectTyped<mozilla::gfx::UnknownUnits, double> const*) src/layout/svg/nsSVGGradientFrame.cpp:222:3
#1 nsSVGUtils::MakeFillPatternFor(nsIFrame*, gfxContext*, mozilla::gfx::GeneralPattern*, mozilla::image::imgDrawingParams&, mozilla::SVGContextPaint*) src/layout/svg/nsSVGUtils.cpp:1372:13
#2 mozilla::SVGGeometryFrame::Render(gfxContext*, unsigned int, mozilla::gfx::BaseMatrix<double> const&, mozilla::image::imgDrawingParams&) src/layout/svg/SVGGeometryFrame.cpp:687:5
#3 mozilla::SVGGeometryFrame::PaintSVG(gfxContext&, mozilla::gfx::BaseMatrix<double> const&, mozilla::image::imgDrawingParams&, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const*) src/layout/svg/SVGGeometryFrame.cpp:261:5
#4 nsDisplaySVGGeometry::Paint(nsDisplayListBuilder*, gfxContext*) src/layout/svg/SVGGeometryFrame.cpp:122:43
#5 mozilla::FrameLayerBuilder::PaintItems(std::vector<mozilla::AssignedDisplayItem, std::allocator<mozilla::AssignedDisplayItem> >&, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&, gfxContext*, nsDisplayListBuilder*, nsPresContext*, mozilla::gfx::IntPointTyped<mozilla::gfx::UnknownUnits> const&, float, float) src/layout/painting/FrameLayerBuilder.cpp:7027:15
#6 mozilla::FrameLayerBuilder::DrawPaintedLayer(mozilla::layers::PaintedLayer*, gfxContext*, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, mozilla::layers::DrawRegionClip, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, void*) src/layout/painting/FrameLayerBuilder.cpp:7184:19
#7 mozilla::layers::ClientPaintedLayer::RenderLayerWithReadback(mozilla::layers::ReadbackProcessor*) src/gfx/layers/client/ClientPaintedLayer.cpp:150:7
#8 mozilla::layers::ClientContainerLayer::RenderLayer() src/gfx/layers/client/ClientContainerLayer.h:53:29
#9 mozilla::layers::ClientLayerManager::EndTransactionInternal(void (*)(mozilla::layers::PaintedLayer*, gfxContext*, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, mozilla::layers::DrawRegionClip, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, void*), void*, mozilla::layers::LayerManager::EndTransactionFlags) src/gfx/layers/client/ClientLayerManager.cpp:318:13
#10 mozilla::layers::ClientLayerManager::EndTransaction(void (*)(mozilla::layers::PaintedLayer*, gfxContext*, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, mozilla::layers::DrawRegionClip, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, void*), void*, mozilla::layers::LayerManager::EndTransactionFlags) src/gfx/layers/client/ClientLayerManager.cpp:373:3
#11 nsDisplayList::PaintRoot(nsDisplayListBuilder*, gfxContext*, unsigned int) src/layout/painting/nsDisplayList.cpp:2740:19
#12 nsLayoutUtils::PaintFrame(gfxContext*, nsIFrame*, nsRegion const&, unsigned int, nsDisplayListBuilderMode, nsLayoutUtils::PaintFrameFlags) src/layout/base/nsLayoutUtils.cpp:3786:12
#13 mozilla::PresShell::Paint(nsView*, nsRegion const&, unsigned int) src/layout/base/PresShell.cpp:5971:5
#14 nsViewManager::ProcessPendingUpdatesPaint(nsIWidget*) src/view/nsViewManager.cpp:461:19
#15 nsViewManager::ProcessPendingUpdatesForView(nsView*, bool) src/view/nsViewManager.cpp:396:33
#16 nsViewManager::ProcessPendingUpdates() src/view/nsViewManager.cpp:1030:5
#17 nsRefreshDriver::Tick(mozilla::TimeStamp) src/layout/base/nsRefreshDriver.cpp:1893:11
#18 mozilla::RefreshDriverTimer::TickRefreshDrivers(mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver> >&) src/layout/base/nsRefreshDriver.cpp:304:7
#19 mozilla::RefreshDriverTimer::Tick(mozilla::TimeStamp) src/layout/base/nsRefreshDriver.cpp:321:5
#20 mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::TickRefreshDriver(mozilla::TimeStamp) src/layout/base/nsRefreshDriver.cpp:642:16
#21 mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsync(mozilla::TimeStamp) src/layout/base/nsRefreshDriver.cpp:542:9
#22 mozilla::layout::VsyncChild::RecvNotify(mozilla::TimeStamp const&) src/layout/ipc/VsyncChild.cpp:66:16
#23 mozilla::layout::PVsyncChild::OnMessageReceived(IPC::Message const&) src/obj-firefox/ipc/ipdl/PVsyncChild.cpp:167:20
#24 mozilla::ipc::PBackgroundChild::OnMessageReceived(IPC::Message const&) src/obj-firefox/ipc/ipdl/PBackgroundChild.cpp:2721:28
#25 mozilla::ipc::MessageChannel::DispatchAsyncMessage(IPC::Message const&) src/ipc/glue/MessageChannel.cpp:2124:21
#26 mozilla::ipc::MessageChannel::DispatchMessage(IPC::Message&&) src/ipc/glue/MessageChannel.cpp:2051:9
#27 mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::MessageChannel::MessageTask&) src/ipc/glue/MessageChannel.cpp:1900:3
#28 mozilla::ipc::MessageChannel::MessageTask::Run() src/ipc/glue/MessageChannel.cpp:1931:13
#29 nsThread::ProcessNextEvent(bool, bool*) src/xpcom/threads/nsThread.cpp:1157:14
#30 NS_ProcessNextEvent(nsIThread*, bool) src/xpcom/threads/nsThreadUtils.cpp:468:10
#31 mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:88:21
#32 MessageLoop::RunInternal() src/ipc/chromium/src/base/message_loop.cc:314:10
#33 MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:289:3
#34 nsBaseAppShell::Run() src/widget/nsBaseAppShell.cpp:137:27
#35 XRE_RunAppShell() src/toolkit/xre/nsEmbedFunctions.cpp:915:20
#36 mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:238:9
#37 MessageLoop::RunInternal() src/ipc/chromium/src/base/message_loop.cc:314:10
#38 MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:289:3
#39 XRE_InitChildProcess(int, char**, XREChildData const*) src/toolkit/xre/nsEmbedFunctions.cpp:753:34
#40 content_process_main(mozilla::Bootstrap*, int, char**) src/browser/app/../../ipc/contentproc/plugin-container.cpp:49:28
#41 main src/browser/app/nsBrowserApp.cpp:265:18
#42 __libc_start_main /build/glibc-Cl5G7W/glibc-2.23/csu/../csu/libc-start.c:291
#43 _start (firefox+0x349f4)

Comment 1

[Jonathan Watt [:jwatt]]

Attachment: Bug 1511564. Block setting of bad SVG enum values. r=longsonr

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

There's a r+ patch which didn't land and no activity in this bug for 2 weeks.
:jwatt, could you have a look please?

Comment 3

[Bob Clary [:bc] (inactive)]

fyi, this is still happening. Bughunter found http://www.theybf.com/2018/08/15/tyga-pokes-fun-at-his-customized-hairline-safaree-makes-a-quick-come-up-after-twitter-bee which reproduces for me on Nightly Linux and another url on the site.